@boxyhq/saml-jackson 0.3.8-beta.761 → 0.3.8-beta.767

package/dist/controller/oauth.js

@@ -138,6 +138,7 @@ class OAuthController {
                 entityID: this.opts.samlAudience,
                 callbackUrl: this.opts.externalUrl + this.opts.samlPath,
                 signingKey: samlConfig.certs.privateKey,
+                publicKey: samlConfig.certs.publicKey,
             });
             const sessionId = crypto_1.default.randomBytes(16).toString('hex');
             yield this.sessionStore.put(sessionId, {

package/dist/saml/saml.d.ts

@@ -1,6 +1,7 @@
 import { SAMLProfile, SAMLReq } from '../typings';
+export declare const stripCertHeaderAndFooter: (cert: string) => string;
 declare const _default: {
-    request: ({ ssoUrl, entityID, callbackUrl, isPassive, forceAuthn, identifierFormat, providerName, signingKey, }: SAMLReq) => {
+    request: ({ ssoUrl, entityID, callbackUrl, isPassive, forceAuthn, identifierFormat, providerName, signingKey, publicKey, }: SAMLReq) => {
         id: string;
         request: string;
     };

package/dist/saml/saml.js

@@ -31,6 +31,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripCertHeaderAndFooter = void 0;
 const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 const xml2js_1 = __importDefault(require("xml2js"));
 const thumbprint_1 = __importDefault(require("thumbprint"));
@@ -42,7 +43,32 @@ const claims_1 = __importDefault(require("./claims"));
 const idPrefix = '_';
 const authnXPath = '/*[local-name(.)="AuthnRequest" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:protocol"]';
 const issuerXPath = '/*[local-name(.)="Issuer" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:assertion"]';
-const signRequest = (xml, signingKey) => {
+const stripCertHeaderAndFooter = (cert) => {
+    cert = cert.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, '');
+    cert = cert.replace(/-+END CERTIFICATE-+\r?\n?/, '');
+    cert = cert.replace(/\r\n/g, '\n');
+    return cert;
+};
+exports.stripCertHeaderAndFooter = stripCertHeaderAndFooter;
+function PubKeyInfo(pubKey) {
+    this.pubKey = (0, exports.stripCertHeaderAndFooter)(pubKey);
+    this.getKeyInfo = function (_key, prefix) {
+        prefix = prefix || '';
+        prefix = prefix ? prefix + ':' : prefix;
+        return ('<' +
+            prefix +
+            'X509Data><' +
+            prefix +
+            'X509Certificate>' +
+            this.pubKey +
+            '</' +
+            prefix +
+            'X509Certificate></' +
+            prefix +
+            'X509Data>');
+    };
+}
+const signRequest = (xml, signingKey, publicKey) => {
     if (!xml) {
         throw new Error('Please specify xml');
     }
@@ -51,6 +77,7 @@ const signRequest = (xml, signingKey) => {
     }
     const sig = new xml_crypto_1.default.SignedXml();
     sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
+    sig.keyInfoProvider = new PubKeyInfo(publicKey);
     sig.signingKey = signingKey;
     sig.addReference(authnXPath, ['http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#'], 'http://www.w3.org/2001/04/xmlenc#sha256');
     sig.computeSignature(xml, {
@@ -58,7 +85,7 @@ const signRequest = (xml, signingKey) => {
     });
     return sig.getSignedXml();
 };
-const request = ({ ssoUrl, entityID, callbackUrl, isPassive = false, forceAuthn = false, identifierFormat = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', providerName = 'BoxyHQ', signingKey, }) => {
+const request = ({ ssoUrl, entityID, callbackUrl, isPassive = false, forceAuthn = false, identifierFormat = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', providerName = 'BoxyHQ', signingKey, publicKey, }) => {
     const id = idPrefix + crypto_1.default.randomBytes(10).toString('hex');
     const date = new Date().toISOString();
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -92,7 +119,7 @@ const request = ({ ssoUrl, entityID, callbackUrl, isPassive = false, forceAuthn
     }
     let xml = xmlbuilder_1.default.create(samlReq).end({});
     if (signingKey) {
-        xml = signRequest(xml, signingKey);
+        xml = signRequest(xml, signingKey, publicKey);
     }
     return {
         id,

package/dist/typings.d.ts

@@ -110,6 +110,7 @@ export interface SAMLReq {
     identifierFormat?: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress';
     providerName?: 'BoxyHQ';
     signingKey: string;
+    publicKey: string;
 }
 export interface SAMLProfile {
     audience: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "0.3.8-beta.761",
+  "version": "0.3.8-beta.767",
   "description": "SAML 2.0 service",
   "keywords": [
     "SAML 2.0"