@_mustachio/openauth 0.12.0 → 0.13.0

package/dist/esm/domain/scim/resource.js

@@ -0,0 +1,256 @@
+// src/domain/scim/resource.ts
+import { err, ok } from "../../types/result";
+var SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+var SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+var SCIM_ENTERPRISE_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+var SCIM_LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+var SCIM_ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+var SCIM_PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+function scimErrorBody(status, detail, scimType) {
+  return {
+    schemas: [SCIM_ERROR_SCHEMA],
+    status: String(status),
+    ...scimType !== undefined ? { scimType } : {},
+    detail
+  };
+}
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var asString = (v) => typeof v === "string" && v.length > 0 ? v : undefined;
+function parseName(v) {
+  if (!isRecord(v))
+    return;
+  const out = {};
+  for (const k of [
+    "formatted",
+    "familyName",
+    "givenName",
+    "middleName",
+    "honorificPrefix",
+    "honorificSuffix"
+  ]) {
+    const s = asString(v[k]);
+    if (s !== undefined)
+      out[k] = s;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+function parseMultiValues(v) {
+  if (!Array.isArray(v))
+    return;
+  const out = [];
+  for (const entry of v) {
+    if (!isRecord(entry))
+      continue;
+    const value = asString(entry["value"]);
+    if (value === undefined)
+      continue;
+    const type = asString(entry["type"]);
+    const primary = entry["primary"];
+    out.push({
+      value,
+      ...type !== undefined ? { type } : {},
+      ...typeof primary === "boolean" ? { primary } : {}
+    });
+  }
+  return out.length > 0 ? out : undefined;
+}
+function parseEnterprise(v) {
+  if (!isRecord(v))
+    return;
+  const out = {};
+  for (const k of [
+    "employeeNumber",
+    "costCenter",
+    "organization",
+    "division",
+    "department"
+  ]) {
+    const s = asString(v[k]);
+    if (s !== undefined)
+      out[k] = s;
+  }
+  const mgr = v["manager"];
+  if (isRecord(mgr)) {
+    const value = asString(mgr["value"]);
+    const displayName = asString(mgr["displayName"]);
+    if (value !== undefined || displayName !== undefined) {
+      out.manager = {
+        ...value !== undefined ? { value } : {},
+        ...displayName !== undefined ? { displayName } : {}
+      };
+    }
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+function parseUserWrite(body) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  if (body["password"] !== undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "this Service Provider does not accept 'password' over SCIM; " + "credentials are managed by the authentication methods, not the " + "directory feed"
+    });
+  }
+  const userName = asString(body["userName"]);
+  if (userName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "userName is required and must be a non-empty string"
+    });
+  }
+  const activeRaw = body["active"];
+  if (activeRaw !== undefined && typeof activeRaw !== "boolean") {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "active must be a boolean"
+    });
+  }
+  const externalId = asString(body["externalId"]);
+  const displayName = asString(body["displayName"]);
+  const name = parseName(body["name"]);
+  const emails = parseMultiValues(body["emails"]);
+  const phoneNumbers = parseMultiValues(body["phoneNumbers"]);
+  const enterprise = parseEnterprise(body[SCIM_ENTERPRISE_SCHEMA]);
+  return ok({
+    userName,
+    active: activeRaw === undefined ? true : activeRaw,
+    ...externalId !== undefined ? { externalId } : {},
+    ...displayName !== undefined ? { displayName } : {},
+    ...name !== undefined ? { name } : {},
+    ...emails !== undefined ? { emails } : {},
