jam.saml.binding¶

binding ¶

Functions:

Name	Description
`build_redirect_signature`	Sign a query string for HTTP-Redirect binding with RSA-SHA256.
`build_redirect_url`	Build a signed redirect URL for HTTP-Redirect binding.
`decode_post`	Decode Base64-encoded SAML data from HTTP-POST binding.
`decode_redirect`	Decode Deflate + Base64 SAML data from HTTP-Redirect binding.
`encode_post`	Base64-encode SAML XML for HTTP-POST binding.
`encode_redirect`	Deflate + Base64-encode SAML XML for HTTP-Redirect binding.
`parse_redirect_request`	Parse a SAML redirect binding query string.
`verify_redirect_signature`	Verify an HTTP-Redirect binding signature.

build_redirect_signature(
    signed_query: str, key: RSAPrivateKey
) -> str

Sign a query string for HTTP-Redirect binding with RSA-SHA256.

Parameters:

Name	Type	Description	Default
`signed_query`	`str`	Raw query string (SAMLRequest=SigAlg=...).	required
`key`	`RSAPrivateKey`	RSA private key.	required

Returns:

Type	Description
`str`	Base64-encoded signature.

build_redirect_url(
    base_url: str,
    saml_params: dict[str, str],
    signing_key: RSAPrivateKey | None = None,
) -> str

Build a signed redirect URL for HTTP-Redirect binding.

Parameters:

Name	Type	Description	Default
`base_url`	`str`	IdP SSO endpoint URL.	required
`saml_params`	`dict[str, str]`	Query params (SAMLRequest, RelayState, etc.).	required
`signing_key`	`RSAPrivateKey \| None`	RSA private key for signing (optional).	`None`

Returns:

Type	Description
`str`	Full redirect URL with query string.

decode_post(b64_str: str) -> str

Decode Base64-encoded SAML data from HTTP-POST binding.

decode_redirect(encoded: str) -> str

Decode Deflate + Base64 SAML data from HTTP-Redirect binding.

encode_post(xml_str: str) -> str

Base64-encode SAML XML for HTTP-POST binding.

encode_redirect(xml_str: str) -> str

Deflate + Base64-encode SAML XML for HTTP-Redirect binding.

parse_redirect_request(
    query_string: str,
    verify_key: RSAPublicKey | None = None,
) -> tuple[str, str]

Parse a SAML redirect binding query string.

Parameters:

Name	Type	Description	Default
`query_string`	`str`	The raw query string from the redirect URL.	required
`verify_key`	`RSAPublicKey \| None`	RSA public key to verify signature (optional).	`None`

Returns:

Type	Description
`tuple[str, str]`	Tuple of (decoded SAML XML string, RelayState).

Raises:

Type	Description
`JamSAMLValidationError`	If signature verification fails.

verify_redirect_signature(
    signed_query: str, signature_b64: str, key: RSAPublicKey
) -> bool

Verify an HTTP-Redirect binding signature.

Parameters:

Name	Type	Description	Default
`signed_query`	`str`	Raw query string that was signed.	required
`signature_b64`	`str`	Base64-encoded signature.	required
`key`	`RSAPublicKey`	RSA public key.	required

Returns:

Type	Description
`bool`	True if signature is valid.

Raises:

Type	Description
`JamSAMLValidationError`	If signature is invalid.