SimpleSaml (simple_saml v1.2.0)
This library is a helper for adding SAML service provider functionality without relying on xmerl and thus being vulnerable to atom exhaustion. It does so by using the simple_xml, which in turn uses saxy to generate a string based DOM reprsentation.
Summary
Functions
Parses a base 64 encoded SAML Response and returns the corresponding DOM and a struct containing the assertion from the response.
This function verifies the digest and signature of the XML document using the given public key. It also validates that the timestamp constraints within the assertion are still valid.
Types
Functions
@spec parse_response(String.t()) :: {:ok, {SimpleXml.xml_node(), SimpleSaml.Assertion.t()}} | {:error, any()}
Parses a base 64 encoded SAML Response and returns the corresponding DOM and a struct containing the assertion from the response.
IMPORTANT: This function neither verifies the response signature, nor does it validate the
claims therein. Use the verify_and_validate_response/3
function to do those things instead.
Examples
SAML responses are parsed and the DOM + assertion returned
iex> saml_response = ~S{PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIERlc3RpbmF0aW9uPSJodHRwczovL2xvY2FsLm1ieC5jb206NDAwMS9hdXRoL2FoZWFkL3NzbyIgSUQ9ImlkMjgxNTExODY2NDU1Mzc3NjE0OTUyNTg1NTkiIElzc3VlSW5zdGFudD0iMjAyMy0wNy0xNFQxNzoyMjoyOC4zMjNaIiBWZXJzaW9uPSIyLjAiIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDI6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5IiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cDovL3d3dy5va3RhLmNvbS9leGthNWhhNmJrblk2T2tkODVkNzwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2lkMjgxNTExODY2NDU1Mzc3NjE0OTUyNTg1NTkiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI3NoYTI1NiIvPjxkczpEaWdlc3RWYWx1ZT5Va2EwRWg2eHpZV2VFc3hROFA1eXh0RU1BQndFeEFEMmVuNFdUMW5QQkhFPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5BNUVRRXM2NjN1Ri9NZ0RTNEc0TDJUc0lYYXEvTGZLS1RDNS9wZFdRNm81cHBzeitTWkQ2TmxyL2haamJsZGJ3TFNGN0pXUHVSYVM4cllSUDZHYWg3blV1Rmx2RXNpRVdyRitZbk8ybzdKWHMyaFROckdrKzMyYVBVeWpkaW83TVRBWnFoN1didjFDTCtsV1hnM3cvaW9LTHI1a0Y5aXpMTTBxWDNOMUZ3bnNOdm1lVE1UL2RibGVCVzZiQ3duc0NMNUpFblpqTlBvaUhFRnBOY21kRHBEZUc1Ym5QVnZSUmxIdU1zbXhUU0NyNVoxS09vSUhvZ1Qrdk91VXViYVFnSjNjeC8zTUJyUHlMWFRFaVBtYU81YlNoUVdXNTZ0bU1GekdpUCtkUi8xMGFydVpGbWJlbXNKV21sbzFndmx2Y1VVY3Y0VTMzSWFBdnNtNXlkZUZwZGc9PTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRHFEQ0NBcENnQXdJQkFnSUdBWWo4bEFZa01BMEdDU3FHU0liM0RRRUJDd1VBTUlHVU1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFRwpBMVVFQ0F3S1EyRnNhV1p2Y201cFlURVdNQlFHQTFVRUJ3d05VMkZ1SUVaeVlXNWphWE5qYnpFTk1Bc0dBMVVFQ2d3RVQydDBZVEVVCk1CSUdBMVVFQ3d3TFUxTlBVSEp2ZG1sa1pYSXhGVEFUQmdOVkJBTU1ER1JsZGkwME5UTTBPVGt3TmpFY01Cb0dDU3FHU0liM0RRRUoKQVJZTmFXNW1iMEJ2YTNSaExtTnZiVEFlRncweU16QTJNamN4TVRFM05UbGFGdzB6TXpBMk1qY3hNVEU0TlRsYU1JR1VNUXN3Q1FZRApWUVFHRXdKVlV6RVRNQkVHQTFVRUNBd0tRMkZzYVdadmNtNXBZVEVXTUJRR0ExVUVCd3dOVTJGdUlFWnlZVzVqYVhOamJ6RU5NQXNHCkExVUVDZ3dFVDJ0MFlURVVNQklHQTFVRUN3d0xVMU5QVUhKdmRtbGtaWEl4RlRBVEJnTlZCQU1NREdSbGRpMDBOVE0wT1Rrd05qRWMKTUJvR0NTcUdTSWIzRFFFSkFSWU5hVzVtYjBCdmEzUmhMbU52YlRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQwpnZ0VCQUxURTdJUkcrb1FaQkFTUTdEWTN5ZVRyd0FCZEkyQmdHMkZYS1NrVFBrOWVuTXd0eVV5RFhDT3RlT2cxOCsvL01BMlVUdmdTCkkrbjBmaUFoN0JpN2N4cGltbk9hai9rY2d2cGRuKzV3cEVmU0lES0FlRWc5VklRZjBmei9rczRYa3JOeFJoOGJhNloveXBPVlIyVEwKb3p1OHY2c2pHQ2lxSFNvaVBsNzhLSU5IeDlqTUIzUUdkVEhSeHNUendGUEdjVUV2TzdYdmp4eE1OOUZMWmRIa3d0QTZjWlhEYkhsQQp2K280RWJMSVJxWEZjM3ZGNXJzM0Z6K2NncVozSFZHbTkwVEZGY2JQYngvZUtjdnp5SGRZdDhQNXBpMzY0bWlqdDlOS3ROVjlGOVZkClB6K0dwL3J4bHcwaS9JV3hWMC92QnJXMTBIUGQ0Mmtyc09nSGlieEJZZzhDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUEKcnBZelpFb1ljUm8zWUY3Tnk0Z2RjOE9EU2xQUEtJZEx2d2hVVEdiUGR6SlUyaWZ4ekUvS2VUSEdtRnBqcGFrakRtbVdzcjJqOUZHVQovOVUwU2pxUG1KSFA1Z1liam16K3REM2plYUVrSUJEWnBjWWMrTXZlUWFBN3VETUlMQTJPVWhIdUZ1MFVKVmpHeGwyRUlweGl2QytJCkowUnBCUzVBRVJUNlY5MUZxdjJZbHdiNXNrbGhvWEdEeDlzK2wrVWQxTUxhZXdJdm5VSGRJUnRDMDJidmxoand0MHBuSUNEdEhNaWsKdk9pVFhqVEJKZ2w3WDlRNTFHbTYzNnE5cEpWalMxVDBnUjNjTnQ5SkpFL2ZvRGRPSzhKb3pSRnRGNGoxNHhlZ1hMdDdCVkJJWHVTTwpLNlAxYzA5bUNQUTFWSmJjajAxUzF6ZnJ2WitSWnZyeHIvMGFYUT09PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWwycDpTdGF0dXMgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24gSUQ9ImlkMjgxNTExODY2NDU2OTg4NDUyMDY4NDg3ODE0IiBJc3N1ZUluc3RhbnQ9IjIwMjMtMDctMTRUMTc6MjI6MjguMzIzWiIgVmVyc2lvbj0iMi4wIiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOklzc3VlciBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL3d3dy5va3RhLmNvbS9leGthNWhhNmJrblk2T2tkODVkNzwvc2FtbDI6SXNzdWVyPjxzYW1sMjpTdWJqZWN0PjxzYW1sMjpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjE6bmFtZWlkLWZvcm1hdDp1bnNwZWNpZmllZCI+ZGouamFpbjwvc2FtbDI6TmFtZUlEPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAyMy0wNy0xNFQxNzoyNzoyOC4zMjRaIiBSZWNpcGllbnQ9Imh0dHBzOi8vbG9jYWwubWJ4LmNvbTo0MDAxL2F1dGgvYWhlYWQvc3NvIi8+PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMjMtMDctMTRUMTc6MTc6MjguMzI0WiIgTm90T25PckFmdGVyPSIyMDIzLTA3LTE0VDE3OjI3OjI4LjMyNFoiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT54cU81MkNORUxkMGhWQjl2YVgxZF9kY3d1WUF4R1VTcjwvc2FtbDI6QXVkaWVuY2U+PC9zYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDI6Q29uZGl0aW9ucz48c2FtbDI6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDIzLTA3LTE0VDE3OjIyOjI4LjMyM1oiIFNlc3Npb25JbmRleD0iaWQxNjg5MzU1MzQ4MzIyLjM1NTAxMzgiPjxzYW1sMjpBdXRobkNvbnRleHQ+PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkUHJvdGVjdGVkVHJhbnNwb3J0PC9zYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWwyOkF1dGhuQ29udGV4dD48L3NhbWwyOkF1dGhuU3RhdGVtZW50Pjwvc2FtbDI6QXNzZXJ0aW9uPjwvc2FtbDJwOlJlc3BvbnNlPg==}
iex> {:ok, {_root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> assertion