+    ...phoneNumbers !== undefined ? { phoneNumbers } : {},
+    ...enterprise !== undefined ? { enterprise } : {}
+  });
+}
+var iso = (ms) => ms === undefined ? undefined : new Date(ms).toISOString();
+function serializeUser(user, baseUrl) {
+  const schemas = [SCIM_USER_SCHEMA];
+  if (user.enterprise !== undefined)
+    schemas.push(SCIM_ENTERPRISE_SCHEMA);
+  const created = iso(user.createdAt);
+  const lastModified = iso(user.updatedAt);
+  return {
+    schemas,
+    id: user.id,
+    ...user.externalId !== undefined ? { externalId: user.externalId } : {},
+    userName: user.userName,
+    ...user.name !== undefined ? { name: user.name } : {},
+    ...user.displayName !== undefined ? { displayName: user.displayName } : {},
+    ...user.emails !== undefined ? { emails: user.emails } : {},
+    ...user.phoneNumbers !== undefined ? { phoneNumbers: user.phoneNumbers } : {},
+    active: user.active,
+    ...user.enterprise !== undefined ? { [SCIM_ENTERPRISE_SCHEMA]: user.enterprise } : {},
+    meta: {
+      resourceType: "User",
+      ...created !== undefined ? { created } : {},
+      ...lastModified !== undefined ? { lastModified } : {},
+      location: `${baseUrl}/Users/${encodeURIComponent(user.id)}`
+    }
+  };
+}
+function serializeList(users, totalResults, startIndex, baseUrl) {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: users.length,
+    Resources: users.map((u) => serializeUser(u, baseUrl))
+  };
+}
+function parseMembers(v) {
+  const list = Array.isArray(v) ? v : isRecord(v) ? [v] : undefined;
+  if (list === undefined)
+    return;
+  const out = [];
+  for (const entry of list) {
+    if (!isRecord(entry))
+      continue;
+    const value = asString(entry["value"]);
+    if (value === undefined)
+      continue;
+    const display = asString(entry["display"]);
+    out.push({ value, ...display !== undefined ? { display } : {} });
+  }
+  return out;
+}
+function parseGroupWrite(body) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  const displayName = asString(body["displayName"]);
+  if (displayName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "displayName is required and must be a non-empty string"
+    });
+  }
+  const externalId = asString(body["externalId"]);
+  const members = parseMembers(body["members"]);
+  return ok({
+    displayName,
+    ...externalId !== undefined ? { externalId } : {},
+    ...members !== undefined ? { members } : {}
+  });
+}
+function serializeGroup(group, baseUrl) {
+  const created = iso(group.createdAt);
+  const lastModified = iso(group.updatedAt);
+  return {
+    schemas: [SCIM_GROUP_SCHEMA],
+    id: group.id,
+    ...group.externalId !== undefined ? { externalId: group.externalId } : {},
+    displayName: group.displayName,
+    ...group.members !== undefined ? {
+      members: group.members.map((m) => ({
+        value: m.value,
+        ...m.display !== undefined ? { display: m.display } : {},
+        $ref: `${baseUrl}/Users/${encodeURIComponent(m.value)}`,
+        type: "User"
+      }))
+    } : {},
+    meta: {
+      resourceType: "Group",
+      ...created !== undefined ? { created } : {},
+      ...lastModified !== undefined ? { lastModified } : {},
+      location: `${baseUrl}/Groups/${encodeURIComponent(group.id)}`
+    }
+  };
+}
+function serializeGroupList(groups, totalResults, startIndex, baseUrl) {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: groups.length,
+    Resources: groups.map((g) => serializeGroup(g, baseUrl))
+  };
+}
+export {
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_ERROR_SCHEMA,
+  SCIM_GROUP_SCHEMA,
+  SCIM_LIST_SCHEMA,
+  SCIM_PATCH_SCHEMA,
+  SCIM_USER_SCHEMA,
+  parseGroupWrite,
+  parseMembers,
+  parseUserWrite,
+  scimErrorBody,
+  serializeGroup,
+  serializeGroupList,
+  serializeList,
+  serializeUser
+};

