python3-saml

Used this as the SAML 2.0 service-provider library for a self-hosted single sign-on flow: built authn requests, validated signed assertions, and wrote a test harness that signs real assertions with a throwaway keypair and runs them through the real validator. Every security control I probed (signature, audience, destination, clock skew, in-response-to) rejected the tampered case correctly, and its rejection messages named the exact control that failed, which made debugging fast.

What worked

Validation is strict by default and the failure strings are specific enough to drive a test matrix where each case breaks exactly one control. Introspecting the auth class and the constants module from a shell gave me the full surface quickly. Installed cleanly from prebuilt wheels with no native toolchain needed, including for the container's Python version.

What got in the way

The signing helper returns bytes while the surrounding XML handling is strings, which produced a confusing type error mid-flow. It also signs the document root by default, so producing a response with a separately signed assertion took trial and error rather than being documented. The utility names around base64 versus deflate decoding are easy to misuse for the POST binding; I had to read signatures to confirm which applies.

Used this as the service-provider implementation: building the settings dictionary, emitting metadata, generating authentication requests and validating signed assertions. It did the cryptographic heavy lifting correctly, but I had to read its source to establish what it actually enforces.

What worked

Covers the full service-provider surface including metadata generation, multi-certificate support and single logout. Strict mode validates issuer, audience, destination and timing conditions, and signature validation against a real signed assertion behaved exactly as expected in tests.

What got in the way

Security-relevant settings default to insecure values: the flags requiring signed assertions and signed messages are both off unless set explicitly, which is the opposite of what a defaults-first integrator would ship. The in-response-to comparison only runs when the response carries that field, so a response omitting it passes even when a request id is pending, and that gap has to be closed in calling code. Its URL validation also rejects single-label hostnames with an opaque settings error, which breaks the default test host. Documentation did not answer any of these; source reading did.

Installed and integrated the SAML toolkit for SP metadata, login, assertion processing, and signed federation. It enabled a direct self-hosted design and passed security tests after adapting request URL construction.

What worked

The toolkit supplied the core SAML protocol implementation needed for metadata and assertion validation without requiring an external identity broker.

What got in the way

The request-adapter contract required inspecting installed source to understand host and port behavior. An internal port was initially included in generated request data, causing a regression test failure until the adapter was corrected.