%SimpleSaml.Assertion{
issuer: "http://www.okta.com/exka5ha6bknY6Okd85d7",
name_id: "dj.jain",
name_id_not_on_or_after: ~U[2023-07-14 17:27:28.324Z],
recipient: "https://local.mbx.com:4001/auth/ahead/sso",
not_before: ~U[2023-07-14 17:17:28.324Z],
not_on_or_after: ~U[2023-07-14 17:27:28.324Z],
audience: "xqO52CNELd0hVB9vaX1d_dcwuYAxGUSr"
}
SAML response with no-prefix namespaces is handled gracefully
iex> saml_response = "PHNhbWxwOlJlc3BvbnNlIElEPSJfNzkyZTIzM2EtODA5ZS00ZmI1LWI0YjEtZmEzYmU1OGUyMmNjIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAyNS0wNS0xMlQwOToxMTo0MS43OThaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyL3NhbWwvc3AvY29uc3VtZS9kdW1teS1tcyIgSW5SZXNwb25zZVRvPSJzYW1sX2Zsb3dfam1kWWxHczlod214N1BYWl9uTDQyM2d4d1M1ZVJtZnAiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxJc3N1ZXIgeG1sbnM9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPmh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzhlNGRhZTczLTg1ODYtNDNmMS04ZTliLThlNWEwOTk0OTA1MC88L0lzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48QXNzZXJ0aW9uIElEPSJfZDJiMGUyOWYtNTdiZC00NTc1LThiMDctODBjNjA5OGUwOTAwIiBJc3N1ZUluc3RhbnQ9IjIwMjUtMDUtMTJUMDk6MTE6NDEuNzk2WiIgVmVyc2lvbj0iMi4wIiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PElzc3Vlcj5odHRwczovL3N0cy53aW5kb3dzLm5ldC84ZTRkYWU3My04NTg2LTQzZjEtOGU5Yi04ZTVhMDk5NDkwNTAvPC9Jc3N1ZXI+PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PFNpZ25lZEluZm8+PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2QyYjBlMjlmLTU3YmQtNDU3NS04YjA3LTgwYzYwOThlMDkwMCI+PFRyYW5zZm9ybXM+PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PERpZ2VzdFZhbHVlPkNJV1hyaEpoK2h1RlpPN2dwSHNqNFI5VFFiMTFBejZUZ2xBWEVrTms4R009PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8+PFNpZ25hdHVyZVZhbHVlPmx0TmNVc00rYXpLbTJTTmFpN0ZPc3BxRGhzK3g4anYzQUNJTFlpNUZQWC9BYTkwRnpJcG44ODVvaW9xanVRVXBRUHRyVDdKcXpLRklXVEJscWhSL3BnZkdBZlJheDE3RVR0ei9MY051bFpPU0RRd1BFZGZKMVV1NlZCSGIyLzg3ZnpxZXJNN0p4Nm9jQXlsRGcyZVpXQTc3dHJXcEZyQlA5RlpuS2s0UEZjSDhPQnZZWUxnWk9YMlc5YW9oUFpDaElhYkpyT1NPUVJrNlg1YlhZdUNHbVYrTW80ZEVYZ0xyYVNndlFtb0VBWnF1elgvTVRHbE5GbUpSVk9UOEFoNHJlaW52WTRKNTEyMVpYMzdCTEZKcDNtYkFVNU1SSXp0eFZ3ZDlYc3FITGFxWGpZVHRjSXlTWHJaNDBQNVh3dFdSYjBkN3paTWJnOU1YaWt3MW5xWDVzdz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE+PFg1MDlDZXJ0aWZpY2F0ZT5NSUlDOERDQ0FkaWdBd0lCQWdJUWEyVU9oOEMrQW9KTEVhRHJaSjhGWnpBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVRJd01BWURWUVFERXlsTmFXTnliM052Wm5RZ1FYcDFjbVVnUm1Wa1pYSmhkR1ZrSUZOVFR5QkRaWEowYVdacFkyRjBaVEFlRncweU5UQTFNRFl4TlRBMk1qVmFGdzB5T0RBMU1EWXhOVEEyTWpSYU1EUXhNakF3QmdOVkJBTVRLVTFwWTNKdmMyOW1kQ0JCZW5WeVpTQkdaV1JsY21GMFpXUWdVMU5QSUVObGNuUnBabWxqWVhSbE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdStDbDRQUHUrWFFEL2VwOVRrTnJvK01oa1NWektCNENWc08ydTR0SUxVY0EvVXg1NGg4WnlyRlNMK3pMblB2MDdvTURLcGRqWEs0ZHQ1T1JKZFFOOWhkM09FMmhJcVFHeG9mT2t4Uk1YV29ITzF2QUw1dEErWHNPYStFV0lEYkFwSS9RUlBLUHRaMWhMaytZL1VLMERNbDFrU3FRN1BTdW0xNmV5UzRSRnhYa1RBY1R2aU84M01LZlB5VG4wYWN4OE15ZVo4dEFIazRoM2FTWDFRNlZrd2Y5SVRsRGR6TElLTzI1ZEZJNnYzNGZNbFQycDJPWjlOT3ovT1NHVHJBWmVmVkpuTHpkVkRmd3NINHo4K0xIemxjNG9BS0JxQ295c0xCd0RqWW9Md1JWTHQrSjBRYUtCeDRQV3pReFRyazgyUmo5KzYvRFUyWGlNbDRDeDdKU1ZRSURBUUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCSnVzOTdlOTRkUnJRdWlhdjlQU1dtV3l2TWd5dkJvWUFpck5FdzM4VkJ6NDJXblZVMCtzU0s0dTdvN1lWUzZJamphZG11M2w2UDZkRDV3YVAwU3dwaHArQ3AyUHMrS3I0NllsdUhIOHE5UTd1RzBjV3cyc3l2SFlKajJTUlUxWTh2cUp0UmlDK09RdHd1aUs2K1g4azNSOTZTTEVZUkc2U0d6dHBVNDBHVmx2NGpLTmhHVEFHWlU3L09STVY2MU9idWdMRGVZT3h5WjVzOCtKMCs0ejRSMDJTdmZpUEhubEZrWVJFNTBDZUNoTW05U0Y1QUJDdTh4c3JIRHZFUm4vZmpUN2Jyd2xKOE5Oa1JnL1FyWnZ0ajFNVThZTlBJT0JZN0d4YVNFVzA2Yit6RE14RzQ4Ynh6cGhuNEdqamxRcC9HeDZGNTBtQVlGbGt1elRtTTJHZFE8L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6ZW1haWxBZGRyZXNzIj5hZHJpYW4uZ3J1bnRrb3dza2lfZ21haWwuY29tI0VYVCNAYWRyaWFuZ3J1bnRrb3dza2lnbWFpbC5vbm1pY3Jvc29mdC5jb208L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89InNhbWxfZmxvd19qbWRZbEdzOWh3bXg3UFhaX25MNDIzZ3h3UzVlUm1mcCIgTm90T25PckFmdGVyPSIyMDI1LTA1LTEyVDEwOjExOjQxLjQ5MloiIFJlY2lwaWVudD0iaHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyL3NhbWwvc3AvY29uc3VtZS9kdW1teS1tcyIvPjwvU3ViamVjdENvbmZpcm1hdGlvbj48L1N1YmplY3Q+PENvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDI1LTA1LTEyVDA5OjA2OjQxLjQ5MloiIE5vdE9uT3JBZnRlcj0iMjAyNS0wNS0xMlQxMDoxMTo0MS40OTJaIj48QXVkaWVuY2VSZXN0cmljdGlvbj48QXVkaWVuY2U+aHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24+PC9Db25kaXRpb25zPjxBdHRyaWJ1dGVTdGF0ZW1lbnQ+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2lkZW50aXR5L2NsYWltcy90ZW5hbnRpZCI+PEF0dHJpYnV0ZVZhbHVlPjhlNGRhZTczLTg1ODYtNDNmMS04ZTliLThlNWEwOTk0OTA1MDwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2lkZW50aXR5L2NsYWltcy9vYmplY3RpZGVudGlmaWVyIj48QXR0cmlidXRlVmFsdWU+MmJjZGM0YTktZTIwZC00Mzc1LTkyYTAtMTU0OGU1MjQxNjUxPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL2Rpc3BsYXluYW1lIj48QXR0cmlidXRlVmFsdWU+QWRyaWFuIEdydW50a293c2tpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL2lkZW50aXR5cHJvdmlkZXIiPjxBdHRyaWJ1dGVWYWx1ZT5saXZlLmNvbTwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2NsYWltcy9hdXRobm1ldGhvZHNyZWZlcmVuY2VzIj48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2F1dGhlbnRpY2F0aW9ubWV0aG9kL3Bhc3N3b3JkPC9BdHRyaWJ1dGVWYWx1ZT48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9jbGFpbXMvbXVsdGlwbGVhdXRobjwvQXR0cmlidXRlVmFsdWU+PEF0dHJpYnV0ZVZhbHVlPmh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwOC8wNi9pZGVudGl0eS9hdXRoZW50aWNhdGlvbm1ldGhvZC91bnNwZWNpZmllZDwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9naXZlbm5hbWUiPjxBdHRyaWJ1dGVWYWx1ZT5BZHJpYW48L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvc3VybmFtZSI+PEF0dHJpYnV0ZVZhbHVlPkdydW50a293c2tpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL2VtYWlsYWRkcmVzcyI+PEF0dHJpYnV0ZVZhbHVlPmFkcmlhbi5ncnVudGtvd3NraUBnbWFpbC5jb208L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSI+PEF0dHJpYnV0ZVZhbHVlPmFkcmlhbi5ncnVudGtvd3NraV9nbWFpbC5jb20jRVhUI0BhZHJpYW5ncnVudGtvd3NraWdtYWlsLm9ubWljcm9zb2Z0LmNvbTwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PC9BdHRyaWJ1dGVTdGF0ZW1lbnQ+PEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAyNS0wNS0wNlQxNDo1MzoyNS4yNzhaIiBTZXNzaW9uSW5kZXg9Il9kMmIwZTI5Zi01N2JkLTQ1NzUtOGIwNy04MGM2MDk4ZTA5MDAiPjxBdXRobkNvbnRleHQ+PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjwvQXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+"
