samlify
Version:
Node.js library for SAML SSO
431 lines • 21.4 kB
JavaScript
;
var __assign = (this && this.__assign) || function () {
__assign = Object.assign || function(t) {
for (var s, i = 1, n = arguments.length; i < n; i++) {
s = arguments[i];
for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
t[p] = s[p];
}
return t;
};
return __assign.apply(this, arguments);
};
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
/**
* @file binding-redirect.ts
* @author tngan
* @desc Binding-level API for SAML HTTP-Redirect. Builds signed/unsigned
* redirect URLs for login/logout requests and responses.
*/
var utility_1 = __importStar(require("./utility"));
var libsaml_1 = __importDefault(require("./libsaml"));
var url = __importStar(require("url"));
var urn_1 = require("./urn");
var binding = urn_1.wording.binding;
var urlParams = urn_1.wording.urlParams;
/**
* Build a `key=value` URL fragment prefixed with the correct separator.
*
* @param param key name
* @param value key value
* @param first when true, use `?` instead of `&`
*/
function pvPair(param, value, first) {
return (first === true ? '?' : '&') + param + '=' + value;
}
/**
* Compose the final redirect URL, deflate/base64/urlencode the SAML message,
* optionally append the detached signature.
*
* @param opts redirect configuration
* @returns absolute redirect URL
*/
function buildRedirectURL(opts) {
var baseUrl = opts.baseUrl, type = opts.type, isSigned = opts.isSigned, context = opts.context, entitySetting = opts.entitySetting;
var _a = opts.relayState, relayState = _a === void 0 ? '' : _a;
var noParams = (url.parse(baseUrl).query || []).length === 0;
var queryParam = libsaml_1.default.getQueryParamByType(type);
// SAML redirect binding: deflate → base64 → URL-encode.
var samlRequest = encodeURIComponent(utility_1.default.base64Encode(utility_1.default.deflateString(context)));
if (relayState !== '') {
relayState = pvPair(urlParams.relayState, encodeURIComponent(relayState));
}
if (isSigned) {
var sigAlg = pvPair(urlParams.sigAlg, encodeURIComponent(entitySetting.requestSignatureAlgorithm));
var octetString = samlRequest + relayState + sigAlg;
return baseUrl
+ pvPair(queryParam, octetString, noParams)
+ pvPair(urlParams.signature, encodeURIComponent(libsaml_1.default.constructMessageSignature(queryParam + '=' + octetString, entitySetting.privateKey, entitySetting.privateKeyPass, undefined, entitySetting.requestSignatureAlgorithm).toString()));
}
return baseUrl + pvPair(queryParam, samlRequest + relayState, noParams);
}
/**
* Build a redirect URL carrying a SAML AuthnRequest.
*
* @param entity `{ idp, sp }` handles
* @param customTagReplacement optional custom template transformer
* @param relayState per-request RelayState; falls back to `entitySetting.relayState`
* @param forceAuthn per-request `ForceAuthn` flag (saml-core §3.4.1)
* @param assertionConsumerServiceIndex per-request ACS index (saml-core §3.4.1).
* Mutually exclusive with `AssertionConsumerServiceURL` / `ProtocolBinding`;
* when supplied, both of those attributes are dropped from the rendered XML.
* @returns id + redirect URL wrapped in a {@link BindingContext}
*/
function loginRequestRedirectURL(entity, customTagReplacement, relayState, forceAuthn, assertionConsumerServiceIndex) {
var _a, _b;
var metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };
var spSetting = entity.sp.entitySetting;
var id = '';
/* v8 ignore start */
if (!metadata.idp || !metadata.sp) {
throw new Error('ERR_GENERATE_REDIRECT_LOGIN_REQUEST_MISSING_METADATA');
}
/* v8 ignore stop */
var base = metadata.idp.getSingleSignOnService(binding.redirect);
// saml-bindings §3.4 / saml-metadata §2.4.3: the IdP must declare a
// <SingleSignOnService> entry with the HTTP-Redirect Binding URI.
// When that endpoint is absent, getSingleSignOnService returns the raw
// service map (an object) rather than a URL string — surface a clear
// error instead of letting it crash inside url.parse downstream.
if (typeof base !== 'string') {
throw new Error('ERR_NO_REDIRECT_SSO_ENDPOINT');
}
var rawSamlRequest;
if (customTagReplacement) {
// saml-bindings §3.4 — the AuthnRequest template is informative, not
// normative. Honour the callback regardless of whether the caller
// supplied a custom template (closes #549). Pass the user-supplied
// template when present; otherwise the library default.
var templateContext = (_b = (_a = spSetting.loginRequestTemplate) === null || _a === void 0 ? void 0 : _a.context) !== null && _b !== void 0 ? _b : libsaml_1.default.defaultLoginRequestTemplate.context;
var info = customTagReplacement(templateContext);
id = (0, utility_1.get)(info, 'id');
rawSamlRequest = (0, utility_1.get)(info, 'context');
// Support callback returning { context: string } or { context: { context: string } }.
if (typeof rawSamlRequest === 'object' && rawSamlRequest !== null && 'context' in rawSamlRequest) {
rawSamlRequest = rawSamlRequest.context;
}
}
else {
var nameIDFormat = spSetting.nameIDFormat;
var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
id = spSetting.generateID();
// saml-core §3.4.1 — `AssertionConsumerServiceIndex` is mutually
// exclusive with `AssertionConsumerServiceURL` / `ProtocolBinding`.
