@boxyhq/saml-jackson 1.0.0 → 1.0.3

package/dist/controller/api.js

@@ -50,7 +50,7 @@ exports.APIController = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const dbutils = __importStar(require("../db/utils"));
 const metrics = __importStar(require("../opentelemetry/metrics"));
-const saml_1 = __importDefault(require("../saml/saml"));
+const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 const x509_1 = __importDefault(require("../saml/x509"));
 const error_1 = require("./error");
 const utils_1 = require("./utils");
@@ -187,7 +187,7 @@ class APIController {
             if (encodedRawMetadata) {
                 metaData = Buffer.from(encodedRawMetadata, 'base64').toString();
             }
-            const idpMetadata = yield saml_1.default.parseMetadataAsync(metaData);
+            const idpMetadata = yield saml20_1.default.parseMetadataAsync(metaData);
             // extract provider
             let providerName = extractHostName(idpMetadata.entityID);
             if (!providerName) {
@@ -323,7 +323,7 @@ class APIController {
             }
             let newMetadata;
             if (metaData) {
-                newMetadata = yield saml_1.default.parseMetadataAsync(metaData);
+                newMetadata = yield saml20_1.default.parseMetadataAsync(metaData);
                 // extract provider
                 let providerName = extractHostName(newMetadata.entityID);
                 if (!providerName) {

package/dist/controller/{signout.js → logout.js}

@@ -36,21 +36,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LogoutController = void 0;
-const xmldom_1 = require("@xmldom/xmldom");
 const crypto_1 = __importDefault(require("crypto"));
-const thumbprint_1 = __importDefault(require("thumbprint"));
 const util_1 = require("util");
-const xml_crypto_1 = require("xml-crypto");
 const xml2js_1 = __importDefault(require("xml2js"));
 const xmlbuilder_1 = __importDefault(require("xmlbuilder"));
 const zlib_1 = require("zlib");
 const dbutils = __importStar(require("../db/utils"));
-const saml_1 = __importDefault(require("../saml/saml"));
+const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 const error_1 = require("./error");
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const relayStatePrefix = 'boxyhq_jackson_';
+const logoutXPath = "/*[local-name(.)='LogoutRequest']";
 class LogoutController {
     constructor({ configStore, sessionStore, opts }) {
         this.opts = opts;
@@ -97,7 +95,16 @@ class LogoutController {
             }
             // HTTP-POST binding
             if ('postUrl' in slo) {
-                logoutForm = (0, utils_1.createRequestForm)(relayState, encodeURI(Buffer.from(signedXML).toString('base64')), slo.postUrl);
+                logoutForm = saml20_1.default.createPostForm(slo.postUrl, [
+                    {
+                        name: 'RelayState',
+                        value: relayState,
+                    },
+                    {
+                        name: 'SAMLRequest',
+                        value: Buffer.from(signedXML).toString('base64'),
+                    },
+                ]);
             }
             return { logoutUrl, logoutForm };
         });
@@ -127,7 +134,7 @@ class LogoutController {
                 throw new error_1.JacksonError('SAML configuration not found.', 403);
             }
             const { idpMetadata, defaultRedirectUrl } = samlConfigs[0];
-            if (!(yield hasValidSignature(rawResponse, idpMetadata.thumbprint))) {
+            if (!(yield saml20_1.default.validateSignature(rawResponse, null, idpMetadata.thumbprint))) {
                 throw new error_1.JacksonError('Invalid signature.', 403);
             }
             try {
@@ -188,44 +195,5 @@ const parseSAMLResponse = (rawResponse) => __awaiter(void 0, void 0, void 0, fun
 });
 // Sign the XML
 const signXML = (xml, signingKey, publicKey) => __awaiter(void 0, void 0, void 0, function* () {
-    const sig = new xml_crypto_1.SignedXml();
-    sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
-    sig.keyInfoProvider = new saml_1.default.PubKeyInfo(publicKey);
-    sig.signingKey = signingKey;
-    sig.addReference("/*[local-name(.)='LogoutRequest']", ['http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#'], 'http://www.w3.org/2001/04/xmlenc#sha256');
-    sig.computeSignature(xml);
-    return sig.getSignedXml();
-});
-// Validate signature
-const hasValidSignature = (xml, certThumbprint) => __awaiter(void 0, void 0, void 0, function* () {
-    return new Promise((resolve, reject) => {
-        const doc = new xmldom_1.DOMParser().parseFromString(xml);
-        const signed = new xml_crypto_1.SignedXml();
-        let calculatedThumbprint;
-        const signature = (0, xml_crypto_1.xpath)(doc, "/*/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0] ||
-            (0, xml_crypto_1.xpath)(doc, "/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0] ||
-            (0, xml_crypto_1.xpath)(doc, "/*/*/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0];
-        signed.keyInfoProvider = {
-            getKey: function getKey(keyInfo) {
-                if (certThumbprint) {
-                    const embeddedSignature = keyInfo[0].getElementsByTagNameNS('http://www.w3.org/2000/09/xmldsig#', 'X509Certificate');
-                    if (embeddedSignature.length > 0) {
-                        const base64cer = embeddedSignature[0].firstChild.toString();
-                        calculatedThumbprint = thumbprint_1.default.calculate(base64cer);
-                        return saml_1.default.certToPEM(base64cer);
-                    }
-                }
-            },
-            getKeyInfo: function getKeyInfo() {
-                return '<X509Data></X509Data>';
-            },
-        };
-        signed.loadSignature(signature.toString());
-        try {
-            return resolve(signed.checkSignature(xml) && calculatedThumbprint.toUpperCase() === certThumbprint.toUpperCase());
-        }
-        catch (err) {
-            return reject(err);
-        }
-    });
+    return yield saml20_1.default.sign(xml, signingKey, publicKey, logoutXPath);
 });

