crates/nornir-identity-sso/Cargo.toml
[package]
name = "nornir-identity-sso"
version = "0.1.2" # RA5-24 no default DoH resolver: unnamed = [sso-domain-resolver] refused, nobody asked
edition = "2021"
authors = ["Ignalina ApS"]
description = "Company single sign-on for the nordisk servers, one copy for every product (A34 M-4): an account's own OIDC or SAML 2.0 identity provider, the flows in flight, the IdP's discovery/JWKS cache, the egress guard and the operator's egress switch (airgap by default), per-client limits, the claim/JIT/rebind rules, e-mail domains proven by DNS and named refusal codes. Storage, transport and words stay the product's; every feature is off by default."
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/edda"
keywords = ["auth", "sso", "oidc", "saml", "identity"]
categories = ["authentication"]
[lib]
name = "nornir_identity_sso"
[features]
default = []
# `sso` — the protocol-free half: the egress guard and the operator's switch
# (`guard`, `egress`), the flows and limits in memory (`state`), e-mail domains
# proven by DNS (`domains`), and everything in `rules`. No network client, no XML,
# no JWT.
sso = ["rules", "dep:base64", "dep:getrandom", "dep:serde_json", "dep:nornir-auth-webauthn"]
# `rules` — the pure half a product's STORE applies inside its own transaction: who
# a verified sign-in is (`rules`: claim, rebind, JIT) and the refusal codes
# (`refusal`). sha2 alone, so a storage crate takes it without the egress, the
# memory or the WebAuthn partition.
rules = ["dep:sha2"]
# `oidc` — the relying party over edda's `nornir_auth_oidc::rp` (discovery, PKCE,
# the ID token's checks) and the IdP's discovery/JWKS cache, reached through the
# product's `Egress` only (nornir-auth-oidc's own `online` client stays off).
oidc = ["sso", "dep:nornir-auth-oidc"]
# `saml` — the SP over edda's pure-Rust `nornir_auth_saml::sp` (no samael, no C).
saml = ["sso", "dep:nornir-auth-saml"]
[dependencies]
nornir-auth-oidc = { version = "0.2.0", path = "../nornir-auth-oidc", default-features = false, optional = true }
nornir-auth-saml = { version = "0.1.2", path = "../nornir-auth-saml", default-features = false, features = ["sp"], optional = true }
# The one client partition (IPv4 address, IPv6 /64): A34-6 counts per client as the
# ceremony store does (A34-8).
nornir-auth-webauthn = { version = "0.2.1", path = "../nornir-auth-webauthn", default-features = false, features = ["ceremony"], optional = true }
sha2 = { version = "0.11", optional = true }
base64 = { version = "0.22", optional = true }
getrandom = { version = "0.4", optional = true }
serde_json = { version = "1", optional = true }
[dev-dependencies]
nornir-auth-oidc = { version = "0.2.0", path = "../nornir-auth-oidc", default-features = false, features = ["test-support"] }
nornir-auth-saml = { version = "0.1.2", path = "../nornir-auth-saml", default-features = false, features = ["test-support"] }