iex> {:ok, {_root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> assertion
%SimpleSaml.Assertion{
attributes: %{
"http://schemas.microsoft.com/claims/authnmethodsreferences" => ["http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password", "http://schemas.microsoft.com/claims/multipleauthn", "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/unspecified"],
"http://schemas.microsoft.com/identity/claims/displayname" => ["Adrian Gruntkowski"],
"http://schemas.microsoft.com/identity/claims/identityprovider" => ["live.com"],
"http://schemas.microsoft.com/identity/claims/objectidentifier" => ["2bcdc4a9-e20d-4375-92a0-1548e5241651"],
"http://schemas.microsoft.com/identity/claims/tenantid" => ["8e4dae73-8586-43f1-8e9b-8e5a09949050"],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" => ["adrian.gruntkowski@gmail.com"],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" => ["Adrian"],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" => ["adrian.gruntkowski_gmail.com#EXT#@adriangruntkowskigmail.onmicrosoft.com"],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" => ["Gruntkowski"]
},
audience: "https://samltest.todo.computer",
issuer: "https://sts.windows.net/8e4dae73-8586-43f1-8e9b-8e5a09949050/",
name_id: "adrian.gruntkowski_gmail.com#EXT#@adriangruntkowskigmail.onmicrosoft.com",
name_id_not_on_or_after: ~U[2025-05-12 10:11:41.492Z],
not_before: ~U[2025-05-12 09:06:41.492Z],
not_on_or_after: ~U[2025-05-12 10:11:41.492Z],
recipient: "https://samltest.todo.computer/saml/sp/consume/dummy-ms"
}
Whitespace in Base64 encoded SAML response payload is ignored
iex> saml_response = "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSMDk3MGNkZTllZDRm\r\nY2NlZDVlZmE2MzY1Mjg3YWQ3YzRjNzViYWUyMyIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMjUtMDUtMTJUMTA6MDg6NDdaIiBEZXN0aW5hdGlv\r\nbj0iaHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyL3NhbWwvc3AvY29u\r\nc3VtZS9kdW1teS1vbmVsb2dpbiIgSW5SZXNwb25zZVRvPSJzYW1sX2Zsb3df\r\nX3kwZFJ0dlBnMHlPOF90eGQyekx2QVlfay1CaGNvTVMiPjxzYW1sOklzc3Vl\r\ncj5odHRwczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8xODM5\r\nOTNkOC1hMDdiLTQ2NWMtOWM3YS05ZDAwODk4YzQ2MDg8L3NhbWw6SXNzdWVy\r\nPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpv\r\nYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2Ft\r\nbHA6U3RhdHVzPjxzYW1sOkFzc2VydGlvbiB4bWxuczpzYW1sPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiB4bWxuczp4cz0iaHR0\r\ncDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOnhzaT0iaHR0\r\ncDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIFZlcnNp\r\nb249IjIuMCIgSUQ9InBmeGJlMjA1OTE4LTE3ZTMtYjQ2NS1jYjk5LTM4MjIy\r\nYTNiOTZkYiIgSXNzdWVJbnN0YW50PSIyMDI1LTA1LTEyVDEwOjA4OjQ3WiI+\r\nPHNhbWw6SXNzdWVyPmh0dHBzOi8vYXBwLm9uZWxvZ2luLmNvbS9zYW1sL21l\r\ndGFkYXRhLzE4Mzk5M2Q4LWEwN2ItNDY1Yy05YzdhLTlkMDA4OThjNDYwODwv\r\nc2FtbDpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3\r\ndy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlNpZ25lZEluZm8+PGRz\r\nOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3\r\nLnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48ZHM6U2lnbmF0dXJl\r\nTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94\r\nbWxkc2lnI3JzYS1zaGExIi8+PGRzOlJlZmVyZW5jZSBVUkk9IiNwZnhiZTIw\r\nNTkxOC0xN2UzLWI0NjUtY2I5OS0zODIyMmEzYjk2ZGIiPjxkczpUcmFuc2Zv\r\ncm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9y\r\nZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpU\r\ncmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEw\r\nL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPmtJcHFtUkF5LzZMd1g5L2Ro\r\naU91NkVXWmpmVT08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwv\r\nZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+YjNXRkdISHZybnZD\r\neVJ6ZE9xNFVzNGppcHFQL2lUVCtwakNQRUJuOWZydDQzZENTM0tSRm1VV3A2\r\naGJ3cFNpU2tVcEd3V05SNW92aDhXSElCVlV0WEVoSks3eXlOanNzUWU1ZGJt\r\ncnI3VUx3VW5YMElXa245ams3eGRYVDV2K1ArZGkxQ3ZTNmFyRHY2ZGloTm9o\r\nVWwzUUlIcDRYc0d0VGVaWE9BS3dCclppamZZais2WWw2MEZOVjFRWkxra2lG\r\nVEpJOXFyajU4dnJaU28vWlIwazNjeHkvNEs2bnROaVB6VmhmWjVtZXU0QkZy\r\nLzhEbGx5UE1XWmVIbFFZYVZMenFTSE1tL1dtcGtESnE1YnBFSVB3cUhaWnc4\r\naTFYeWlUU1J2TWsyYXR6NkFSSlVQdlpmcjdIY1hQQ25iS1B3MHhMMEh6TzlR\r\nNlN6a3N5SUNqRjg3QXd3PT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJ\r\nbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSUQ3akND\r\nQXRhZ0F3SUJBZ0lVVTlsdVFUNjJvVHFtYVMzMXBKMU5wcVljWWhFd0RRWUpL\r\nb1pJaHZjTkFRRUZCUUF3U3pFV01CUUdBMVVFQ2d3TlZFOUVUeUJEYjIxd2RY\r\nUmxjakVWTUJNR0ExVUVDd3dNVDI1bFRHOW5hVzRnU1dSUU1Sb3dHQVlEVlFR\r\nRERCRlBibVZNYjJkcGJpQkJZMk52ZFc1MElEQWVGdzB5TlRBMU1Ea3hNelU1\r\nTURsYUZ3MHpNREExTURreE16VTVNRGxhTUVzeEZqQVVCZ05WQkFvTURWUlBS\r\nRThnUTI5dGNIVjBaWEl4RlRBVEJnTlZCQXNNREU5dVpVeHZaMmx1SUVsa1VE\r\nRWFNQmdHQTFVRUF3d1JUMjVsVEc5bmFXNGdRV05qYjNWdWRDQXdnZ0VpTUEw\r\nR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDcHlXUGxPYUpp\r\naEsxeURVR3NhSVJ2UWQ0am1IMiswS2hVV01mUzYzQTI2UjRhSlJ5eis4U0dZ\r\nSTgyUjBuc2ZWUGxNQkdmZVdrSzZ4WThkSU92eDFIMlhYZ0pZOU81MSt3M1RP\r\nMmNWMWptMTNQM05lMjNldVBYbTB1cDYzR3pqakVSWTZEQzJNem1lN1RCeUJ6\r\nSUhkVkFwamNNSDd5Q2tpdk1yL21xRm0vaEVjaDhSbTUwRmhFTWFUM0VhUTRP\r\nS3VmSmZhR09mRzVDZFhPV0h4