jam.saml.signature¶

signature ¶

Functions:

Name	Description
`extract_public_key_from_keyinfo`	Extract the RSA public key from an XML Signature's KeyInfo/X509Data.
`load_private_key`	Load an RSA private key from a PEM string.
`load_public_key`	Load an RSA public key from a PEM string or X.509 certificate.
`sign_assertion`	Sign a SAML Assertion with an enveloped XML signature.
`verify_assertion_signature`	Verify the enveloped XML signature on a SAML Assertion.

extract_public_key_from_keyinfo(
    sig: Element,
) -> RSAPublicKey

Extract the RSA public key from an XML Signature's KeyInfo/X509Data.

Parameters:

Name	Type	Description	Default
`sig`	`Element`	The Signature Element containing KeyInfo.	required

Returns:

Type	Description
`RSAPublicKey`	RSAPublicKey.

Raises:

Type	Description
`JamSAMLValidationError`	If KeyInfo is missing or no certificate found.

load_private_key(pem_str: str) -> RSAPrivateKey

Load an RSA private key from a PEM string.

Parameters:

Name	Type	Description	Default
`pem_str`	`str`	PEM-encoded private key.	required

Returns:

Type	Description
`RSAPrivateKey`	RSAPrivateKey.

Raises:

Type	Description
`JamSAMLValidationError`	If key is not RSA.

load_public_key(pem_str: str) -> RSAPublicKey

Load an RSA public key from a PEM string or X.509 certificate.

Parameters:

Name	Type	Description	Default
`pem_str`	`str`	PEM-encoded public key or certificate.	required

Returns:

Type	Description
`RSAPublicKey`	RSAPublicKey.

Raises:

Type	Description
`JamSAMLValidationError`	If key is not RSA.

sign_assertion(
    assertion: Element,
    key: RSAPrivateKey,
    cert_pem: str | None = None,
) -> Element

Sign a SAML Assertion with an enveloped XML signature.

The signature is added as a child of the Assertion element. Uses RSA-SHA256 and Exclusive XML Canonicalization.

Parameters:

Name	Type	Description	Default
`assertion`	`Element`	The Assertion Element to sign (must have an ID attribute).	required
`key`	`RSAPrivateKey`	RSA private key for signing.	required
`cert_pem`	`str \| None`	Optional PEM certificate for X509Data in KeyInfo.	`None`

Returns:

Type	Description
`Element`	The assertion Element with Signature child appended.

Raises:

Type	Description
`JamSAMLValidationError`	If assertion has no ID.

verify_assertion_signature(
    assertion: Element, key: RSAPublicKey | None = None
) -> bool

Verify the enveloped XML signature on a SAML Assertion.

Verifies both the digest (content integrity) and the RSA signature.

Parameters:

Name	Type	Description	Default
`assertion`	`Element`	The Assertion Element containing a Signature child.	required
`key`	`RSAPublicKey \| None`	RSA public key. If None, extracted from KeyInfo in the signature.	`None`

Returns:

Type	Description
`bool`	True if signature is valid.

Raises:

Type	Description
`JamSAMLValidationError`	If signature is missing, malformed, or invalid.