saml-rs v0.6.1

Added

• (security) add an opt-in AuthnRequest IssueInstant age policy (#178)

Fixed

• (api) append AuthnRequestIssueInstant on TimeWindowField (#185)

Other

• warn that the following release removes strict() (#182)
• stop publishing the deprecated rustsaml crate (#179)

saml-rs v0.6.0

Added

• (sso) reject a later assertion that matches an outstanding logout (#168)
• (metadata) [breaking] require the metadata signature shape on signed import
• (slo) let the logout responder choose LogoutResponse status (#167)
• (conformance) keep metadata trust and replay as caller arguments (#149)
• (slo) honor Recommended rules on typed Single Logout (#146)
• (sso) follow Web Browser SSO producer rules when generating (#144)
• (sso) honor Recommended when accepting Web Browser SSO (#143)

Fixed

• (sso) [breaking] reject unrecognized assertion conditions (#173)

Other

• (migrations) record the remaining 0.6 upgrade steps (#176)
• separate guides, reference, and explanation (#174)
• Let the identity provider return an error Response with no assertions (#175)
• Enforce HTTP-Redirect signature removal and the RelayState limit (#172)
• Expose ForceAuthn, IsPassive, and Subject on a received AuthnRequest (#169)
• Allow five minutes of clock skew and keep replay until NotOnOrAfter (#166)
• (deps) bump bergshamra (#150)
• Publish recommended() and deprecate strict() (#153)
• Point policy docs at the classification records (#152)
• (api) [breaking] name the CBC signature relaxation for E93 (#148)

saml-rs v0.5.3

Fixed

• (slo) validate Destination at typed receivers (#97)

Other

• rewrite upgrade guides and record them in AGENTS.md (#132)

saml-rs v0.5.2

Added

• (api) expose verified XML signature evidence and strict profile (#122)

Other

• (rustsaml) mark the crate as no longer maintained (#130)

saml-rs v0.5.1

Fixed

• (deps) bump transitive cryptoki to 0.12.1 (#128)
• (deps) upgrade quick-xml to 0.42 (#124)

Other

• (deps) bump the cargo-maintenance group across 1 directory with 3 updates (#123)
• point package pages at the saml-rs repository (#126)
• (deps) bump bergshamra in the cargo-xml-crypto group (#119)

saml-rs v0.5.0

Added

• (crypto) expose selectable Bergshamra providers (#110)

Other

• (crypto) [breaking] upgrade Bergshamra to 0.8 and MSRV to Rust 1.88 (#108)

Fixed

• (crypto) apply the software RSA key-transport opt-in only to RustCrypto so
  AWS-LC decrypts RSA-OAEP with default options

saml-rs v0.4.0

Added

• (api) [breaking] enforce standards-aware Response signature policy (#81)

Fixed

• (slo) [breaking] emit session authority logout expiration (#101)
• (slo) [breaking] validate LogoutRequest time bounds (#73)
• (slo) [breaking] reject non-conformant custom LogoutResponse templates (#91)
• (sso) [breaking] enforce UTC IssueInstant on responses and assertions (#90)
• (slo) [breaking] validate logout response issue instant (#80)
• (protocol) [breaking] validate AuthnRequest IssueInstant (#74)

Other

• (deps) bump the cargo-maintenance group across 1 directory with 4 updates (#104)
• (slo) add external HTTP-Redirect interoperability fixtures (#99)
• (migrations) start 0.3 to 0.4 guide (#84)
• (deps) bump uuid in the cargo-maintenance group (#93)

Fixed

• (slo) [breaking] require UTC LogoutRequest IssueInstant, validate
  optional NotOnOrAfter, and derive replay expiry from its skew-adjusted
  deadline

saml-rs v0.3.0

Fixed

• (api) [breaking] avoid exposing time crate types (#72)

Other

• (migrations) add 0.2 to 0.3 guide (#83)

saml-rs v0.2.1

Added

• (compat) restore maintained crate aliases

Fixed

• enforce SAML 2.0 namespace and version profile (#79)
• honor repeated AuthnStatement session bounds (#71)
• (security) preserve SAML audience restriction groups (#69)
• reject repeated SAML assertion conditions (#67)
• (security) enforce SP assertion signature policy (#70)
• (xml) reject multiple document elements (#68)