package/dist/controller/oauth/redirect.d.ts

@@ -1 +1 @@
-export declare const success: (redirectUrl: string, params: Record<string, string>) => string;
+export declare const success: (redirectUrl: string, params: Record<string, string | string[] | undefined>) => string;

package/dist/controller/oauth/redirect.js

@@ -4,7 +4,12 @@ exports.success = void 0;
 const success = (redirectUrl, params) => {
     const url = new URL(redirectUrl);
     for (const [key, value] of Object.entries(params)) {
-        url.searchParams.set(key, value);
+        if (Array.isArray(value)) {
+            value.forEach((v) => url.searchParams.append(key, v));
+        }
+        else if (value !== undefined) {
+            url.searchParams.set(key, value);
+        }
     }
     return url.href;
 };

package/dist/controller/oauth.d.ts

@@ -12,12 +12,14 @@ export declare class OAuthController implements IOAuthController {
         tokenStore: any;
         opts: any;
     });
+    private resolveMultipleConfigMatches;
     authorize(body: OAuthReqBody): Promise<{
-        redirect_url: string;
-        authorize_form: string;
+        redirect_url?: string;
+        authorize_form?: string;
     }>;
     samlResponse(body: SAMLResponsePayload): Promise<{
-        redirect_url: string;
+        redirect_url?: string;
+        app_select_form?: string;
     }>;
     /**
      * @swagger

