# @askrjs/auth/saml

> Published API exports for @askrjs/auth/saml.

Source: [https://askrjs.com/docs/reference/api/auth/saml](https://askrjs.com/docs/reference/api/auth/saml)

Status: stable. Packages: @askrjs/auth/saml.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 8 exports from the declarations shipped by @askrjs/auth.

### `createSamlServiceProvider`

```ts
createSamlServiceProvider: (options: SamlServiceProviderOptions) => SamlServiceProvider
```

Create a SAML service provider for metadata, login requests, and response validation.

### `SamlPrincipal`

```ts
SamlPrincipal: any
```

Principal claims extracted from a validated SAML assertion.

- `saml`: SAML issuer, subject, session, and attributes.

### `SamlRequestStore`

```ts
SamlRequestStore: any
```

Persistence contract for pending SAML requests.

- `save`: Persist a pending authentication request.

- `get`: Load a pending authentication request.

- `consume`: Consume a pending request exactly once.

### `SamlServiceProvider`

```ts
SamlServiceProvider: any
```

SAML service-provider operations.

- `metadata`: Render SAML metadata XML.

- `createAuthnRequest`: Create a signed authentication request.

- `validateResponse`: Validate an encoded SAML response.

### `SamlServiceProviderOptions`

```ts
SamlServiceProviderOptions: any
```

Service-provider metadata, identity-provider details, and validation policy.

- `entityId`: Service-provider entity ID.

- `acsUrl`: Assertion-consumer service URL.

- `idp`: Identity-provider entity ID, SSO URL, and signing certificates.

- `requestStore`: Store for pending authentication requests.

- `signRequests`: Optional request-signing key pair.

- `decryptAssertions`: Optional assertion-decryption key pair.

- `requireSignedResponse`: Require a valid XML signature on responses.

- `requestTtlSeconds`: Pending-request lifetime in seconds.

- `maxAssertionAgeSeconds`: Maximum assertion age in seconds.

- `clockSkewSeconds`: Allowed clock skew in seconds.

- `clock`: Clock returning Unix time in milliseconds.

### `SamlStoredRequest`

```ts
SamlStoredRequest: any
```

Pending SAML authentication request retained for callback validation.

- `id`: Request identifier.

- `createdAt`: Creation time in Unix milliseconds.

- `expiresAt`: Expiration time in Unix milliseconds.

- `relayState`: Optional relay state returned by the identity provider.

### `SamlValidationError`

```ts
SamlValidationError: typeof SamlValidationError
```

Error raised when a SAML response fails validation.

- `code`: Error category used for programmatic handling.

### `SamlValidationErrorCode`

```ts
SamlValidationErrorCode: "malformed-response" | "unsupported-algorithm" | "invalid-signature" | "invalid-claim" | "unknown-request" | "replayed-response" | "idp-error"
```

Stable failure codes for SAML validation.

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/auth/oidc/index.md) | [Next](https://askrjs.com/docs/reference/api/auth/mfa/index.md)