package/dist/esm/http/handlers/scim.js

@@ -0,0 +1,59 @@
+// src/http/handlers/scim.ts
+import { handleScimRequest } from "../../domain/scim/handle";
+import { scimErrorBody } from "../../domain/scim/resource";
+var SCIM_CONTENT_TYPE = "application/scim+json;charset=utf-8";
+var MOUNT = "/scim/v2";
+function scimResponse(status, body, extra = {}) {
+  if (body === null || status === 204) {
+    return new Response(null, { status, headers: extra });
+  }
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": SCIM_CONTENT_TYPE,
+      "cache-control": "no-store",
+      ...extra
+    }
+  });
+}
+function makeScimHandler(deps) {
+  return async (c) => {
+    if (!deps.scimDirectory) {
+      return scimResponse(501, scimErrorBody(501, "SCIM is not configured on this deployment (no scimDirectory " + "was supplied to createIdP)"));
+    }
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return scimResponse(403, scimErrorBody(403, "SCIM provisioning is not enabled for this tenant"));
+    }
+    const url = new URL(c.req.url);
+    const path = url.pathname.startsWith(MOUNT) ? url.pathname.slice(MOUNT.length) : url.pathname;
+    const method = c.req.method.toUpperCase();
+    let body = null;
+    if (method === "POST" || method === "PUT" || method === "PATCH") {
+      const raw = await c.req.raw.text();
+      if (raw.length > 0) {
+        try {
+          body = JSON.parse(raw);
+        } catch {
+          return scimResponse(400, scimErrorBody(400, "request body is not valid JSON", "invalidSyntax"));
+        }
+      }
+    }
+    const issuer = c.get("issuerUrl");
+    const base = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer;
+    const result = await handleScimRequest({
+      tenant,
+      method,
+      path,
+      query: url.searchParams,
+      body,
+      authorization: c.req.header("authorization") ?? null,
+      baseUrl: `${base}${MOUNT}`,
+      directory: deps.scimDirectory
+    });
+    return scimResponse(result.status, result.body, result.headers ?? {});
+  };
+}
+export {
+  makeScimHandler
+};

package/dist/esm/http/middleware/tenant.js

@@ -7,6 +7,25 @@ import {
   tokenEndpointErrorResponse
 } from "../errors";
 import { authError } from "../../types/error";
+function isScimPath(pathname) {
+  return pathname === "/scim/v2" || pathname.startsWith("/scim/v2/");
+}
+function scimTenantErrorResponse(error) {
+  const operational = error.code === "server_error" || error.code === "internal_error";
+  const status = operational ? 500 : 403;
+  const detail = operational ? "the configuration store backing this endpoint failed the request" : "SCIM provisioning is not enabled for this tenant";
+  return new Response(JSON.stringify({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    status: String(status),
+    detail
+  }), {
+    status,
+    headers: {
+      "content-type": "application/scim+json;charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
 function isCallbackPath(pathname) {
   return pathname.startsWith("/cb/");
 }
@@ -41,6 +60,9 @@ function tenantMiddleware(deps) {
       if (url.pathname === "/authorize") {
         return authorizeDirectErrorResponse(resolved.error);
       }
+      if (isScimPath(url.pathname)) {
+        return scimTenantErrorResponse(resolved.error);
+      }
       return tokenEndpointErrorResponse(resolved.error);
     }
     const tenantId = resolved.value;
@@ -50,6 +72,9 @@ function tenantMiddleware(deps) {
       if (url.pathname === "/authorize") {
         return authorizeDirectErrorResponse(err);
       }
+      if (isScimPath(url.pathname)) {
+        return scimTenantErrorResponse(cfg.error);
+      }
       return tokenEndpointErrorResponse(err);
     }
     const custom = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};