package/dist/controller/oauth.js

@@ -41,15 +41,27 @@ const util_1 = require("util");
 const zlib_1 = require("zlib");
 const dbutils = __importStar(require("../db/utils"));
 const metrics = __importStar(require("../opentelemetry/metrics"));
-const saml_1 = __importDefault(require("../saml/saml"));
+const saml20_1 = __importDefault(require("@boxyhq/saml20"));
+const claims_1 = __importDefault(require("../saml/claims"));
 const error_1 = require("./error");
 const allowed = __importStar(require("./oauth/allowed"));
 const codeVerifier = __importStar(require("./oauth/code-verifier"));
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
-const relayStatePrefix = 'boxyhq_jackson_';
-function getEncodedClientId(client_id) {
+const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
+    const profile = yield saml20_1.default.validateAsync(rawResponse, validateOpts);
+    if (profile && profile.claims) {
+        // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
+        profile.claims = claims_1.default.map(profile.claims);
+        // some providers don't return the id in the assertion, we set it to a sha256 hash of the email
+        if (!profile.claims.id && profile.claims.email) {
+            profile.claims.id = crypto_1.default.createHash('sha256').update(profile.claims.email).digest('hex');
+        }
+    }
+    return profile;
+});
+function getEncodedTenantProduct(client_id) {
     try {
         const sp = new URLSearchParams(client_id);
         const tenant = sp.get('tenant');
@@ -74,11 +86,53 @@ class OAuthController {
         this.tokenStore = tokenStore;
         this.opts = opts;
     }
+    resolveMultipleConfigMatches(samlConfigs, idp_hint, originalParams, isIdpFlow = false) {
+        if (samlConfigs.length > 1) {
+            if (idp_hint) {
+                return { resolvedSamlConfig: samlConfigs.find(({ clientID }) => clientID === idp_hint) };
+            }
+            else if (this.opts.idpDiscoveryPath) {
+                if (!isIdpFlow) {
+                    // redirect to IdP selection page
+                    const idpList = samlConfigs.map(({ idpMetadata: { provider }, clientID }) => JSON.stringify({
+                        provider,
+                        clientID,
+                    }));
+                    return {
+                        redirect_url: redirect.success(this.opts.externalUrl + this.opts.idpDiscoveryPath, Object.assign(Object.assign({}, originalParams), { idp: idpList })),
+                    };
+                }
+                else {
+                    const appList = samlConfigs.map(({ product, name, description, clientID }) => ({
+                        product,
+                        name,
+                        description,
+                        clientID,
+                    }));
+                    return {
+                        app_select_form: saml20_1.default.createPostForm(this.opts.idpDiscoveryPath, [
+                            {
+                                name: 'SAMLResponse',
+                                value: originalParams.SAMLResponse,
+                            },
+                            {
+                                name: 'app',
+                                value: encodeURIComponent(JSON.stringify(appList)),
+                            },
+                        ]),
+                    };
+                }
+            }
+        }
+        return {};
+    }
     authorize(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { response_type = 'code', client_id, redirect_uri, state, tenant, product, code_challenge, code_challenge_method = '', 
+            const { response_type = 'code', client_id, redirect_uri, state, tenant, product, access_type, code_challenge, code_challenge_method = '', 
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            provider = 'saml', } = body;
+            provider = 'saml', idp_hint, } = body;
+            let requestedTenant = tenant;
+            let requestedProduct = product;
             metrics.increment('oauthAuthorize');
             if (!redirect_uri) {
                 throw new error_1.JacksonError('Please specify a redirect URL.', 400);
@@ -95,25 +149,69 @@ class OAuthController {
                 if (!samlConfigs || samlConfigs.length === 0) {
                     throw new error_1.JacksonError('SAML configuration not found.', 403);
                 }
-                // TODO: Support multiple matches
                 samlConfig = samlConfigs[0];
+                // Support multiple matches
+                const { resolvedSamlConfig, redirect_url } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, {
+                    response_type,
+                    client_id,
+                    redirect_uri,
+                    state,
+                    tenant,
+                    product,
+                    code_challenge,
+                    code_challenge_method,
+                    provider,
+                });
+                if (redirect_url) {
+                    return { redirect_url };
+                }
+                if (resolvedSamlConfig) {
+                    samlConfig = resolvedSamlConfig;
+                }
             }
-            else if (client_id && client_id !== '' && client_id !== 'undefined' && client_id !== 'null') {
+            else if ((client_id && client_id !== '' && client_id !== 'undefined' && client_id !== 'null') ||
+                (access_type && access_type !== '' && access_type !== 'undefined' && access_type !== 'null')) {
                 // if tenant and product are encoded in the client_id then we parse it and check for the relevant config(s)
-                const sp = getEncodedClientId(client_id);
-                if (sp === null || sp === void 0 ? void 0 : sp.tenant) {
+                let sp = getEncodedTenantProduct(client_id);
+                if (!sp && access_type) {
+                    sp = getEncodedTenantProduct(access_type);
+                }
+                if (sp && sp.tenant && sp.product) {
+                    requestedTenant = sp.tenant;
+                    requestedProduct = sp.product;
                     const samlConfigs = yield this.configStore.getByIndex({
                         name: utils_1.IndexNames.TenantProduct,
-                        value: dbutils.keyFromParts(sp.tenant, sp.product || ''),
+                        value: dbutils.keyFromParts(sp.tenant, sp.product),
                     });
                     if (!samlConfigs || samlConfigs.length === 0) {
                         throw new error_1.JacksonError('SAML configuration not found.', 403);
                     }
-                    // TODO: Support multiple matches
                     samlConfig = samlConfigs[0];
+                    // Support multiple matches
+                    const { resolvedSamlConfig, redirect_url } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, {
+                        response_type,
+                        client_id,
+                        redirect_uri,
+                        state,
+                        tenant,
+                        product,
+                        code_challenge,
+                        code_challenge_method,
+                        provider,
+                    });
+                    if (redirect_url) {
+                        return { redirect_url };
+                    }
+                    if (resolvedSamlConfig) {