VGJyZ3pMdVpNUzRZb3Z5aTJrSVMrL21xejBN\r\nSlIxYnRBQ1FNNmJOQnN5Wk4wdk5OdThLdWp5NGRQQkMwbWlkWi9EdzgvTUUy\r\nNFVzNlFjNTN5YW12ZkJEQm5pSEh3M0c2Wkx3YVBLZS84MDhuSkdvNFJrQkMz\r\nM2pKZWZxbE1EZG16Y2xtWjFBZ01CQUFHamdja3dnY1l3REFZRFZSMFRBUUgv\r\nQkFJd0FEQWRCZ05WSFE0RUZnUVVtOVA3NEhtWURIVWpHTkhYWk8vV1dKWGR5\r\nSlF3Z1lZR0ExVWRJd1IvTUgyQUZKdlQrK0I1bUF4MUl4alIxMlR2MWxpVjNj\r\naVVvVStrVFRCTE1SWXdGQVlEVlFRS0RBMVVUMFJQSUVOdmJYQjFkR1Z5TVJV\r\nd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhHakFZQmdOVkJBTU1FVTl1\r\nWlV4dloybHVJRUZqWTI5MWJuUWdnaFJUMlc1QlByYWhPcVpwTGZXa25VMm1w\r\naHhpRVRBT0JnTlZIUThCQWY4RUJBTUNCNEF3RFFZSktvWklodmNOQVFFRkJR\r\nQURnZ0VCQUpQV3hTVHZQZHBJbExoc0VUZDU0aGRCWkNXc05sSk4rd2JQbE9l\r\ndmJkNTlXWTlYakFlRGw4TThScFRJcHY3UC9heVJWTUJCOFh5Yk9JTDhMaG5W\r\naU9zTzJ0U3B4cWM3MDFCbGYyTlRWVGIvSFRKVElEQ1o3LzgycVZaSGYrMzRU\r\nc0NGcWRxaGRudnROVU1TQU1mN2JuSjBUSG0zYmNBNk96WmpUQk50UTVSYi9t\r\nNXAzbEZIOVpndTVQL2xlTm5FSmFqT3RxRW5Jbmd6enpWNGNDdncyNndHNVQw\r\nWlcrZGNSWkJMQXBHWElGaGNEZHFSeGRqam1mK1FQNVZaenVQRmVUTU8rWG9s\r\nRXBmbXNCZDQvUzkwaDFGU1YxbjdxMlBXNDNBYmFpbHpmbk1hZlZHRXIvMGFa\r\nTmhUdXplajZCeDBTajFBWWczcnJCeWFxS2Z6em9TK3ZCOD08L2RzOlg1MDlD\r\nZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNp\r\nZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBGb3JtYXQ9InVy\r\nbjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWls\r\nQWRkcmVzcyI+YWRyaWFuK29uZWxvZ2luQHRvZG8uY29tcHV0ZXI8L3NhbWw6\r\nTmFtZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46\r\nb2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJq\r\nZWN0Q29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMjUtMDUtMTJU\r\nMTA6MTE6NDdaIiBSZWNpcGllbnQ9Imh0dHBzOi8vc2FtbHRlc3QudG9kby5j\r\nb21wdXRlci9zYW1sL3NwL2NvbnN1bWUvZHVtbXktb25lbG9naW4iIEluUmVz\r\ncG9uc2VUbz0ic2FtbF9mbG93X195MGRSdHZQZzB5TzhfdHhkMnpMdkFZX2st\r\nQmhjb01TIi8+PC9zYW1sOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sOlN1\r\nYmplY3Q+PHNhbWw6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMjUtMDUtMTJU\r\nMTA6MDU6NDdaIiBOb3RPbk9yQWZ0ZXI9IjIwMjUtMDUtMTJUMTA6MTE6NDda\r\nIj48c2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sOkF1ZGllbmNlPmh0\r\ndHBzOi8vc2FtbHRlc3QudG9kby5jb21wdXRlcjwvc2FtbDpBdWRpZW5jZT48\r\nL3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48\r\nc2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMjUtMDUtMTJU\r\nMTA6MDg6NDZaIiBTZXNzaW9uTm90T25PckFmdGVyPSIyMDI1LTA1LTEzVDEw\r\nOjA4OjQ3WiIgU2Vzc2lvbkluZGV4PSJfZDlkMTllODQtM2NkMy00ODQ4LWFj\r\nYTAtOWM4OGY3ZTE5NTFjIj48c2FtbDpBdXRobkNvbnRleHQ+PHNhbWw6QXV0\r\naG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4w\r\nOmFjOmNsYXNzZXM6UGFzc3dvcmRQcm90ZWN0ZWRUcmFuc3BvcnQ8L3NhbWw6\r\nQXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sOkF1dGhuQ29udGV4dD48L3Nh\r\nbWw6QXV0aG5TdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50Pjxz\r\nYW1sOkF0dHJpYnV0ZSBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6\r\nU0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIiBOYW1lPSJsYXN0X25h\r\nbWUiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3\r\ndy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4\r\nczpzdHJpbmciPkdydW50a293c2tpPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwv\r\nc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWVGb3JtYXQ9InVy\r\nbjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6YmFz\r\naWMiIE5hbWU9ImZpcnN0X25hbWUiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHht\r\nbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5z\r\ndGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPkFkcmlhbjwvc2FtbDpBdHRy\r\naWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBO\r\nYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5h\r\nbWUtZm9ybWF0OmJhc2ljIiBOYW1lPSJlbWFpbCI+PHNhbWw6QXR0cmlidXRl\r\nVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNj\r\naGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+YWRyaWFuK29u\r\nZWxvZ2luQHRvZG8uY29tcHV0ZXI8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9z\r\nYW1sOkF0dHJpYnV0ZT48L3NhbWw6QXR0cmlidXRlU3RhdGVtZW50Pjwvc2Ft\r\nbDpBc3NlcnRpb24+PC9zYW1scDpSZXNwb25zZT4KCg==\r\n"
iex> {:ok, {_root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> assertion
%SimpleSaml.Assertion{
attributes: %{
"email" => ["adrian+onelogin@todo.computer"],
"first_name" => ["Adrian"],
"last_name" => ["Gruntkowski"]
},
audience: "https://samltest.todo.computer",
issuer: "https://app.onelogin.com/saml/metadata/183993d8-a07b-465c-9c7a-9d00898c4608",
name_id: "adrian+onelogin@todo.computer",
name_id_not_on_or_after: ~U[2025-05-12 10:11:47Z],
not_before: ~U[2025-05-12 10:05:47Z],
not_on_or_after: ~U[2025-05-12 10:11:47Z],
recipient: "https://samltest.todo.computer/saml/sp/consume/dummy-onelogin"
}
@spec verify_and_validate_response( SimpleXml.xml_node(), SimpleSaml.Assertion.t(), public_key(), keyword() ) :: :ok | {:error, any()}
This function verifies the digest and signature of the XML document using the given public key. It also validates that the timestamp constraints within the assertion are still valid.
SAML responses can be signed at the root-level, at the assertion-level or both. This function gives preference to verifying the root-level signature, if one exists. Otherwise, it verifies the assertion-level signature.
IMPORTANT: Before you rely on the claims made within the assertion, you must validate that the
issuer
, recipient
, and audience
field values in the assertion match your expected value.
This helps to thwart an attack where a SAML response intended for a different audience or target
endpoint is reused with your endpoint.
Examples
In the examples below, we purposely skip the time conditions validation to help ensure that the tests remain valid independent of time. In practice, time condition verification should not be skipped.