// When the caller supplies the index we set the URL+ProtocolBinding
// tags to undefined so `replaceTagsByValue` drops both attributes
// from the rendered XML (closes #437).
var useAcsIndex = assertionConsumerServiceIndex !== undefined;
var tags = {
ID: id,
Destination: base,
Issuer: metadata.sp.getEntityID(),
IssueInstant: new Date().toISOString(),
NameIDFormat: selectedNameIDFormat,
ProtocolBinding: useAcsIndex
? undefined
: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
AssertionConsumerServiceURL: useAcsIndex
? undefined
: metadata.sp.getAssertionConsumerService(binding.post),
AssertionConsumerServiceIndex: assertionConsumerServiceIndex,
EntityID: metadata.sp.getEntityID(),
AllowCreate: spSetting.allowCreate,
// saml-core §3.4.1 — `replaceTagsByValue` drops the attribute when
// `forceAuthn` is undefined, matching `use="optional"`.
ForceAuthn: forceAuthn,
};
rawSamlRequest = libsaml_1.default.replaceTagsByValue(libsaml_1.default.defaultLoginRequestTemplate.context, tags);
}
return {
id: id,
context: buildRedirectURL({
context: rawSamlRequest,
type: urlParams.samlRequest,
isSigned: metadata.sp.isAuthnRequestSigned(),
entitySetting: spSetting,
baseUrl: base,
relayState: relayState !== null && relayState !== void 0 ? relayState : spSetting.relayState,
}),
};
}
/**
* Build a redirect URL carrying a SAML login Response.
*
* @param requestInfo parsed request used to link `InResponseTo`
* @param entity `{ idp, sp }` handles
* @param user authenticated user
* @param relayState caller-supplied redirect URL
* @param customTagReplacement optional custom template transformer
* @returns id + redirect URL wrapped in a {@link BindingContext}
*/
function loginResponseRedirectURL(requestInfo, entity, user, relayState, customTagReplacement) {
var _a, _b, _c, _d, _e, _f, _g, _h, _j;
if (user === void 0) { user = {}; }
var idpSetting = entity.idp.entitySetting;
var spSetting = entity.sp.entitySetting;
var metadata = {
idp: entity.idp.entityMeta,
sp: entity.sp.entityMeta,
};
var id = idpSetting.generateID();
/* v8 ignore start */
if (!metadata.idp || !metadata.sp) {
throw new Error('ERR_GENERATE_REDIRECT_LOGIN_RESPONSE_MISSING_METADATA');
}
/* v8 ignore stop */
var base = metadata.sp.getAssertionConsumerService(binding.redirect);
// saml-bindings §3.4 / saml-metadata §2.4.3: the SP must declare an
// <AssertionConsumerService> entry with the HTTP-Redirect Binding URI.
// When that endpoint is absent, getAssertionConsumerService returns
// undefined or the raw service list — reject with a clear error rather
// than crashing in url.parse.
if (typeof base !== 'string') {
throw new Error('ERR_NO_REDIRECT_SSO_ENDPOINT');
}
var rawSamlResponse;
var nameIDFormat = idpSetting.nameIDFormat;
var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
var nowTime = new Date();
var fiveMinutesLaterTime = new Date(nowTime.getTime() + 300000);
var tvalue = {
ID: id,
AssertionID: idpSetting.generateID(),
Destination: base,
SubjectRecipient: base,
Issuer: metadata.idp.getEntityID(),
Audience: metadata.sp.getEntityID(),
EntityID: metadata.sp.getEntityID(),
IssueInstant: nowTime.toISOString(),
AssertionConsumerServiceURL: base,
StatusCode: urn_1.namespace.statusCode.success,
ConditionsNotBefore: nowTime.toISOString(),
ConditionsNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
SubjectConfirmationDataNotOnOrAfter: fiveMinutesLaterTime.toISOString(),
NameIDFormat: selectedNameIDFormat,
NameID: user.email || '',
InResponseTo: (0, utility_1.get)(requestInfo, 'extract.request.id', ''),
AuthnStatement: '',
AttributeStatement: '',
};
if (customTagReplacement) {
// saml-bindings §3.4 — honour the callback even when the caller did
// not override `loginResponseTemplate` (closes #549). Prefer the
// user-supplied template, then the tag-prefixed default (closes #388),
// and finally the library default.