+                        samlConfig = resolvedSamlConfig;
+                    }
                 }
                 else {
                     samlConfig = yield this.configStore.get(client_id);
+                    if (samlConfig) {
+                        requestedTenant = samlConfig.tenant;
+                        requestedProduct = samlConfig.product;
+                    }
                 }
             }
             else {
@@ -137,7 +235,7 @@ class OAuthController {
                 ssoUrl = sso.postUrl;
                 post = true;
             }
-            const samlReq = saml_1.default.request({
+            const samlReq = saml20_1.default.request({
                 ssoUrl,
                 entityID: this.opts.samlAudience,
                 callbackUrl: this.opts.externalUrl + this.opts.samlPath,
@@ -145,12 +243,16 @@ class OAuthController {
                 publicKey: samlConfig.certs.publicKey,
             });
             const sessionId = crypto_1.default.randomBytes(16).toString('hex');
-            const requestedParams = {
-                tenant,
-                product,
-                client_id,
-                state,
-            };
+            const requested = { client_id, state };
+            if (requestedTenant) {
+                requested.tenant = requestedTenant;
+            }
+            if (requestedProduct) {
+                requested.product = requestedProduct;
+            }
+            if (idp_hint) {
+                requested.idp_hint = idp_hint;
+            }
             yield this.sessionStore.put(sessionId, {
                 id: samlReq.id,
                 redirect_uri,
@@ -158,9 +260,9 @@ class OAuthController {
                 state,
                 code_challenge,
                 code_challenge_method,
-                requested: requestedParams,
+                requested,
             });
-            const relayState = relayStatePrefix + sessionId;
+            const relayState = utils_1.relayStatePrefix + sessionId;
             let redirectUrl;
             let authorizeForm;
             if (!post) {
@@ -172,7 +274,16 @@ class OAuthController {
             }
             else {
                 // HTTP POST binding
-                authorizeForm = (0, utils_1.createRequestForm)(relayState, encodeURI(Buffer.from(samlReq.request).toString('base64')), ssoUrl);
+                authorizeForm = saml20_1.default.createPostForm(ssoUrl, [
+                    {
+                        name: 'RelayState',
+                        value: relayState,
+                    },
+                    {
+                        name: 'SAMLRequest',
+                        value: Buffer.from(samlReq.request).toString('base64'),
+                    },
+                ]);
             }
             return {
                 redirect_url: redirectUrl,
@@ -182,18 +293,16 @@ class OAuthController {
     }
     samlResponse(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { SAMLResponse } = body;
+            const { SAMLResponse, idp_hint } = body;
             let RelayState = body.RelayState || ''; // RelayState will contain the sessionId from earlier quasi-oauth flow
-            if (!this.opts.idpEnabled && !RelayState.startsWith(relayStatePrefix)) {
+            const isIdPFlow = !RelayState.startsWith(utils_1.relayStatePrefix);
+            if (!this.opts.idpEnabled && isIdPFlow) {
                 // IDP is disabled so block the request
                 throw new error_1.JacksonError('IdP (Identity Provider) flow has been disabled. Please head to your Service Provider to login.', 403);
             }
-            if (!RelayState.startsWith(relayStatePrefix)) {
-                RelayState = '';
-            }
-            RelayState = RelayState.replace(relayStatePrefix, '');
+            RelayState = RelayState.replace(utils_1.relayStatePrefix, '');
             const rawResponse = Buffer.from(SAMLResponse, 'base64').toString();
-            const parsedResp = yield saml_1.default.parseAsync(rawResponse);
+            const parsedResp = yield saml20_1.default.parseAsync(rawResponse);
             const samlConfigs = yield this.configStore.getByIndex({
                 name: utils_1.IndexNames.EntityID,
                 value: parsedResp === null || parsedResp === void 0 ? void 0 : parsedResp.issuer,
@@ -201,8 +310,17 @@ class OAuthController {
             if (!samlConfigs || samlConfigs.length === 0) {
                 throw new error_1.JacksonError('SAML configuration not found.', 403);
             }
-            // TODO: Support multiple matches
-            const samlConfig = samlConfigs[0];
+            let samlConfig = samlConfigs[0];
+            if (isIdPFlow) {
+                RelayState = '';
+                const { resolvedSamlConfig, app_select_form } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, { SAMLResponse }, true);
+                if (app_select_form) {
+                    return { app_select_form };
+                }
+                if (resolvedSamlConfig) {
+                    samlConfig = resolvedSamlConfig;
+                }
+            }
             let session;
             if (RelayState !== '') {
                 session = yield this.sessionStore.get(RelayState);
@@ -210,6 +328,20 @@ class OAuthController {
                     throw new error_1.JacksonError('Unable to validate state from the origin request.', 403);
                 }
             }
+            if (!isIdPFlow) {
+                // Resolve if there are multiple matches for SP login. TODO: Support multiple matches for IdP login
+                samlConfig =
+                    samlConfigs.length === 1
+                        ? samlConfigs[0]
+                        : samlConfigs.filter((c) => {
+                            var _a, _b, _c;
+                            return (c.clientID === ((_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.client_id) ||
+                                (c.tenant === ((_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.tenant) && c.product === ((_c = session === null || session === void 0 ? void 0 : session.requested) === null || _c === void 0 ? void 0 : _c.product)));
+                        })[0];
+            }
+            if (!samlConfig) {
+                throw new error_1.JacksonError('SAML configuration not found.', 403);
+            }
             const validateOpts = {
                 thumbprint: samlConfig.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,
@@ -217,7 +349,7 @@ class OAuthController {
             if (session && session.id) {
                 validateOpts.inResponseTo = session.id;
             }
-            const profile = yield saml_1.default.validateAsync(rawResponse, validateOpts);
+            const profile = yield validateResponse(rawResponse, validateOpts);
             // store details against a code
             const code = crypto_1.default.randomBytes(20).toString('hex');
             const codeVal = {
@@ -332,7 +464,7 @@ class OAuthController {
             else if (client_id && client_secret) {
                 // check if we have an encoded client_id
                 if (client_id !== 'dummy') {
-                    const sp = getEncodedClientId(client_id);
+                    const sp = getEncodedTenantProduct(client_id);
                     if (!sp) {
                         // OAuth flow
                         if (client_id !== codeVal.clientID || client_secret !== codeVal.clientSecret) {

