pressly / saml Goto Github PK

https://github.com/goware/saml/blob/master/files.go#L11

https://github.com/spf13/afero
https://github.com/blang/vfs
or byte buffer
or similar..

1. Provide a tool that anonymizes SAML response (pretty much anything about IdP and all the PIIs) and rewrites the signature (cat saml-response.xml | go run cmd/saml-response-anonymizer/main.go > anonymized-saml-response.xml)
2. Kick of a test suite with SAML response examples, where we ideally call out what's the IdP behind the scenes (OneLogin etc.)

We support redirect only at this point. I think we should support POST to IdP as well.

GET /login => POST {IdP} => POST /acs

Thoughts @xiam ?

I find using word "Middleware" very misleading in the context of this package, ie.:

middleware := sp.NewMiddleware(&serviceProvider)

middleware := idp.NewMiddleware(&identityProvider)

Both objects are not "middlewares" in my opinion. Instead, they provide end handlers,
ie. middleware.ServeMetadata.

I think of "middleware" as of onion pattern that wraps the http.Handler, see https://github.com/go-chi/chi#middleware-handlers.

Can we get rid of word "Middleware"?

How about this:

	r := chi.NewRouter()

	sp := saml.ServiceProvider{
		CertFile: *flagPubCert,
		KeyFile:  *flagPrivKey,

		IdPMetadataURL: *flagMetadataURL,

		MetadataURL: *flagPublicURL + metadataPath,
		AcsURL:      *flagPublicURL + acsPath,

		SecurityOpts: saml.SecurityOpts{
			AllowSelfSignedCert: true,
		},
	}

	r.Get("/metadata.xml", sp.MetadataHandler)
	r.Post("/acs", sp.ACSHandler))