var templateContext = (_e = (_b = (_a = idpSetting.loginResponseTemplate) === null || _a === void 0 ? void 0 : _a.context) !== null && _b !== void 0 ? _b : (_d = (_c = idpSetting.tagPrefixedDefaults) === null || _c === void 0 ? void 0 : _c.loginResponseTemplate) === null || _d === void 0 ? void 0 : _d.context) !== null && _e !== void 0 ? _e : libsaml_1.default.defaultLoginResponseTemplate.context;
var template = customTagReplacement(templateContext);
id = (0, utility_1.get)(template, 'id');
rawSamlResponse = (0, utility_1.get)(template, 'context');
}
else {
if (requestInfo !== null && ((_f = requestInfo.extract) === null || _f === void 0 ? void 0 : _f.request)) {
tvalue.InResponseTo = requestInfo.extract.request.id;
}
// saml-core §1.4: prefer the IdP-rewritten default when tagPrefix is
// overridden (closes #388); otherwise fall back to the library default.
var baseTemplate = (_j = (_h = (_g = idpSetting.tagPrefixedDefaults) === null || _g === void 0 ? void 0 : _g.loginResponseTemplate) === null || _h === void 0 ? void 0 : _h.context) !== null && _j !== void 0 ? _j : libsaml_1.default.defaultLoginResponseTemplate.context;
rawSamlResponse = libsaml_1.default.replaceTagsByValue(baseTemplate, tvalue);
}
var privateKey = idpSetting.privateKey, privateKeyPass = idpSetting.privateKeyPass, signatureAlgorithm = idpSetting.requestSignatureAlgorithm;
var config = {
privateKey: privateKey,
privateKeyPass: privateKeyPass,
signatureAlgorithm: signatureAlgorithm,
signingCert: metadata.idp.getX509Certificate('signing'),
isBase64Output: false,
};
if (metadata.sp.isWantAssertionsSigned()) {
rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign(__assign({}, config), { rawSamlMessage: rawSamlResponse, transformationAlgorithms: spSetting.transformationAlgorithms, referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']", signatureConfig: {
prefix: 'ds',
location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
} }));
}
// SAML response over redirect binding is always signed (see SAML core 3.4.4).
return {
id: id,
context: buildRedirectURL({
baseUrl: base,
type: urlParams.samlResponse,
isSigned: true,
context: rawSamlResponse,
entitySetting: idpSetting,
relayState: relayState,
}),
};
}
/**
* Build a redirect URL carrying a SAML LogoutRequest.
*
* @param user currently authenticated user
* @param entity `{ init, target }` handles
* @param relayState caller-supplied redirect URL
* @param customTagReplacement optional custom template transformer
* @returns id + redirect URL wrapped in a {@link BindingContext}
*/
function logoutRequestRedirectURL(user, entity, relayState, customTagReplacement) {
var _a, _b, _c, _d, _e, _f, _g, _h;
var metadata = { init: entity.init.entityMeta, target: entity.target.entityMeta };
var initSetting = entity.init.entitySetting;
var id = initSetting.generateID();
var nameIDFormat = initSetting.nameIDFormat;
var selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
/* v8 ignore start */
if (!metadata.init || !metadata.target) {
throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_REQUEST_MISSING_METADATA');
}
/* v8 ignore stop */
var base = metadata.target.getSingleLogoutService(binding.redirect);
// saml-bindings §3.4 / saml-metadata §2.4.3: the target entity must declare
// a <SingleLogoutService> with the HTTP-Redirect Binding URI. Otherwise the
// service map leaks through and crashes inside url.parse downstream.
if (typeof base !== 'string') {
throw new Error('ERR_NO_REDIRECT_SLO_ENDPOINT');
}
var rawSamlRequest = '';
var requiredTags = {
ID: id,
Destination: base,
EntityID: metadata.init.getEntityID(),
Issuer: metadata.init.getEntityID(),
IssueInstant: new Date().toISOString(),
NameIDFormat: selectedNameIDFormat,
NameID: user.logoutNameID,
SessionIndex: user.sessionIndex,
};
if (customTagReplacement) {
// saml-bindings §3.4 — honour the callback even when the caller did
// not override `logoutRequestTemplate` (closes #549). Prefer the
// user-supplied template, then the tag-prefixed default (closes #388),
// and finally the library default.