package/dist/controller/utils.d.ts

@@ -2,5 +2,5 @@ export declare enum IndexNames {
     EntityID = "entityID",
     TenantProduct = "tenantProduct"
 }
-export declare const createRequestForm: (relayState: string, samlReqEnc: string, postUrl: string) => string;
+export declare const relayStatePrefix = "boxyhq_jackson_";
 export declare const validateAbsoluteUrl: (url: any, message: any) => void;

package/dist/controller/utils.js

@@ -1,36 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAbsoluteUrl = exports.createRequestForm = exports.IndexNames = void 0;
+exports.validateAbsoluteUrl = exports.relayStatePrefix = exports.IndexNames = void 0;
 const error_1 = require("./error");
 var IndexNames;
 (function (IndexNames) {
     IndexNames["EntityID"] = "entityID";
     IndexNames["TenantProduct"] = "tenantProduct";
 })(IndexNames = exports.IndexNames || (exports.IndexNames = {}));
-const createRequestForm = (relayState, samlReqEnc, postUrl) => {
-    const formElements = [
-        '<!DOCTYPE html>',
-        '<html>',
-        '<head>',
-        '<meta charset="utf-8">',
-        '<meta http-equiv="x-ua-compatible" content="ie=edge">',
-        '</head>',
-        '<body onload="document.forms[0].submit()">',
-        '<noscript>',
-        '<p>Note: Since your browser does not support JavaScript, you must press the Continue button once to proceed.</p>',
-        '</noscript>',
-        '<form method="post" action="' + encodeURI(postUrl) + '">',
-        '<input type="hidden" name="RelayState" value="' + relayState + '"/>',
-        '<input type="hidden" name="SAMLRequest" value="' + samlReqEnc + '"/>',
-        '<input type="submit" value="Continue" />',
-        '</form>',
-        '<script>document.forms[0].style.display="none";</script>',
-        '</body>',
-        '</html>',
-    ];
-    return formElements.join('');
-};
-exports.createRequestForm = createRequestForm;
+exports.relayStatePrefix = 'boxyhq_jackson_';
 const validateAbsoluteUrl = (url, message) => {
     try {
         new URL(url);

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { AdminController } from './controller/admin';
 import { APIController } from './controller/api';
 import { OAuthController } from './controller/oauth';
 import { HealthCheckController } from './controller/health-check';
-import { LogoutController } from './controller/signout';
+import { LogoutController } from './controller/logout';
 import { JacksonOption } from './typings';
 export declare const controllers: (opts: JacksonOption) => Promise<{
     apiController: APIController;

