@boxyhq/saml-jackson 1.0.0 → 1.0.1

package/dist/controller/oauth.js

@@ -79,6 +79,8 @@ class OAuthController {
             const { response_type = 'code', client_id, redirect_uri, state, tenant, product, code_challenge, code_challenge_method = '', 
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
             provider = 'saml', } = body;
+            let requestedTenant = tenant;
+            let requestedProduct = product;
             metrics.increment('oauthAuthorize');
             if (!redirect_uri) {
                 throw new error_1.JacksonError('Please specify a redirect URL.', 400);
@@ -102,6 +104,8 @@ class OAuthController {
                 // if tenant and product are encoded in the client_id then we parse it and check for the relevant config(s)
                 const sp = getEncodedClientId(client_id);
                 if (sp === null || sp === void 0 ? void 0 : sp.tenant) {
+                    requestedTenant = sp.tenant;
+                    requestedProduct = sp.product || '';
                     const samlConfigs = yield this.configStore.getByIndex({
                         name: utils_1.IndexNames.TenantProduct,
                         value: dbutils.keyFromParts(sp.tenant, sp.product || ''),
@@ -145,9 +149,9 @@ class OAuthController {
                 publicKey: samlConfig.certs.publicKey,
             });
             const sessionId = crypto_1.default.randomBytes(16).toString('hex');
-            const requestedParams = {
-                tenant,
-                product,
+            const requested = {
+                tenant: requestedTenant,
+                product: requestedProduct,
                 client_id,
                 state,
             };
@@ -158,7 +162,7 @@ class OAuthController {
                 state,
                 code_challenge,
                 code_challenge_method,
-                requested: requestedParams,
+                requested,
             });
             const relayState = relayStatePrefix + sessionId;
             let redirectUrl;
@@ -201,8 +205,6 @@ class OAuthController {
             if (!samlConfigs || samlConfigs.length === 0) {
                 throw new error_1.JacksonError('SAML configuration not found.', 403);
             }
-            // TODO: Support multiple matches
-            const samlConfig = samlConfigs[0];
             let session;
             if (RelayState !== '') {
                 session = yield this.sessionStore.get(RelayState);
@@ -210,6 +212,17 @@ class OAuthController {
                     throw new error_1.JacksonError('Unable to validate state from the origin request.', 403);
                 }
             }
+            // Resolve if there are multiple matches for SP login. TODO: Support multiple matches for IdP login
+            const samlConfig = samlConfigs.length === 1
+                ? samlConfigs[0]
+                : samlConfigs.filter((c) => {
+                    var _a, _b, _c;
+                    return (c.clientID === ((_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.client_id) ||
+                        (c.tenant === ((_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.tenant) && c.product === ((_c = session === null || session === void 0 ? void 0 : session.requested) === null || _c === void 0 ? void 0 : _c.product)));
+                })[0];
+            if (!samlConfig) {
+                throw new error_1.JacksonError('SAML configuration not found.', 403);
+            }
             const validateOpts = {
                 thumbprint: samlConfig.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"