var templateContext = (_e = (_b = (_a = initSetting.logoutRequestTemplate) === null || _a === void 0 ? void 0 : _a.context) !== null && _b !== void 0 ? _b : (_d = (_c = initSetting.tagPrefixedDefaults) === null || _c === void 0 ? void 0 : _c.logoutRequestTemplate) === null || _d === void 0 ? void 0 : _d.context) !== null && _e !== void 0 ? _e : libsaml_1.default.defaultLogoutRequestTemplate.context;
var info = customTagReplacement(templateContext, requiredTags);
id = (0, utility_1.get)(info, 'id');
rawSamlRequest = (0, utility_1.get)(info, 'context');
}
else {
var baseTemplate = (_h = (_g = (_f = initSetting.tagPrefixedDefaults) === null || _f === void 0 ? void 0 : _f.logoutRequestTemplate) === null || _g === void 0 ? void 0 : _g.context) !== null && _h !== void 0 ? _h : libsaml_1.default.defaultLogoutRequestTemplate.context;
rawSamlRequest = libsaml_1.default.replaceTagsByValue(baseTemplate, requiredTags);
}
return {
id: id,
context: buildRedirectURL({
context: rawSamlRequest,
relayState: relayState,
type: urlParams.logoutRequest,
isSigned: entity.target.entitySetting.wantLogoutRequestSigned,
entitySetting: initSetting,
baseUrl: base,
}),
};
}
/**
* Build a redirect URL carrying a SAML LogoutResponse.
*
* @param requestInfo parsed request used to link `InResponseTo`
* @param entity `{ init, target }` handles
* @param relayState caller-supplied redirect URL
* @param customTagReplacement optional custom template transformer
* @returns id + redirect URL wrapped in a {@link BindingContext}
*/
function logoutResponseRedirectURL(requestInfo, entity, relayState, customTagReplacement) {
var _a, _b, _c, _d, _e, _f, _g, _h;
var metadata = {
init: entity.init.entityMeta,
target: entity.target.entityMeta,
};
var initSetting = entity.init.entitySetting;
var id = initSetting.generateID();
/* v8 ignore start */
if (!metadata.init || !metadata.target) {
throw new Error('ERR_GENERATE_REDIRECT_LOGOUT_RESPONSE_MISSING_METADATA');
}
/* v8 ignore stop */
var base = metadata.target.getSingleLogoutService(binding.redirect);
// saml-bindings §3.4 / saml-metadata §2.4.3: same constraint as the
// logout request path — the target must advertise a HTTP-Redirect SLO
// endpoint before we can build a URL.
if (typeof base !== 'string') {
throw new Error('ERR_NO_REDIRECT_SLO_ENDPOINT');
}
var rawSamlResponse;
if (customTagReplacement) {
// saml-bindings §3.4 — honour the callback even when the caller did
// not override `logoutResponseTemplate` (closes #549). Prefer the
// user-supplied template, then the tag-prefixed default (closes #388),
// and finally the library default.
var templateContext = (_e = (_b = (_a = initSetting.logoutResponseTemplate) === null || _a === void 0 ? void 0 : _a.context) !== null && _b !== void 0 ? _b : (_d = (_c = initSetting.tagPrefixedDefaults) === null || _c === void 0 ? void 0 : _c.logoutResponseTemplate) === null || _d === void 0 ? void 0 : _d.context) !== null && _e !== void 0 ? _e : libsaml_1.default.defaultLogoutResponseTemplate.context;
var template = customTagReplacement(templateContext);
id = (0, utility_1.get)(template, 'id');
rawSamlResponse = (0, utility_1.get)(template, 'context');
}
else {
var tvalue = {
ID: id,
Destination: base,
Issuer: metadata.init.getEntityID(),
EntityID: metadata.init.getEntityID(),
IssueInstant: new Date().toISOString(),
StatusCode: urn_1.namespace.statusCode.success,
};
if (requestInfo && requestInfo.extract && requestInfo.extract.request) {
tvalue.InResponseTo = requestInfo.extract.request.id;
}
var baseTemplate = (_h = (_g = (_f = initSetting.tagPrefixedDefaults) === null || _f === void 0 ? void 0 : _f.logoutResponseTemplate) === null || _g === void 0 ? void 0 : _g.context) !== null && _h !== void 0 ? _h : libsaml_1.default.defaultLogoutResponseTemplate.context;
rawSamlResponse = libsaml_1.default.replaceTagsByValue(baseTemplate, tvalue);
}
return {
id: id,
context: buildRedirectURL({
baseUrl: base,
type: urlParams.logoutResponse,
isSigned: entity.target.entitySetting.wantLogoutResponseSigned,
context: rawSamlResponse,
entitySetting: initSetting,
relayState: relayState,
}),
};
}
var redirectBinding = {
loginRequestRedirectURL: loginRequestRedirectURL,
loginResponseRedirectURL: loginResponseRedirectURL,
logoutRequestRedirectURL: logoutRequestRedirectURL,
logoutResponseRedirectURL: logoutResponseRedirectURL,
};
exports.default = redirectBinding;
//# sourceMappingURL=binding-redirect.js.map