package/dist/esm/http/router.js

@@ -7,6 +7,7 @@ import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
 import { makeMethodRouteHandler } from "./handlers/method-route";
 import { makeParHandler } from "./handlers/par";
 import { makeRegisterHandler } from "./handlers/register";
+import { makeScimHandler } from "./handlers/scim";
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
 import { makeTokenHandler } from "./handlers/token";
 import { makeUserinfoHandler } from "./handlers/userinfo";
@@ -34,6 +35,8 @@ function buildRouter(deps) {
   app.use("/end_session", tenantMiddleware(deps));
   app.get("/end_session", makeEndSessionHandler(deps));
   app.post("/end_session", makeEndSessionHandler(deps));
+  app.use("/scim/v2/*", tenantMiddleware(deps));
+  app.all("/scim/v2/*", makeScimHandler(deps));
   app.use("/par", tenantMiddleware(deps));
   app.post("/par", makeParHandler(deps));
   app.use("/register", tenantMiddleware(deps));

package/dist/esm/index.js

@@ -58,6 +58,7 @@ function createIdP(opts) {
     sessionStore: opts.sessionStore,
     keyStore: opts.keyStore,
     ...opts.methodStore ? { methodStore: opts.methodStore } : {},
+    ...opts.scimDirectory ? { scimDirectory: opts.scimDirectory } : {},
     ...auditLog ? { auditLog } : {},
     methodCache,
     stateKeys: opts.stateKeys,

package/dist/esm/methods/saml-sp/acs.js

@@ -2,24 +2,31 @@
 import xmldom from "@xmldom/xmldom";
 import { authError } from "../../types/error";
 import { mapProfile } from "./attributes";
-import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
 var { DOMParser } = xmldom;
-function checkRecipient(profile, acsUrl) {
+function parseVerifiedAssertion(profile) {
   if (typeof profile.getAssertionXml !== "function") {
     return {
-      kind: "error",
-      error: authError.internalError("saml-sp: node-saml profile exposes no getAssertionXml(); cannot " + "perform the Recipient binding check. Refusing to authenticate.")
+      failure: {
+        kind: "error",
+        error: authError.internalError("saml-sp: node-saml profile exposes no getAssertionXml(); cannot " + "perform the Recipient binding check. Refusing to authenticate.")
+      }
     };
   }
-  let doc;
   try {
-    doc = new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml");
+    return {
+      doc: new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml")
+    };
   } catch (e) {
     return {
-      kind: "error",
-      error: authError.internalError("saml-sp: failed to parse the verified assertion for the " + "Recipient check", e)
+      failure: {
+        kind: "error",
+        error: authError.internalError("saml-sp: failed to parse the verified assertion", e)
+      }
     };
   }
+}
+function checkRecipient(doc, acsUrl) {
   const nodes = doc.getElementsByTagNameNS("*", "SubjectConfirmationData");
   const recipients = [];
   for (let i = 0;i < nodes.length; i++) {
@@ -41,15 +48,7 @@ function checkRecipient(profile, acsUrl) {
   }
   return null;
 }
-function extractReplayInfo(profile) {
-  if (typeof profile.getAssertionXml !== "function")
-    return null;
-  let doc;
-  try {
-    doc = new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml");
-  } catch {
-    return null;
-  }
+function extractReplayInfo(doc) {
   const root = doc.documentElement;
   const assertionId = root?.getAttribute("ID") ?? "";
   if (!assertionId)
@@ -68,6 +67,25 @@ function extractReplayInfo(profile) {
   }
   return { assertionId, notOnOrAfterMs: earliest };
 }
+function extractAuthnStatement(doc) {
+  const out = {};
+  const stmt = doc.getElementsByTagNameNS("*", "AuthnStatement")[0];
+  if (!stmt)
+    return out;
+  const instant = stmt.getAttribute("AuthnInstant");
+  if (instant)
+    out.authnInstant = instant;
+  const sessionExpiry = stmt.getAttribute("SessionNotOnOrAfter");
+  if (sessionExpiry) {
+    const ms = Date.parse(sessionExpiry);
+    if (!Number.isNaN(ms))
+      out.sessionNotOnOrAfter = ms;
+  }
+  const ref = stmt.getElementsByTagNameNS("*", "AuthnContextClassRef")[0]?.textContent?.trim();
+  if (ref)
+    out.authnContextClassRef = ref;
+  return out;
+}
 async function consumeAssertion(ctx, methodId, config) {
   const idpInitiated = ctx.flow === null;
   let spEntityId;
@@ -85,7 +103,7 @@ async function consumeAssertion(ctx, methodId, config) {
         error: authError.internalError("saml-sp: IdP-initiated ACS dispatched without issuer context")
       };
     }
-    spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+    spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
     acsUrl = ctx.dispatch.callbackUrl;
   } else {
     const state = ctx.methodState;
@@ -148,11 +166,15 @@ async function consumeAssertion(ctx, methodId, config) {
   if (!profile || !profile.nameID) {
     return { kind: "denied", reason: "assertion produced no usable subject" };
   }
-  const recipientFailure = checkRecipient(profile, acsUrl);
+  const parsed = parseVerifiedAssertion(profile);
+  if ("failure" in parsed)
+    return parsed.failure;
+  const assertionDoc = parsed.doc;
+  const recipientFailure = checkRecipient(assertionDoc, acsUrl);
   if (recipientFailure)
     return recipientFailure;
   if (idpInitiated) {
-    const replay = extractReplayInfo(profile);
+    const replay = extractReplayInfo(assertionDoc);
     if (!replay) {
       return {
         kind: "error",
@@ -179,10 +201,12 @@ async function consumeAssertion(ctx, methodId, config) {
       };
     }
   }
+  const authnStatement = extractAuthnStatement(assertionDoc);
   const verified = {
     nameID: profile.nameID,
     nameIDFormat: profile.nameIDFormat ?? "",
     ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
+    ...authnStatement,
     attributes: profile.attributes ?? {},
     responseXml: profile.getSamlResponseXml?.() ?? ""
   };