SAML response with root and assertion level signature is verified
iex> cert_der = "MIIDpDCCAoygAwIBAgIGAZJ72OLcMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCnRoaW5rYWhlYWQxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjQxMDExMTM1MDA0WhcNMzQxMDExMTM1MTA0WjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDAp0aGlua2FoZWFkMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuIHZRuGro+Z2+nmtl0D5BpSWfS7obctsAhOCc8+pIz27/s4Q05Ch+2q7qW+9bJwMdxCvNSRyLQ285CftlyX9WxpDts2sRVIqMwuTMlpFrzi7ieFY1IGxqLmU6QS3MHCQ51jT7F7t5wpr5iM4+V0k9PBfkvqsAGfxmueJeIL4HsYmo8WW8JTr3MaQJFm0fXD+eR7stclR/SalW1e3ISYMq6tyuQgWCWFQfYOloTxzeU7PNG1N54fgW5VkEWzxnRwUv+cscVYHpq4yqrZ3K86DMEG7RHoE7AKVsec7rpv4R06BP129My0zb7UrLIGtjxEUjeP9BArtitgJSnFyiYkmwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAgU1x6WxXfBePHC6zLWGhHhw75Vo4olM4Te9yIRDl4lrxOeiXLPRPHSBUd3dcMGQ9EE7Ani5nHI9TLwSG8zlxCYOT916UQNuo/6BbPOwP9MXBqpy7N5l49LGRJ3rKiWJvBgznO1AxdwjYOudNzrBoQ3G4eEnk3X//H3PRFCOE5e4eVmsWnMnD8+3/3tBZh4T3oJ78AeoRsOuWaQQfhJnE3iV54Croj7EAaKpDOogoMsUtl6UNTI2q7WSBFJO7GXtFyXrjfAEYjnQ9NJltpzmSFliXQYo5yUAwt1J2OoUq99UhDSAFVmwXXMhxnZ14ui7q/iwL68kHxuJV0jMmr7Ckz"
iex> {:ok, cert} = cert_der |> Base.decode64!() |> X509.Certificate.from_der()
iex> public_key = X509.Certificate.public_key(cert)
iex> saml_response = "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIERlc3RpbmF0aW9uPSJodHRwczovL2xvY2FsLm1ieC5jb206NDAwMS9hdXRoL3NhbWwvc3NvIiBJRD0iaWQ1MzQ0NjY3NDY2MzYwNjA4OTE2MTIwOTEyNTQyNiIgSXNzdWVJbnN0YW50PSIyMDI1LTA3LTA2VDE2OjEzOjQxLjg5NloiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMjpJc3N1ZXIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vd3d3Lm9rdGEuY29tL2V4azE2eWFqbTdwUmpDeVJOMHg4PC9zYW1sMjpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlNpZ25lZEluZm8+PGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQ1MzQ0NjY3NDY2MzYwNjA4OTE2MTIwOTEyNTQyNiI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PGRzOkRpZ2VzdFZhbHVlPmwrVWdDVktXSzRoRjJkcTN6c3BvWVNzQ3RFS3pmNEhJSFVzaU82SmZWdmM9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPk5CTjVxQVRjanlRZjRuY0c4V1pKMmV6a0p6aUZkM1k0MzhPbnI3SndqSFVBci9nWUhKanJYVnR4SkZrYmsxQkUvZ3lwNU4wdkdtY1pIaC9rb0E0LzBrbFJBUHFxSGtld2QrTmttUFpLeDN4RmhPOXJpQTRoeHZlaTRHaWFBSXRPcVlqS25xQ1lDSUhBakN5dlBXNWZkckxaODJXMG9yT1N1M1FVMlo2eUtEcGoxbjR3MlgxQ0MvWUxZcm1LMHN0YVVETlpCUk9MWEcrenJFSWkxbFRJU1Z4THV5Qm9ScitxbEUyNDNQOTNlZ2tDZXBkdDFKaWRkNUNZZnl2aERYWDA0cDlRVGtNRjZ3N2xMcXNuNjkwK3p2cHpaN1pnNkZnRkRZQUZCVmtUN1JXZ1Y2RGZ4d3BpZmJNd1B2OVBWOURqczJhUEUzeURjK1ZPbmpOazA1UzdQUT09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlEcERDQ0FveWdBd0lCQWdJR0FaSjcyT0xjTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdTTVFzd0NRWURWUVFHRXdKVlV6RVRNQkVHCkExVUVDQXdLUTJGc2FXWnZjbTVwWVRFV01CUUdBMVVFQnd3TlUyRnVJRVp5WVc1amFYTmpiekVOTUFzR0ExVUVDZ3dFVDJ0MFlURVUKTUJJR0ExVUVDd3dMVTFOUFVISnZkbWxrWlhJeEV6QVJCZ05WQkFNTUNuUm9hVzVyWVdobFlXUXhIREFhQmdrcWhraUc5dzBCQ1FFVwpEV2x1Wm05QWIydDBZUzVqYjIwd0hoY05NalF4TURFeE1UTTFNREEwV2hjTk16UXhNREV4TVRNMU1UQTBXakNCa2pFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQWdNQ2tOaGJHbG1iM0p1YVdFeEZqQVVCZ05WQkFjTURWTmhiaUJHY21GdVkybHpZMjh4RFRBTEJnTlYKQkFvTUJFOXJkR0V4RkRBU0JnTlZCQXNNQzFOVFQxQnliM1pwWkdWeU1STXdFUVlEVlFRRERBcDBhR2x1YTJGb1pXRmtNUnd3R2dZSgpLb1pJaHZjTkFRa0JGZzFwYm1adlFHOXJkR0V1WTI5dE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnR1SUhaUnVHcm8rWjIrbm10bDBENUJwU1dmUzdvYmN0c0FoT0NjOCtwSXoyNy9zNFEwNUNoKzJxN3FXKzliSndNZHhDdk5TUnlMUTIKODVDZnRseVg5V3hwRHRzMnNSVklxTXd1VE1scEZyemk3aWVGWTFJR3hxTG1VNlFTM01IQ1E1MWpUN0Y3dDV3cHI1aU00K1YwazlQQgpma3Zxc0FHZnhtdWVKZUlMNEhzWW1vOFdXOEpUcjNNYVFKRm0wZlhEK2VSN3N0Y2xSL1NhbFcxZTNJU1lNcTZ0eXVRZ1dDV0ZRZllPCmxvVHh6ZVU3UE5HMU41NGZnVzVWa0VXenhuUndVditjc2NWWUhwcTR5cXJaM0s4NkRNRUc3UkhvRTdBS1ZzZWM3cnB2NFIwNkJQMTIKOU15MHpiN1VyTElHdGp4RVVqZVA5QkFydGl0Z0pTbkZ5aVlrbXdJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFnVTF4NgpXeFhmQmVQSEM2ekxXR2hIaHc3NVZvNG9sTTRUZTl5SVJEbDRscnhPZWlYTFBSUEhTQlVkM2RjTUdROUVFN0FuaTVuSEk5VEx3U0c4CnpseENZT1Q5MTZVUU51by82QmJQT3dQOU1YQnFweTdONWw0OUxHUkozcktpV0p2Qmd6bk8xQXhkd2pZT3VkTnpyQm9RM0c0ZUVuazMKWC8vSDNQUkZDT0U1ZTRlVm1zV25NbkQ4KzMvM3RCWmg0VDNvSjc4QWVvUnNPdVdhUVFmaEpuRTNpVjU0Q3JvajdFQWFLcERPb2dvTQpzVXRsNlVOVEkycTdXU0JGSk83R1h0RnlYcmpmQUVZam5ROU5KbHRwem1TRmxpWFFZbzV5VUF3dDFKMk9vVXE5OVVoRFNBRlZtd1hYCk1oeG5aMTR1aTdxL2l3TDY4a0h4dUpWMGpNbXI3Q2t6PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWwycDpTdGF0dXMgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24gSUQ9ImlkMjY0NzQ5Mzg1OTA1ODQxMTQ0MTQyNDgzNzU1NSIgSXNzdWVJbnN0YW50PSIyMDI1LTA3LTA2VDE2OjEzOjQxLjg5NloiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpJc3N1ZXIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vd3d3Lm9rdGEuY29tL2V4azE2eWFqbTdwUmpDeVJOMHg4PC9zYW1sMjpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlNpZ25lZEluZm8+PGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQyNjQ3NDkzODU5MDU4NDExNDQxNDI0ODM3NTU1Ij48ZHM6VHJhbnNmb3Jtcz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz48ZHM6RGlnZXN0VmFsdWU+dmVYOTJDOTBGNUc1QzkwNEJLZDFhMUxqZkdUTTZsRlI1Ty8wc3pvNXVhND08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+Tnp5YUVKWUZDd2dLZkorSXdrdGZ2c3JBcS8yUGYvd25PMHpNSGE4bTFYdmd3QjBhQ0VQZXZsUHRhT0ZjaHVMV0R2Z2hlKzN0MHJxYmZhZ3cvWXZqTjh5YjJkYjltSFZZT3p4cFY4ZUFXeVlyYVBmbkJoRDJDbkh2V0hhVXJvc3FWTzBXb3FadHV3b0lFN0NlRWNBVHZEUmJhSFZWNVVXam9xbk1wY2Zzek5SZVI5TE0wMWNOQTk1cVlidW5tZzlTNmE2ajgwWTR1cWNaYXJOdHVjbXFwQnlRd0Vwc3BTUThkOWRSUFJLNVhuRjJsREc2WEFMOVQ4M3JpRDBxUnVLd1hXVWdHV0xCQzJZazJxcW9FZDhBTnlUdThDa1FjOS9BMGNNYTlMeCtXTlNRWlJEcnFmQk4yaW9wTnBpUjNrRlBGQ3ZBTDZvbmhWWFBVeGRNK1prNE5RPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURwRENDQW95Z0F3SUJBZ0lHQVpKNzJPTGNNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1JR1NNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUNBd0tRMkZzYVdadmNtNXBZVEVXTUJRR0ExVUVCd3dOVTJGdUlFWnlZVzVqYVhOamJ6RU5NQXNHQTFVRUNnd0VUMnQwWVRFVQpNQklHQTFVRUN3d0xVMU5QVUhKdmRtbGtaWEl4RXpBUkJnTlZCQU1NQ25Sb2FXNXJZV2hsWVdReEhEQWFCZ2txaGtpRzl3MEJDUUVXCkRXbHVabTlBYjJ0MFlTNWpiMjB3SGhjTk1qUXhNREV4TVRNMU1EQTBXaGNOTXpReE1ERXhNVE0xTVRBMFdqQ0JrakVMTUFrR0ExVUUKQmhNQ1ZWTXhFekFSQmdOVkJBZ01Da05oYkdsbWIzSnVhV0V4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEVEFMQmdOVgpCQW9NQkU5cmRHRXhGREFTQmdOVkJBc01DMU5UVDFCeWIzWnBaR1Z5TVJNd0VRWURWUVFEREFwMGFHbHVhMkZvWldGa01Sd3dHZ1lKCktvWklodmNOQVFrQkZnMXBibVp2UUc5cmRHRXVZMjl0TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUEKdHVJSFpSdUdybytaMitubXRsMEQ1QnBTV2ZTN29iY3RzQWhPQ2M4K3BJejI3L3M0UTA1Q2grMnE3cVcrOWJKd01keEN2TlNSeUxRMgo4NUNmdGx5WDlXeHBEdHMyc1JWSXFNd3VUTWxwRnJ6aTdpZUZZMUlHeHFMbVU2UVMzTUhDUTUxalQ3Rjd0NXdwcjVpTTQrVjBrOVBCCmZrdnFzQUdmeG11ZUplSUw0SHNZbW84V1c4SlRyM01hUUpGbTBmWEQrZVI3c3RjbFIvU2FsVzFlM0lTWU1xNnR5dVFnV0NXRlFmWU8KbG9UeHplVTdQTkcxTjU0ZmdXNVZrRVd6eG5Sd1V2K2NzY1ZZSHBxNHlxclozSzg2RE1FRzdSSG9FN0FLVnNlYzdycHY0UjA2QlAxMgo5TXkwemI3VXJMSUd0anhFVWplUDlCQXJ0aXRnSlNuRnlpWWttd0lEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQWdVMXg2Cld4WGZCZVBIQzZ6TFdHaEhodzc1Vm80b2xNNFRlOXlJUkRsNGxyeE9laVhMUFJQSFNCVWQzZGNNR1E5RUU3QW5pNW5ISTlUTHdTRzgKemx4Q1lPVDkxNlVRTnVvLzZCYlBPd1A5TVhCcXB5N041bDQ5TEdSSjNyS2lXSnZCZ3puTzFBeGR3allPdWROenJCb1EzRzRlRW5rMwpYLy9IM1BSRkNPRTVlNGVWbXNXbk1uRDgrMy8zdEJaaDRUM29KNzhBZW9Sc091V2FRUWZoSm5FM2lWNTRDcm9qN0VBYUtwRE9vZ29NCnNVdGw2VU5USTJxN1dTQkZKTzdHWHRGeVhyamZBRVlqblE5TkpsdHB6bVNGbGlYUVlvNXlVQXd0MUoyT29VcTk5VWhEU0FGVm13WFgKTWh4bloxNHVpN3EvaXdMNjhrSHh1SlYwak1tcjdDa3o8L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDI6U3ViamVjdCB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOk5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkIj5kai5qYWluQGFoZWFkLmNvbTwvc2FtbDI6TmFtZUlEPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAyNS0wNy0wNlQxNjoxODo0MS44OTZaIiBSZWNpcGllbnQ9Imh0dHBzOi8vbG9jYWwubWJ4LmNvbTo0MDAxL2F1dGgvc2FtbC9zc28iLz48L3NhbWwyOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sMjpTdWJqZWN0PjxzYW1sMjpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAyNS0wNy0wNlQxNjowODo0MS44OTZaIiBOb3RPbk9yQWZ0ZXI9IjIwMjUtMDctMDZUMTY6MTg6NDEuODk2WiIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT5odHRwczovL2xvY2FsLm1ieC5jb206NDAwMS9WZDF6WHI0NE9Ta2RKdGZpZGk3dVoyTkd5aEk8L3NhbWwyOkF1ZGllbmNlPjwvc2FtbDI6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWwyOkNvbmRpdGlvbnM+PHNhbWwyOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAyNS0wNy0wNlQxNjoxMzo0MS44OTZaIiBTZXNzaW9uSW5kZXg9ImlkMTc1MTgxODQyMDM4MS4xMTg4MTE5NTIxIiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOkF1dGhuQ29udGV4dD48c2FtbDI6QXV0aG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmRQcm90ZWN0ZWRUcmFuc3BvcnQ8L3NhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDI6QXV0aG5Db250ZXh0Pjwvc2FtbDI6QXV0aG5TdGF0ZW1lbnQ+PC9zYW1sMjpBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+"
iex> {:ok, {root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> SimpleSaml.verify_and_validate_response(root, assertion, public_key, skip_time_conditions?: true)
:ok
SAML response with an assertion-level signature only is verified
iex> cert_der = "MIIC8DCCAdigAwIBAgIQa2UOh8C+AoJLEaDrZJ8FZzANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yNTA1MDYxNTA2MjVaFw0yODA1MDYxNTA2MjRaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+Cl4PPu+XQD/ep9TkNro+MhkSVzKB4CVsO2u4tILUcA/Ux54h8ZyrFSL+zLnPv07oMDKpdjXK4dt5ORJdQN9hd3OE2hIqQGxofOkxRMXWoHO1vAL5tA+XsOa+EWIDbApI/QRPKPtZ1hLk+Y/UK0DMl1kSqQ7PSum16eyS4RFxXkTAcTviO83MKfPyTn0acx8MyeZ8tAHk4h3aSX1Q6Vkwf9ITlDdzLIKO25dFI6v34fMlT2p2OZ9NOz/OSGTrAZefVJnLzdVDfwsH4z8+LHzlc4oAKBqCoysLBwDjYoLwRVLt+J0QaKBx4PWzQxTrk82Rj9+6/DU2XiMl4Cx7JSVQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBJus97e94dRrQuiav9PSWmWyvMgyvBoYAirNEw38VBz42WnVU0+sSK4u7o7YVS6Ijjadmu3l6P6dD5waP0Swphp+Cp2Ps+Kr46YluHH8q9Q7uG0cWw2syvHYJj2SRU1Y8vqJtRiC+OQtwuiK6+X8k3R96SLEYRG6SGztpU40GVlv4jKNhGTAGZU7/ORMV61ObugLDeYOxyZ5s8+J0+4z4R02SvfiPHnlFkYRE50CeChMm9SF5ABCu8xsrHDvERn/fjT7brwlJ8NNkRg/QrZvtj1MU8YNPIOBY7GxaSEW06b+zDMxG48bxzphn4GjjlQp/Gx6F50mAYFlkuzTmM2GdQ"
iex> {:ok, cert} = cert_der |> Base.decode64!() |> X509.Certificate.from_der()
iex> public_key = X509.Certificate.public_key(cert)
iex> saml_response = "PHNhbWxwOlJlc3BvbnNlIElEPSJfNzkyZTIzM2EtODA5ZS00ZmI1LWI0YjEtZmEzYmU1OGUyMmNjIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAyNS0wNS0xMlQwOToxMTo0MS43OThaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyL3NhbWwvc3AvY29uc3VtZS9kdW1teS1tcyIgSW5SZXNwb25zZVRvPSJzYW1sX2Zsb3dfam1kWWxHczlod214N1BYWl9uTDQyM2d4d1M1ZVJtZnAiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxJc3N1ZXIgeG1sbnM9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPmh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzhlNGRhZTczLTg1ODYtNDNmMS04ZTliLThlNWEwOTk0OTA1MC88L0lzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48QXNzZXJ0aW9uIElEPSJfZDJiMGUyOWYtNTdiZC00NTc1LThiMDctODBjNjA5OGUwOTAwIiBJc3N1ZUluc3RhbnQ9IjIwMjUtMDUtMTJUMDk6MTE6NDEuNzk2WiIgVmVyc2lvbj0iMi4wIiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PElzc3Vlcj5odHRwczovL3N0cy53aW5kb3dzLm5ldC84ZTRkYWU3My04NTg2LTQzZjEtOGU5Yi04ZTVhMDk5NDkwNTAvPC9Jc3N1ZXI+PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PFNpZ25lZEluZm8+PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2QyYjBlMjlmLTU3YmQtNDU3NS04YjA3LTgwYzYwOThlMDkwMCI+PFRyYW5zZm9ybXM+PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