wai-saml2: SAML2 assertion validation as WAI middleware

[ library, mit, security ] [ Propose Tags ]

A Haskell library which implements SAML2 assertion validation as WAI middleware

[Skip to Readme]


Note: This package has metadata revisions in the cabal description newer than included in the tarball. To unpack the package including the revisions, use 'cabal get'.

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees


Versions [RSS],,,,,,,, 0.4, 0.5 (info)
Change log CHANGELOG.md
Dependencies base (>=4.8 && <5), base16-bytestring (>=0.1 && <1.1), base64-bytestring (>=0.1 && <2), bytestring (>=0.9 && <0.13), c14n (>= && <1), containers (>=0.6 && <0.7), cryptonite (<1), data-default-class (<1), http-types (<1), mtl (>=2.2.1 && <3), network-uri (>=2.0 && <3), text (<2.2), time (>=1.9 && <2), vault (>=0.3 && <1), wai (>=3.0 && <4), wai-extra (>=3.0 && <4), x509 (<2), x509-store (<2), xml-conduit (<2), zlib (>= && <0.8) [details]
License MIT
Copyright Copyright (c) Michael B. Gale
Author Michael B. Gale
Maintainer github@michael-gale.co.uk
Revised Revision 2 made by mbg at 2024-03-02T23:52:56Z
Category Security
Home page https://github.com/mbg/wai-saml2#readme
Bug tracker https://github.com/mbg/wai-saml2/issues
Source repo head: git clone https://github.com/mbg/wai-saml2
Uploaded by mbg at 2023-08-22T22:50:58Z
Distributions LTSHaskell:0.5
Downloads 1252 total (28 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs available [build log]
Last success reported on 2023-08-22 [all 1 reports]

Readme for wai-saml2-0.5

[back to package description]


GitHub Haskell CI stackage-nightly Hackage

A Haskell library which implements SAML2 assertion validation as WAI middleware. This can be used by a Haskell web application (the service provider, SP) to perform identity provider (IdP) initiated authentication, i.e. SAML2-based authentication where the authentication begins at the IdP-end, the IdP authenticates the user, and then gets the user to submit a SAML2 assertion back to the SP (known as "unsolicited SSO" within e.g. the Shibboleth project).


There are currently a number of limitations to this library:

  • The library implements IdP-initiated authentication and has some support for SP-initiated authentication (See the documentation for the Network.Wai.SAML2.Request module)

  • The library does not currently support the full SAML2 specification and makes certain assumptions about what the IdP's responses contain. It will most likely fail with any IdPs which do not send responses in the same format. If you wish to use this library and encounter problems with your IdP, please open an issue or a pull request which implements support accordingly.


The library is estimated to be sufficiently robust for use in a production environment. If you wish to implement this middleware, please note the following:

  • You must store IDs of assertions you see. If an assertion is successfully validated by this library, you must check that you have not previously seen the assertion ID in order to prevent replay attacks.

  • You must not expose any errors to a client as that could severely compromise the security of the system as attackers may be able to use the errors to narrow down valid SAML responses. You should log and monitor errors though as they may indicate attacks on your system. Ensure that log files containing errors from the SAML2 middleware are stored securely.



You need to have registered your service provider with the identity provider. You need to have access to the IdP's metadata, which will contain the public key used for signature validation.


The saml2Config function may be used to construct SAML2Config values. It expects at least the SP's private key and the IdP's public key as arguments (even when mandatory encryption is disabled) but you should almost certainly customise the configuration further. The private and public keys can be loaded with functions from the Data.X509 and Data.X509.File modules (from the x509 and x509-store packages, respectively):

(saml2Config spPrivateKey idpPublicKey){
    saml2AssertionPath = "/sso/assert",
    saml2ExpectedIssuer = Just "https://idp.sp.com/saml2",
    saml2ExpectedDestination = Just "https://example.com/sso/assert",

The configuration options are documented in the Haddock documentation for the Network.Wai.SAML2.Config module.


Two interfaces to the middleware are provided. See the Haddock documentation for the Network.Wai.SAML2 module for full usage examples. An example using the saml2Callback variant is shown below, where cfg is a SAML2Config value and app is your existing WAI application:

saml2Callback cfg callback mainApp
 where callback (Left err) app req sendResponse = do
           -- a POST request was made to the assertion endpoint, but
           -- something went wrong, details of which are provided by
           -- the error: this should probably be logged as it may
           -- indicate that an attack was attempted against the
           -- endpoint, but you *must* not show the error
           -- to the client as it would severely compromise
           -- system security
           -- you may also want to return e.g. a HTTP 400 or 401 status
       callback (Right result) app req sendResponse = do
           -- a POST request was made to the assertion endpoint and the
           -- SAML2 response was successfully validated:
           -- you *must* check that you have not encountered the
           -- assertion ID before; we assume that there is a
           -- computation tryRetrieveAssertion which looks up
           -- assertions by ID in e.g. a database
           result <- tryRetrieveAssertion (assertionId (assertion result))

           case result of
               Just something -> -- a replay attack has occurred
               Nothing -> do
                   -- store the assertion id somewhere
                   storeAssertion (assertionId (assertion result))

                   -- the assertion is valid and you can now e.g.
                   -- retrieve user data from your database
                   -- before proceeding with the request by e.g.
                   -- redirecting them to the main view


Please see CONTRIBUTING.md