package/dist/esm/methods/saml-sp/attributes.js

@@ -66,6 +66,8 @@ function mapProfile(profile, mapping) {
       attributes,
       ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
       authnInstant: Number.isNaN(authnInstant) ? Date.now() : authnInstant,
+      ...profile.sessionNotOnOrAfter !== undefined ? { sessionNotOnOrAfter: profile.sessionNotOnOrAfter } : {},
+      ...profile.authnContextClassRef !== undefined ? { authnContextClassRef: profile.authnContextClassRef } : {},
       raw: { responseXml: profile.responseXml }
     }
   };

package/dist/esm/methods/saml-sp/authnrequest.js

@@ -1,7 +1,7 @@
 // src/methods/saml-sp/authnrequest.ts
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
 async function buildAuthnRequestRedirect(ctx, methodId, config) {
   if (!ctx.dispatch) {
     return {
@@ -15,7 +15,7 @@ async function buildAuthnRequestRedirect(ctx, methodId, config) {
       error: authError.internalError("saml-sp: signAuthnRequest is true but signingKey is missing " + "(config schema should have rejected this).")
     };
   }
-  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const acsUrl = ctx.dispatch.callbackUrl;
   const probe = await ctx.methodScratch.put("authnrequest-scratch-probe", "1", 1000);
   if (isErr(probe)) {