package/dist/index.js

@@ -31,7 +31,7 @@ const admin_1 = require("./controller/admin");
 const api_1 = require("./controller/api");
 const oauth_1 = require("./controller/oauth");
 const health_check_1 = require("./controller/health-check");
-const signout_1 = require("./controller/signout");
+const logout_1 = require("./controller/logout");
 const db_1 = __importDefault(require("./db/db"));
 const defaultDb_1 = __importDefault(require("./db/defaultDb"));
 const read_config_1 = __importDefault(require("./read-config"));
@@ -58,7 +58,7 @@ const controllers = (opts) => __awaiter(void 0, void 0, void 0, function* () {
     const sessionStore = db.store('oauth:session', opts.db.ttl);
     const codeStore = db.store('oauth:code', opts.db.ttl);
     const tokenStore = db.store('oauth:token', opts.db.ttl);
-    const healthCheckStore = db.store('_health');
+    const healthCheckStore = db.store('_health:check');
     const apiController = new api_1.APIController({ configStore });
     const adminController = new admin_1.AdminController({ configStore });
     const healthCheckController = new health_check_1.HealthCheckController({ healthCheckStore });
@@ -70,7 +70,7 @@ const controllers = (opts) => __awaiter(void 0, void 0, void 0, function* () {
         tokenStore,
         opts,
     });
-    const logoutController = new signout_1.LogoutController({
+    const logoutController = new logout_1.LogoutController({
         configStore,
         sessionStore,
         opts,

package/dist/typings.d.ts

@@ -29,7 +29,8 @@ export interface IOAuthController {
         authorize_form?: string;
     }>;
     samlResponse(body: SAMLResponsePayload): Promise<{
-        redirect_url: string;
+        redirect_url?: string;
+        app_select_form?: string;
     }>;
     token(body: OAuthTokenReq): Promise<OAuthTokenRes>;
     userInfo(token: string): Promise<Profile>;
@@ -48,15 +49,18 @@ export interface OAuthReqBody {
     client_id: string;
     redirect_uri: string;
     state: string;
-    tenant: string;
-    product: string;
+    tenant?: string;
+    product?: string;
+    access_type?: string;
     code_challenge: string;
     code_challenge_method: 'plain' | 'S256' | '';
     provider: 'saml';
+    idp_hint?: string;
 }
 export interface SAMLResponsePayload {
     SAMLResponse: string;
     RelayState: string;
+    idp_hint?: string;
 }
 export interface OAuthTokenReq {
     client_id: string;
@@ -111,23 +115,6 @@ export interface DatabaseOption {
     encryptionKey?: string;
     pageLimit?: number;
 }
-export interface SAMLReq {
-    ssoUrl?: string;
-    entityID: string;
-    callbackUrl: string;
-    isPassive?: boolean;
-    forceAuthn?: boolean;
-    identifierFormat?: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress';
-    providerName?: 'BoxyHQ';
-    signingKey: string;
-    publicKey: string;
-}
-export interface SAMLProfile {
-    audience: string;
-    claims: Record<string, any>;
-    issuer: string;
-    sessionIndex: string;
-}
 export interface JacksonOption {
     externalUrl: string;
     samlPath: string;
@@ -136,6 +123,7 @@ export interface JacksonOption {
     idpEnabled?: boolean;
     db: DatabaseOption;
     clientSecretVerifier?: string;
+    idpDiscoveryPath?: string;
 }
 export interface SLORequestParams {
     nameId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"
@@ -36,38 +36,35 @@
     "statements": 70
   },
   "dependencies": {
-    "@boxyhq/saml20": "0.2.1",
+    "@boxyhq/saml20": "1.0.2",
     "@opentelemetry/api-metrics": "0.27.0",
-    "@peculiar/webcrypto": "1.3.2",
+    "@peculiar/webcrypto": "1.3.3",
     "@peculiar/x509": "1.6.1",
-    "mongodb": "4.4.1",
+    "mongodb": "4.5.0",
     "mysql2": "2.3.3",
     "pg": "8.7.3",
-    "rambda": "7.0.3",
-    "redis": "4.0.4",
+    "redis": "4.1.0",
     "reflect-metadata": "0.1.13",
     "ripemd160": "2.0.2",
-    "thumbprint": "0.0.1",
-    "typeorm": "0.3.3",
-    "xml-crypto": "2.1.3",
+    "typeorm": "0.3.6",
     "xml2js": "0.4.23",
     "xmlbuilder": "15.1.1"
   },
   "devDependencies": {
-    "@types/node": "17.0.23",
+    "@types/node": "17.0.31",
     "@types/sinon": "10.0.11",
-    "@types/tap": "15.0.6",
-    "@typescript-eslint/eslint-plugin": "5.16.0",
-    "@typescript-eslint/parser": "5.16.0",
+    "@types/tap": "15.0.7",
+    "@typescript-eslint/eslint-plugin": "5.23.0",
+    "@typescript-eslint/parser": "5.23.0",
     "cross-env": "7.0.3",
-    "eslint": "8.11.0",
+    "eslint": "8.15.0",
     "eslint-config-prettier": "8.5.0",
-    "prettier": "2.6.0",
-    "sinon": "13.0.1",
-    "tap": "16.0.1",
+    "prettier": "2.6.2",
+    "sinon": "14.0.0",
+    "tap": "16.2.0",
     "ts-node": "10.7.0",
-    "tsconfig-paths": "3.14.1",
-    "typescript": "4.6.2"
+    "tsconfig-paths": "4.0.0",
+    "typescript": "4.6.4"
   },
   "engines": {
     "node": ">=14.18.1 <=16.x"

