crates/nornir-auth-saml/src/lib.rs
//! # nornir-auth-saml
//!
//! The **SAML 2.0** (enterprise-SSO) Service Provider of the shared edda auth
//! family: [`sp`], a minimal, strict, pure-Rust SP for the HTTP-POST binding
//! with NO C dependency — exclusive C14N, enveloped RSA-SHA2 / ECDSA-P-256
//! XML-DSig against the configured IdP certificate only, one assertion,
//! XSW-proof reads. It is what a guarded static appliance (gunnar) links. It
//! enables ADFS / Entra ID / Okta / Ping / Keycloak SAML estates.
//!
//! There is one SAML path. The samael-backed provider that used to sit beside
//! it (feature `saml`) is gone (A34-14): it checked the audience against
//! samael's default `http://localhost:8080/saml/metadata`, allowed
//! IdP-initiated responses, kept no replay cache and allowed 180 s of skew,
//! and no product ever linked it.
//!
//! Every module is behind a feature, all off by default:
//!
//! * `sp` — the verifier, the `AuthnRequest`, the metadata both ways;
//! * `test-support` — a fake IdP's signer and an in-process fake IdP over
//! HTTP, with throwaway TEST-ONLY keys; never in a release build.
/// The pure-Rust SP verifier (feature `sp`).
#[cfg(feature = "sp")]
pub mod sp;
/// A fake IdP's signer with throwaway TEST-ONLY keys (feature `test-support`).
#[cfg(feature = "test-support")]
pub mod test_support;
/// A fake SAML IdP over HTTP, in process (tests only).
#[cfg(feature = "test-support")]
pub mod fake_idp;