package/dist/esm/methods/saml-sp/factory.js

@@ -48,13 +48,24 @@ var samlSpConfigSchema = z.object({
     certPem: z.string().min(1)
   }).optional(),
   idpInitiated: idpInitiatedSchema.optional(),
-  clockSkewSeconds: z.number().int().nonnegative().optional()
+  clockSkewSeconds: z.number().int().nonnegative().optional(),
+  spEntityId: z.string().min(1).optional(),
+  forceAuthn: z.boolean().optional(),
+  requestedAuthnContext: z.object({
+    classRefs: z.array(z.string().min(1)).min(1),
+    comparison: z.enum(["exact", "minimum", "maximum", "better"]).optional()
+  }).optional(),
+  requireSignedAssertion: z.boolean().optional(),
+  requireSignedResponse: z.boolean().optional()
 }).refine((c) => !c.signAuthnRequest || c.signingKey !== undefined, {
   message: "signingKey is required when signAuthnRequest is true",
   path: ["signingKey"]
 }).refine((c) => !c.allowEncryptedAssertions || c.decryptionKey !== undefined, {
   message: "decryptionKey is required when allowEncryptedAssertions is true",
   path: ["decryptionKey"]
+}).refine((c) => (c.requireSignedAssertion ?? true) || c.requireSignedResponse === true, {
+  message: "requireSignedAssertion may only be false when requireSignedResponse " + "is true — at least one signature is mandatory",
+  path: ["requireSignedAssertion"]
 });
 var samlSpFactory = {
   kind: "saml-sp",

package/dist/esm/methods/saml-sp/metadata.js

@@ -1,6 +1,6 @@
 // src/methods/saml-sp/metadata.ts
 import { authError } from "../../types/error";
-import { deriveSpEntityId } from "./saml-instance";
+import { resolveSpEntityId } from "./saml-instance";
 var NAME_ID_FORMAT_URN = {
   persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
   transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
@@ -19,6 +19,7 @@ function buildSpMetadataXml(input) {
   const entityId = xmlEscape(input.spEntityId);
   const acs = xmlEscape(input.acsUrl);
   const signed = input.signingCertPem !== undefined;
+  const wantAssertionsSigned = input.wantAssertionsSigned ?? true;
   const nameIdLine = input.nameIdFormat !== undefined ? `
     <md:NameIDFormat>${NAME_ID_FORMAT_URN[input.nameIdFormat]}</md:NameIDFormat>` : "";
   const x509 = (cert) => `<ds:KeyInfo><ds:X509Data><ds:X509Certificate>` + certBody(cert) + `</ds:X509Certificate></ds:X509Data></ds:KeyInfo>`;
@@ -30,7 +31,7 @@ function buildSpMetadataXml(input) {
     <md:SingleLogoutService ` + `Binding="${HTTP_POST}" Location="${xmlEscape(input.slsUrl)}"/>` : "";
   return `<?xml version="1.0" encoding="UTF-8"?>
 ` + `<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ` + `xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ` + `entityID="${entityId}">
-` + `  <md:SPSSODescriptor AuthnRequestsSigned="${signed}" ` + `WantAssertionsSigned="true" ` + `protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">` + keyDescriptor + sls + nameIdLine + `
+` + `  <md:SPSSODescriptor AuthnRequestsSigned="${signed}" ` + `WantAssertionsSigned="${wantAssertionsSigned}" ` + `protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">` + keyDescriptor + sls + nameIdLine + `
     <md:AssertionConsumerService ` + `Binding="${HTTP_POST}" Location="${acs}" index="0" isDefault="true"/>` + `
   </md:SPSSODescriptor>
 ` + `</md:EntityDescriptor>
@@ -43,7 +44,7 @@ async function buildSpMetadata(ctx, methodId, config) {
       error: authError.internalError("saml-sp: metadata route dispatched without issuer context " + "(ctx.dispatch is null)")
     };
   }
-  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const cb = new URL(ctx.dispatch.callbackUrl);
   const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`;
   const xml = buildSpMetadataXml({
@@ -51,6 +52,7 @@ async function buildSpMetadata(ctx, methodId, config) {
     acsUrl: ctx.dispatch.callbackUrl,
     ...config.idp.sloUrl ? { slsUrl } : {},
     ...config.idp.nameIdFormat !== undefined ? { nameIdFormat: config.idp.nameIdFormat } : {},
+    wantAssertionsSigned: config.requireSignedAssertion ?? true,
     ...config.signAuthnRequest && config.signingKey ? { signingCertPem: config.signingKey.certPem } : {},
     ...config.allowEncryptedAssertions && config.decryptionKey ? { encryptionCertPem: config.decryptionKey.certPem } : {}
   });