package/dist/saml/saml.d.ts

@@ -1,15 +0,0 @@
-import { SAMLProfile, SAMLReq } from '../typings';
-export declare const stripCertHeaderAndFooter: (cert: string) => string;
-declare function PubKeyInfo(this: any, pubKey: string): void;
-declare const _default: {
-    request: ({ ssoUrl, entityID, callbackUrl, isPassive, forceAuthn, identifierFormat, providerName, signingKey, publicKey, }: SAMLReq) => {
-        id: string;
-        request: string;
-    };
-    parseAsync: (rawAssertion: string) => Promise<SAMLProfile>;
-    validateAsync: (rawAssertion: string, options: any) => Promise<SAMLProfile>;
-    parseMetadataAsync: (idpMeta: string) => Promise<Record<string, any>>;
-    PubKeyInfo: typeof PubKeyInfo;
-    certToPEM: (cert: string) => string;
-};
-export default _default;

package/dist/saml/saml.js

@@ -1,240 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stripCertHeaderAndFooter = void 0;
-const saml20_1 = __importDefault(require("@boxyhq/saml20"));
-const crypto_1 = __importDefault(require("crypto"));
-const rambda = __importStar(require("rambda"));
-const thumbprint_1 = __importDefault(require("thumbprint"));
-const xml_crypto_1 = __importDefault(require("xml-crypto"));
-const xml2js_1 = __importDefault(require("xml2js"));
-const xmlbuilder_1 = __importDefault(require("xmlbuilder"));
-const claims_1 = __importDefault(require("./claims"));
-const idPrefix = '_';
-const authnXPath = '/*[local-name(.)="AuthnRequest" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:protocol"]';
-const issuerXPath = '/*[local-name(.)="Issuer" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:assertion"]';
-const stripCertHeaderAndFooter = (cert) => {
-    cert = cert.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, '');
-    cert = cert.replace(/-+END CERTIFICATE-+\r?\n?/, '');
-    cert = cert.replace(/\r\n/g, '\n');
-    return cert;
-};
-exports.stripCertHeaderAndFooter = stripCertHeaderAndFooter;
-function PubKeyInfo(pubKey) {
-    this.pubKey = (0, exports.stripCertHeaderAndFooter)(pubKey);
-    this.getKeyInfo = function (_key, prefix) {
-        prefix = prefix || '';
-        prefix = prefix ? prefix + ':' : prefix;
-        return `<${prefix}X509Data><${prefix}X509Certificate>${this.pubKey}</${prefix}X509Certificate</${prefix}X509Data>`;
-    };
-}
-const signRequest = (xml, signingKey, publicKey) => {
-    if (!xml) {
-        throw new Error('Please specify xml');
-    }
-    if (!signingKey) {
-        throw new Error('Please specify signingKey');
-    }
-    const sig = new xml_crypto_1.default.SignedXml();
-    sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
-    sig.keyInfoProvider = new PubKeyInfo(publicKey);
-    sig.signingKey = signingKey;
-    sig.addReference(authnXPath, ['http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#'], 'http://www.w3.org/2001/04/xmlenc#sha256');
-    sig.computeSignature(xml, {
-        location: { reference: authnXPath + issuerXPath, action: 'after' },
-    });
-    return sig.getSignedXml();
-};
-const request = ({ ssoUrl, entityID, callbackUrl, isPassive = false, forceAuthn = false, identifierFormat = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', providerName = 'BoxyHQ', signingKey, publicKey, }) => {
-    const id = idPrefix + crypto_1.default.randomBytes(10).toString('hex');
-    const date = new Date().toISOString();
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const samlReq = {
-        'samlp:AuthnRequest': {
-            '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-            '@ID': id,
-            '@Version': '2.0',
-            '@IssueInstant': date,
-            '@ProtocolBinding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-            '@Destination': ssoUrl,
-            'saml:Issuer': {
-                '@xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-                '#text': entityID,
-            },
-        },
-    };
-    if (isPassive)
-        samlReq['samlp:AuthnRequest']['@IsPassive'] = true;
-    if (forceAuthn) {
-        samlReq['samlp:AuthnRequest']['@ForceAuthn'] = true;
-    }
-    samlReq['samlp:AuthnRequest']['@AssertionConsumerServiceURL'] = callbackUrl;
-    samlReq['samlp:AuthnRequest']['samlp:NameIDPolicy'] = {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@Format': identifierFormat,
-        '@AllowCreate': 'true',
-    };
-    if (providerName != null) {
