search

mbg / wai-saml2

WAI middleware implementing SAML2
MIT License
5 stars 6 forks source link

Support unencrypted assertions #6

Closed mbg closed 2 years ago

mbg commented 3 years ago

This PR will add support for unencrypted assertions (#5).

In particular, we ensure that the configuration's type reflects this: the SAML2Config type is now parameterised over a list of type-level flags reflecting the security configuration. The library defaults are represented simply by an empty type-level list '[] while settings which change the defaults are added to the list so that it is easy to spot if there are potential security issues.

For unencrypted assertions, we have a new smart constructor saml2PlainTextConfig which is like saml2Config, but does not require a private key for the service provider. The resulting type of configuration is SAML2Config '[PlainTextAssertions].

fumieval commented 2 years ago

@mbg Are you actively working on this / do you have any uncommited changes? If not, I'm willing to take over the project

mbg commented 2 years ago

Hi @fumieval! Thanks for offering to help with this! I am not actively working on this PR since no one else expressed interest in #6. There are no uncomitted changes, so if you want to finish the work I started here, that would be very much appreciated :)