package/dist/esm/methods/saml-sp/saml-instance.js

@@ -14,6 +14,9 @@ function deriveSpEntityId(issuerUrl, tenantId, methodId) {
   const base = issuerUrl.endsWith("/") ? issuerUrl.slice(0, -1) : issuerUrl;
   return `${base}/${tenantId}/${methodId}`;
 }
+function resolveSpEntityId(config, issuerUrl, tenantId, methodId) {
+  return config.spEntityId ?? deriveSpEntityId(issuerUrl, tenantId, methodId);
+}
 function buildSamlInstance(config, binding, nowMs) {
   const activeCerts = selectActiveCertPems(config.idp.signingCerts, nowMs);
   if (activeCerts.length === 0) {
@@ -29,9 +32,15 @@ function buildSamlInstance(config, binding, nowMs) {
     audience: binding.spEntityId,
     identifierFormat,
     validateInResponseTo: binding.logout ? ValidateInResponseTo.never : binding.idpInitiated ? ValidateInResponseTo.ifPresent : ValidateInResponseTo.always,
-    wantAssertionsSigned: true,
-    wantAuthnResponseSigned: false,
+    wantAssertionsSigned: config.requireSignedAssertion ?? true,
+    wantAuthnResponseSigned: config.requireSignedResponse ?? false,
     acceptedClockSkewMs: (config.clockSkewSeconds ?? 60) * 1000,
+    forceAuthn: config.forceAuthn ?? false,
+    ...config.requestedAuthnContext ? {
+      disableRequestedAuthnContext: false,
+      authnContext: [...config.requestedAuthnContext.classRefs],
+      racComparison: config.requestedAuthnContext.comparison ?? "exact"
+    } : { disableRequestedAuthnContext: true },
     cacheProvider: methodScratchCacheProvider(binding.scratch, IN_RESPONSE_TO_TTL_MS),
     ...binding.signing ? {
       privateKey: binding.signing.privateKeyPem,
@@ -45,5 +54,6 @@ function buildSamlInstance(config, binding, nowMs) {
 export {
   NAME_ID_FORMAT_URN,
   buildSamlInstance,
-  deriveSpEntityId
+  deriveSpEntityId,
+  resolveSpEntityId
 };

package/dist/esm/methods/saml-sp/slo-initiate.js

@@ -2,7 +2,7 @@
 import { authError } from "../../types/error";
 import {
   buildSamlInstance,
-  deriveSpEntityId,
+  resolveSpEntityId,
   NAME_ID_FORMAT_URN
 } from "./saml-instance";
 async function initiateSpLogout(ctx, methodId, config) {
@@ -44,7 +44,7 @@ async function initiateSpLogout(ctx, methodId, config) {
     };
   }
   const nameIDFormat = nameIdFormatParam !== null ? NAME_ID_FORMAT_URN[nameIdFormatParam] : config.idp.nameIdFormat !== undefined ? NAME_ID_FORMAT_URN[config.idp.nameIdFormat] : NAME_ID_FORMAT_URN.persistent;
-  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   let redirectUrl;
   try {
     const saml = buildSamlInstance(config, {

package/dist/esm/methods/saml-sp/sls.js

@@ -1,7 +1,7 @@
 // src/methods/saml-sp/sls.ts
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
 var SLO_REPLAY_HORIZON_MS = 10 * 60000;
 async function consumeSls(ctx, methodId, config) {
   if (!ctx.dispatch) {
@@ -16,7 +16,7 @@ async function consumeSls(ctx, methodId, config) {
       error: authError.internalError("saml-sp: /sls reached with no idp.sloUrl configured")
     };
   }
-  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const url = new URL(ctx.request.url);
   const originalQuery = url.search.replace(/^\?/, "");
   let samlRequest;