apron-saml

Stateless Service-Provider-side SAML 2.0 protocol library: build AuthnRequests, parse IdP metadata, decode SAML Responses, and validate assertions — as an importable primitive, never a service.

Part of the apron-* family of stateless protocol primitives. Like the others, apron-saml owns protocol mechanics only: it holds no state, opens no sockets, and persists nothing. Storage, sessions, and the stateful federation belong to the consuming application.

Status: scaffolding. The public surface below is the target API (pending the API-surface ADR); most of it currently raises NotImplementedError. Track progress in the issue backlog.

Scope

  • In scope (v1): SP-side consumption — build authentication requests, parse IdP / generate SP metadata, decode Responses, and validate assertions (signature, XML-Signature-Wrapping hardening, Conditions, SubjectConfirmation, replay prevention, optional encrypted-assertion decryption).
  • Out of scope (v1): issuing assertions (IdP side), Single Logout (SLO), and IdP-initiated SSO — deferred; see the backlog.

All XML-security is delegated to a vetted library, never hand-rolled.

Install

pip install apron-saml

Requires Python 3.11+. Once the XML-security backend lands (tracked in the backlog), a system xmlsec/libxmlsec1 dependency will be required — installation notes will follow here.

Usage (target API)

from apron_saml import ServiceProvider, SamlConfig

sp = ServiceProvider(
    SamlConfig(
        entity_id="https://sp.example.com/metadata",
        acs_url="https://sp.example.com/saml/acs",
        idp_metadata=idp_metadata_xml,   # the caller fetches this; apron-saml does no network I/O
    )
)

# Outbound: start an SP-initiated login.
authn = sp.build_authn_request(relay_state="/dashboard")
redirect_to = authn.redirect_url()

# Inbound: decode, fully validate, and extract the identity (or raise a SamlError subclass).
identity = sp.process_response(saml_response_b64, expected_in_response_to=authn.request_id)

Every rejection raises a SamlError subclass — there are no boolean-returning validators and no silent failure.

Development

make setup   # bootstrap uv + venv + pre-commit
make test    # unit tests
make lint    # ruff + ty via pre-commit

License

Apache-2.0.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for mzai from gravatar.com mzai

License

Apache-2.0

Requires

Python >=3.11

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

apron_saml-0.0.1.tar.gz (30.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

apron_saml-0.0.1-py3-none-any.whl (13.3 kB view details)

Uploaded Python 3

File details

Details for the file apron_saml-0.0.1.tar.gz.

File metadata

  • Download URL: apron_saml-0.0.1.tar.gz
  • Upload date:
  • Size: 30.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for apron_saml-0.0.1.tar.gz
Algorithm Hash digest
SHA256 5af622d1cf9d97b6b1698155a8e34f46697226435eda8e6e6c0f35d2f09391df
MD5 67ebcde470d42295936a45d82ea9e383
BLAKE2b-256 10098f07aa1ac1b9d03c3ad9a35cd2c525cde54b363f670878200319f1a897bb

See more details on using hashes here.

Provenance

The following attestation bundles were made for apron_saml-0.0.1.tar.gz:

Publisher: release.yaml on mozilla-ai/apron-saml

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file apron_saml-0.0.1-py3-none-any.whl.

File metadata

  • Download URL: apron_saml-0.0.1-py3-none-any.whl
  • Upload date:
  • Size: 13.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for apron_saml-0.0.1-py3-none-any.whl
Algorithm Hash digest
SHA256 6bc128e49a48e0d6d78ba7a9eda99d090fc1f9efabfea9b32356b005cb8a4590
MD5 70735242f1f297b3694589a232089de8
BLAKE2b-256 13ed22c53ab99cfbb64c767d2473420e0eb350ef27cc075d615d1b67cca27682

See more details on using hashes here.

Provenance

The following attestation bundles were made for apron_saml-0.0.1-py3-none-any.whl:

Publisher: release.yaml on mozilla-ai/apron-saml

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.0.1 This release

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page