PERpZ2VzdFZhbHVlPkNJV1hyaEpoK2h1RlpPN2dwSHNqNFI5VFFiMTFBejZUZ2xBWEVrTms4R009PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8+PFNpZ25hdHVyZVZhbHVlPmx0TmNVc00rYXpLbTJTTmFpN0ZPc3BxRGhzK3g4anYzQUNJTFlpNUZQWC9BYTkwRnpJcG44ODVvaW9xanVRVXBRUHRyVDdKcXpLRklXVEJscWhSL3BnZkdBZlJheDE3RVR0ei9MY051bFpPU0RRd1BFZGZKMVV1NlZCSGIyLzg3ZnpxZXJNN0p4Nm9jQXlsRGcyZVpXQTc3dHJXcEZyQlA5RlpuS2s0UEZjSDhPQnZZWUxnWk9YMlc5YW9oUFpDaElhYkpyT1NPUVJrNlg1YlhZdUNHbVYrTW80ZEVYZ0xyYVNndlFtb0VBWnF1elgvTVRHbE5GbUpSVk9UOEFoNHJlaW52WTRKNTEyMVpYMzdCTEZKcDNtYkFVNU1SSXp0eFZ3ZDlYc3FITGFxWGpZVHRjSXlTWHJaNDBQNVh3dFdSYjBkN3paTWJnOU1YaWt3MW5xWDVzdz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE+PFg1MDlDZXJ0aWZpY2F0ZT5NSUlDOERDQ0FkaWdBd0lCQWdJUWEyVU9oOEMrQW9KTEVhRHJaSjhGWnpBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVRJd01BWURWUVFERXlsTmFXTnliM052Wm5RZ1FYcDFjbVVnUm1Wa1pYSmhkR1ZrSUZOVFR5QkRaWEowYVdacFkyRjBaVEFlRncweU5UQTFNRFl4TlRBMk1qVmFGdzB5T0RBMU1EWXhOVEEyTWpSYU1EUXhNakF3QmdOVkJBTVRLVTFwWTNKdmMyOW1kQ0JCZW5WeVpTQkdaV1JsY21GMFpXUWdVMU5QSUVObGNuUnBabWxqWVhSbE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdStDbDRQUHUrWFFEL2VwOVRrTnJvK01oa1NWektCNENWc08ydTR0SUxVY0EvVXg1NGg4WnlyRlNMK3pMblB2MDdvTURLcGRqWEs0ZHQ1T1JKZFFOOWhkM09FMmhJcVFHeG9mT2t4Uk1YV29ITzF2QUw1dEErWHNPYStFV0lEYkFwSS9RUlBLUHRaMWhMaytZL1VLMERNbDFrU3FRN1BTdW0xNmV5UzRSRnhYa1RBY1R2aU84M01LZlB5VG4wYWN4OE15ZVo4dEFIazRoM2FTWDFRNlZrd2Y5SVRsRGR6TElLTzI1ZEZJNnYzNGZNbFQycDJPWjlOT3ovT1NHVHJBWmVmVkpuTHpkVkRmd3NINHo4K0xIemxjNG9BS0JxQ295c0xCd0RqWW9Md1JWTHQrSjBRYUtCeDRQV3pReFRyazgyUmo5KzYvRFUyWGlNbDRDeDdKU1ZRSURBUUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCSnVzOTdlOTRkUnJRdWlhdjlQU1dtV3l2TWd5dkJvWUFpck5FdzM4VkJ6NDJXblZVMCtzU0s0dTdvN1lWUzZJamphZG11M2w2UDZkRDV3YVAwU3dwaHArQ3AyUHMrS3I0NllsdUhIOHE5UTd1RzBjV3cyc3l2SFlKajJTUlUxWTh2cUp0UmlDK09RdHd1aUs2K1g4azNSOTZTTEVZUkc2U0d6dHBVNDBHVmx2NGpLTmhHVEFHWlU3L09STVY2MU9idWdMRGVZT3h5WjVzOCtKMCs0ejRSMDJTdmZpUEhubEZrWVJFNTBDZUNoTW05U0Y1QUJDdTh4c3JIRHZFUm4vZmpUN2Jyd2xKOE5Oa1JnL1FyWnZ0ajFNVThZTlBJT0JZN0d4YVNFVzA2Yit6RE14RzQ4Ynh6cGhuNEdqamxRcC9HeDZGNTBtQVlGbGt1elRtTTJHZFE8L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6ZW1haWxBZGRyZXNzIj5hZHJpYW4uZ3J1bnRrb3dza2lfZ21haWwuY29tI0VYVCNAYWRyaWFuZ3J1bnRrb3dza2lnbWFpbC5vbm1pY3Jvc29mdC5jb208L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89InNhbWxfZmxvd19qbWRZbEdzOWh3bXg3UFhaX25MNDIzZ3h3UzVlUm1mcCIgTm90T25PckFmdGVyPSIyMDI1LTA1LTEyVDEwOjExOjQxLjQ5MloiIFJlY2lwaWVudD0iaHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyL3NhbWwvc3AvY29uc3VtZS9kdW1teS1tcyIvPjwvU3ViamVjdENvbmZpcm1hdGlvbj48L1N1YmplY3Q+PENvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDI1LTA1LTEyVDA5OjA2OjQxLjQ5MloiIE5vdE9uT3JBZnRlcj0iMjAyNS0wNS0xMlQxMDoxMTo0MS40OTJaIj48QXVkaWVuY2VSZXN0cmljdGlvbj48QXVkaWVuY2U+aHR0cHM6Ly9zYW1sdGVzdC50b2RvLmNvbXB1dGVyPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24+PC9Db25kaXRpb25zPjxBdHRyaWJ1dGVTdGF0ZW1lbnQ+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2lkZW50aXR5L2NsYWltcy90ZW5hbnRpZCI+PEF0dHJpYnV0ZVZhbHVlPjhlNGRhZTczLTg1ODYtNDNmMS04ZTliLThlNWEwOTk0OTA1MDwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2lkZW50aXR5L2NsYWltcy9vYmplY3RpZGVudGlmaWVyIj48QXR0cmlidXRlVmFsdWU+MmJjZGM0YTktZTIwZC00Mzc1LTkyYTAtMTU0OGU1MjQxNjUxPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL2Rpc3BsYXluYW1lIj48QXR0cmlidXRlVmFsdWU+QWRyaWFuIEdydW50a293c2tpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL2lkZW50aXR5cHJvdmlkZXIiPjxBdHRyaWJ1dGVWYWx1ZT5saXZlLmNvbTwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2NsYWltcy9hdXRobm1ldGhvZHNyZWZlcmVuY2VzIj48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2F1dGhlbnRpY2F0aW9ubWV0aG9kL3Bhc3N3b3JkPC9BdHRyaWJ1dGVWYWx1ZT48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9jbGFpbXMvbXVsdGlwbGVhdXRobjwvQXR0cmlidXRlVmFsdWU+PEF0dHJpYnV0ZVZhbHVlPmh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwOC8wNi9pZGVudGl0eS9hdXRoZW50aWNhdGlvbm1ldGhvZC91bnNwZWNpZmllZDwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9naXZlbm5hbWUiPjxBdHRyaWJ1dGVWYWx1ZT5BZHJpYW48L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvc3VybmFtZSI+PEF0dHJpYnV0ZVZhbHVlPkdydW50a293c2tpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL2VtYWlsYWRkcmVzcyI+PEF0dHJpYnV0ZVZhbHVlPmFkcmlhbi5ncnVudGtvd3NraUBnbWFpbC5jb208L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSI+PEF0dHJpYnV0ZVZhbHVlPmFkcmlhbi5ncnVudGtvd3NraV9nbWFpbC5jb20jRVhUI0BhZHJpYW5ncnVudGtvd3NraWdtYWlsLm9ubWljcm9zb2Z0LmNvbTwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PC9BdHRyaWJ1dGVTdGF0ZW1lbnQ+PEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAyNS0wNS0wNlQxNDo1MzoyNS4yNzhaIiBTZXNzaW9uSW5kZXg9Il9kMmIwZTI5Zi01N2JkLTQ1NzUtOGIwNy04MGM2MDk4ZTA5MDAiPjxBdXRobkNvbnRleHQ+PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjwvQXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+"
iex> {:ok, {root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> SimpleSaml.verify_and_validate_response(root, assertion, public_key, skip_time_conditions?: true)
:ok
SAML response with a root-level only signature is verified