Other

• add migration guide structure

Added

• (api) expose every AuthnStatement session tuple in XML order

Fixed

• (sp) honor the earliest SessionNotOnOrAfter across repeated AuthnStatement values

saml-rs v0.2.0

Added

• (api) add typed Single Logout facade (#59)
• (api) add typed Web SSO facade (#58)
• (api) add typed SAML validation context
• (api) add typed config builders
• (api) refine typed SAML API contracts
• (api) add typed SAML browser and result models
• (api) add typed SAML binding subsets
• (api) add typed SAML configuration policies
• (api) add typed Saml facade contract
• (opensaml) support idp protocol assertion tag prefixes (#28)
• (opensaml) add authn request options
• (opensaml) align IdP metadata ordering behavior
• (opensaml) support rsa pss sha256 signatures

Fixed

• (crypto) preflight SAML reference URIs (#65)
• (sp) fail on missing response ACS metadata
• (api) repair typed browser model invariants
• (deps) update crypto-bigint to 0.7.5 (#48)
• (deps) upgrade bergshamra to 0.6.3 (#47)
• (deps) upgrade quick-xml to 0.41 (#43)
• (opensaml) include SimpleSign fields in POST forms
• (opensaml) render login response attributes structurally
• fix login attribute metadata escaping (#36)
• reject request-bound unsolicited SSO (#35)
• fix metadata xml escaping (#32)
• (opensaml) limit redirect base64 decode (#30)
• (opensaml) render optional logout session index
• (security) bound XML parsing before authentication
• gate XML-Enc software RSA decryption
• (opensaml) escape SAML template values
• (opensaml) validate logout request issuer
• (opensaml) escape SAML attribute values
• (opensaml) validate SAML response destination
• (opensaml) require logout response correlation
• (opensaml) bind detached SAML signatures to consumed fields
• (opensaml) validate bearer subject confirmation
• (opensaml) require AuthnRequest root signature coverage
• (opensaml) validate AuthnRequest issuer
• (opensaml) [breaking] limit HTTP-Redirect DEFLATE output
• (opensaml) require explicit SAML response correlation
• (opensaml) require metadata signature root coverage
• (security) bind extracted SAML content to verified reference

Other

• (deps) bump bergshamra in the cargo-xml-crypto group (#63)
• split large modules
• document docs.rs publication surface
• (api) document the typed Saml facade
• (api) verify builder typed user journeys
• [codex] Preserve signed metadata coverage in typed descriptors (#57)
• (error) add semantic SAML validation errors
• [codex] Rebrand workspace as single saml-rs crate
• (deps) bump time in the cargo-maintenance group (#46)
• [codex] split cargo dependency update lanes (#44)
• (opensaml) pin crypto upgrade regressions (#45)
• [codex] render default login responses structurally (#42)
• [codex] validate crypto XML template inputs (#41)
• (opensaml) render default logout messages structurally (#39)
• (opensaml) render default authn requests structurally (#40)
• (readme) clarify current SAML profile scope
• (deps) bump the github-actions group with 2 updates (#34)
• (deps) bump the cargo-dependencies group with 2 updates (#33)
• add validated POST binding form variant (#31)
• update agent guidance (#29)
• Merge pull request #27 from salasebas/advisor/002-authn-request-options
• remove tracked parity notes
• include agent files in worktrees
• refresh README and upstream samlify reference (#22)
• fix release-plz push authentication
• add path-based PR labels
• add release-plz workflow

Changed

• Renamed the primary package from opensaml to saml-rs; Rust imports now use
  saml_rs.
• Moved implementation code from crates/opensaml/src to src.
• Renamed OpenSamlError to SamlError.
• Retired alias crates from active publication; do not yank existing healthy
  alias versions.
• Added typed config builders and direction-specific AuthnRequest policy names;
  builders use strict defaults while constructors/default policy values preserve
  compatibility, and final config validation now covers policy requirements.
• Hardened detailed metadata signature verification so signed metadata evidence
  is exposed through accessors, default-limit detailed wrappers are available,
  and unsafe metadata reference transforms such as XPath/XSLT fail closed before
  descriptor coverage is accepted.