iex> cert_der = "MIIDqDCCApCgAwIBAgIGAY/zPxfMMA0GCSqGSIb3DQEBCwUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGRldi00NTM0OTkwNjEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0yNDA2MDcxNTA4MDlaFw0zNDA2MDcxNTA5MDlaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGRldi00NTM0OTkwNjEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMO24PWv93mgEmTC1WFjBneI+fcE77QHzZGgeiYfIQiso3s3BCpm7FEs+HK6r5AGpt3Q99FrmFBP/2AFC5/wEG9PiotFIQtLBo+AQZmY+M/9pIMFIWft+Z9k09BK4TPPk0ENRUfZXECWzK9pWygdPzMz6trOAVlpvAHGYgujoTCc6xMsKJvZVkHnG/syqvobk19F/4NKBgki614FgoUS/DP8QMMrRlxRS8Qh3friEvzsBQSvBcnW9+TvT4aFhtVXMbkJozL5Rp3LfTDw1AdNPqyokqDLb2zuv2iPhz3vGfltnRz31ZdZawuHtybQEAJwpqYp0zFXrzAWFOe0SF+hwj8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgxBYmrgsJp3ho1dzEfqU7DNPpWNt4JLnXMbEeAqxgkzQozIBS+C8tshNgT0SqC+zIIKCZWieq0eyay0nltacEeuATgD3TD8M6+4IzsI9z8xYYyEwSxWLBRkd4J5GgHt5J3cT6fE2GhyQMKxrsMiNDqS36BFtt3bU22KZH/6cNdUWwDoV0uqvc904nc/QHo3QuxYw2T2gjQqQkK1ic4/tPAY8H41mxx5VHhm79iH9a7BM29F6lhLho9Mlmp4zhZbY35EPT3H6dbKDZp1a+aWpWoDJNFfxXN4u51xN47dJOLmRQxvpeuElCR/4jKiqJ74AUcMPRcNqhoNiPj0QoxxQ9g=="
iex> {:ok, cert} = cert_der |> Base.decode64!() |> X509.Certificate.from_der()
iex> public_key = X509.Certificate.public_key(cert)
iex> saml_response = "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIERlc3RpbmF0aW9uPSJodHRwczovL2xvY2FsLm1ieC5jb206NDAwMS9hdXRoL3NhbWwvc3NvIiBJRD0iaWQ3NDc0NjEwNzcxODM5MzY2NDY3MTc2MTE5NDg5NiIgSXNzdWVJbnN0YW50PSIyMDI1LTA3LTA2VDE3OjMyOjQ3LjU1MFoiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMjpJc3N1ZXIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vd3d3Lm9rdGEuY29tL2V4a2hsYmlvNjRvQURqdGdxNWQ3PC9zYW1sMjpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlNpZ25lZEluZm8+PGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQ3NDc0NjEwNzcxODM5MzY2NDY3MTc2MTE5NDg5NiI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PGRzOkRpZ2VzdFZhbHVlPnZTQkdvVk1UYzdsRDRGeUp5bm9rREt2YW5SNjYrQUZRYk1YNWJ4d1J0L1E9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPnA0ekI3TGZ6VWZpZ1d4RnRnZlh4b3lHR3RLcCtRTjl4ckFsYW9HbnVyc3RmaHZrNENJRG1rRVNmazlHNVFQZUpMck9YNkY3S0JOSjdpVm5nN2ZpWmhGeWx3TzN4RzZVUDVCS2xEN3dVeHd2NjNqMW5OZWJVNFZNeFNpNHlxZEZGdzZjS0MyaWdvYUllbEVXeWovMlZkNGJ6T1JsbWxidjNMSUJCd1VKanBmN1F6djYzSWwzYWh0QmdEbFlnMVErTXJvOXA2Q3BlWFMyQUNsL0pEejI4c0dVNWVmem5xMjNaaGFabERBeUl1R3ViSTBkSzBVYzBsY1pWUHdBcjNiZlEvNGRTSlBhN25mTzJxbHVSbktPVU5OUFRUUW9KSHZuQkg2WlBENWprL0xmWGxnRDBDNk9sZEVGTmRwWWJwTnNObHY2NmIyYS9QVmpaL0lLTndtMzRMQT09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlEcURDQ0FwQ2dBd0lCQWdJR0FZL3pQeGZNTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdVTVFzd0NRWURWUVFHRXdKVlV6RVRNQkVHCkExVUVDQXdLUTJGc2FXWnZjbTVwWVRFV01CUUdBMVVFQnd3TlUyRnVJRVp5WVc1amFYTmpiekVOTUFzR0ExVUVDZ3dFVDJ0MFlURVUKTUJJR0ExVUVDd3dMVTFOUFVISnZkbWxrWlhJeEZUQVRCZ05WQkFNTURHUmxkaTAwTlRNME9Ua3dOakVjTUJvR0NTcUdTSWIzRFFFSgpBUllOYVc1bWIwQnZhM1JoTG1OdmJUQWVGdzB5TkRBMk1EY3hOVEE0TURsYUZ3MHpOREEyTURjeE5UQTVNRGxhTUlHVU1Rc3dDUVlEClZRUUdFd0pWVXpFVE1CRUdBMVVFQ0F3S1EyRnNhV1p2Y201cFlURVdNQlFHQTFVRUJ3d05VMkZ1SUVaeVlXNWphWE5qYnpFTk1Bc0cKQTFVRUNnd0VUMnQwWVRFVU1CSUdBMVVFQ3d3TFUxTlBVSEp2ZG1sa1pYSXhGVEFUQmdOVkJBTU1ER1JsZGkwME5UTTBPVGt3TmpFYwpNQm9HQ1NxR1NJYjNEUUVKQVJZTmFXNW1iMEJ2YTNSaExtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTU8yNFBXdjkzbWdFbVRDMVdGakJuZUkrZmNFNzdRSHpaR2dlaVlmSVFpc28zczNCQ3BtN0ZFcytISzZyNUFHcHQzUTk5RnIKbUZCUC8yQUZDNS93RUc5UGlvdEZJUXRMQm8rQVFabVkrTS85cElNRklXZnQrWjlrMDlCSzRUUFBrMEVOUlVmWlhFQ1d6SzlwV3lnZApQek16NnRyT0FWbHB2QUhHWWd1am9UQ2M2eE1zS0p2WlZrSG5HL3N5cXZvYmsxOUYvNE5LQmdraTYxNEZnb1VTL0RQOFFNTXJSbHhSClM4UWgzZnJpRXZ6c0JRU3ZCY25XOStUdlQ0YUZodFZYTWJrSm96TDVScDNMZlREdzFBZE5QcXlva3FETGIyenV2MmlQaHozdkdmbHQKblJ6MzFaZFphd3VIdHliUUVBSndwcVlwMHpGWHJ6QVdGT2UwU0YraHdqOENBd0VBQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQQpneEJZbXJnc0pwM2hvMWR6RWZxVTdETlBwV050NEpMblhNYkVlQXF4Z2t6UW96SUJTK0M4dHNoTmdUMFNxQyt6SUlLQ1pXaWVxMGV5CmF5MG5sdGFjRWV1QVRnRDNURDhNNis0SXpzSTl6OHhZWXlFd1N4V0xCUmtkNEo1R2dIdDVKM2NUNmZFMkdoeVFNS3hyc01pTkRxUzMKNkJGdHQzYlUyMktaSC82Y05kVVd3RG9WMHVxdmM5MDRuYy9RSG8zUXV4WXcyVDJnalFxUWtLMWljNC90UEFZOEg0MW14eDVWSGhtNwo5aUg5YTdCTTI5RjZsaExobzlNbG1wNHpoWmJZMzVFUFQzSDZkYktEWnAxYSthV3BXb0RKTkZmeFhONHU1MXhONDdkSk9MbVJReHZwCmV1RWxDUi80aktpcUo3NEFVY01QUmNOcWhvTmlQajBRb3h4UTlnPT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDJwOlN0YXR1cyB4bWxuczpzYW1sMnA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCI+PHNhbWwycDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWwycDpTdGF0dXM+PHNhbWwyOkFzc2VydGlvbiBJRD0iaWQxODgyMDExMTQ0NzE3MTMwOTIyMTA5NjIxMTY2OSIgSXNzdWVJbnN0YW50PSIyMDI1LTA3LTA2VDE3OjMyOjQ3LjU1MFoiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpJc3N1ZXIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiPmh0dHA6Ly93d3cub2t0YS5jb20vZXhraGxiaW82NG9BRGp0Z3E1ZDc8L3NhbWwyOklzc3Vlcj48c2FtbDI6U3ViamVjdD48c2FtbDI6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPmRqLmphaW5AbWJ4LmNvbTwvc2FtbDI6TmFtZUlEPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAyNS0wNy0wNlQxNzozNzo0Ny41NTBaIiBSZWNpcGllbnQ9Imh0dHBzOi8vbG9jYWwubWJ4LmNvbTo0MDAxL2F1dGgvc2FtbC9zc28iLz48L3NhbWwyOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sMjpTdWJqZWN0PjxzYW1sMjpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAyNS0wNy0wNlQxNzoyNzo0Ny41NTBaIiBOb3RPbk9yQWZ0ZXI9IjIwMjUtMDctMDZUMTc6Mzc6NDcuNTUwWiI+PHNhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWwyOkF1ZGllbmNlPmh0dHBzOi8vbG9jYWwubWJ4LmNvbTo0MDAxL1ZkMXpYcjQ0T1NrZEp0ZmlkaTd1WjJOR3loSTwvc2FtbDI6QXVkaWVuY2U+PC9zYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDI6Q29uZGl0aW9ucz48c2FtbDI6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDI1LTA3LTA2VDE3OjMyOjQ3LjU1MFoiIFNlc3Npb25JbmRleD0iaWQxNzUxODIzMTY3NTQ4LjM5OTgyNTYyIj48c2FtbDI6QXV0aG5Db250ZXh0PjxzYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDI6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sMjpBdXRobkNvbnRleHQ+PC9zYW1sMjpBdXRoblN0YXRlbWVudD48L3NhbWwyOkFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4="
iex> {:ok, {root, assertion}} = SimpleSaml.parse_response(saml_response)
iex> SimpleSaml.verify_and_validate_response(root, assertion, public_key, skip_time_conditions?: true)
:ok