-        samlReq['samlp:AuthnRequest']['@ProviderName'] = providerName;
-    }
-    let xml = xmlbuilder_1.default.create(samlReq).end({});
-    if (signingKey) {
-        xml = signRequest(xml, signingKey, publicKey);
-    }
-    return {
-        id,
-        request: xml,
-    };
-};
-const parseAsync = (rawAssertion) => __awaiter(void 0, void 0, void 0, function* () {
-    return new Promise((resolve, reject) => {
-        saml20_1.default.parse(rawAssertion, function onParseAsync(err, profile) {
-            if (err) {
-                reject(err);
-                return;
-            }
-            resolve(profile);
-        });
-    });
-});
-const validateAsync = (rawAssertion, options) => __awaiter(void 0, void 0, void 0, function* () {
-    return new Promise((resolve, reject) => {
-        saml20_1.default.validate(rawAssertion, options, function onValidateAsync(err, profile) {
-            if (err) {
-                reject(err);
-                return;
-            }
-            if (profile && profile.claims) {
-                // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
-                profile.claims = claims_1.default.map(profile.claims);
-                // some providers don't return the id in the assertion, we set it to a sha256 hash of the email
-                if (!profile.claims.id) {
-                    profile.claims.id = crypto_1.default.createHash('sha256').update(profile.claims.email).digest('hex');
-                }
-            }
-            resolve(profile);
-        });
-    });
-});
-const parseMetadataAsync = (idpMeta) => __awaiter(void 0, void 0, void 0, function* () {
-    return new Promise((resolve, reject) => {
-        xml2js_1.default.parseString(idpMeta, { tagNameProcessors: [xml2js_1.default.processors.stripPrefix] }, (err, res) => {
-            if (err) {
-                reject(err);
-                return;
-            }
-            const entityID = rambda.path('EntityDescriptor.$.entityID', res);
-            let X509Certificate = null;
-            let ssoPostUrl = null;
-            let ssoRedirectUrl = null;
-            let loginType = 'idp';
-            let sloRedirectUrl = null;
-            let sloPostUrl = null;
-            let ssoDes = rambda.pathOr(null, 'EntityDescriptor.IDPSSODescriptor', res);
-            if (!ssoDes) {
-                ssoDes = rambda.pathOr([], 'EntityDescriptor.SPSSODescriptor', res);
-                if (!ssoDes) {
-                    loginType = 'sp';
-                }
-            }
-            for (const ssoDesRec of ssoDes) {
-                const keyDes = ssoDesRec['KeyDescriptor'];
-                for (const keyDesRec of keyDes) {
-                    if (keyDesRec['$'] && keyDesRec['$'].use === 'signing') {
-                        const ki = keyDesRec['KeyInfo'][0];
-                        const cd = ki['X509Data'][0];
-                        X509Certificate = cd['X509Certificate'][0];
-                    }
-                }
-                const ssoSvc = ssoDesRec['SingleSignOnService'] || ssoDesRec['AssertionConsumerService'] || [];
-                for (const ssoSvcRec of ssoSvc) {
-                    if (rambda.pathOr('', '$.Binding', ssoSvcRec).endsWith('HTTP-POST')) {
-                        ssoPostUrl = rambda.path('$.Location', ssoSvcRec);
-                    }
-                    else if (rambda.pathOr('', '$.Binding', ssoSvcRec).endsWith('HTTP-Redirect')) {
-                        ssoRedirectUrl = rambda.path('$.Location', ssoSvcRec);
-                    }
-                }
-                const sloSvc = ssoDesRec['SingleLogoutService'] || [];
-                for (const sloSvcRec of sloSvc) {
-                    if (rambda.pathOr('', '$.Binding', sloSvcRec).endsWith('HTTP-Redirect')) {
-                        sloRedirectUrl = rambda.path('$.Location', sloSvcRec);
-                    }
-                    else if (rambda.pathOr('', '$.Binding', sloSvcRec).endsWith('HTTP-POST')) {
-                        sloPostUrl = rambda.path('$.Location', sloSvcRec);
-                    }
-                }
-            }
-            const ret = {
-                sso: {},
-                slo: {},
-            };
-            if (entityID) {
-                ret.entityID = entityID;
-            }
-            if (X509Certificate) {
-                ret.thumbprint = thumbprint_1.default.calculate(X509Certificate);
-            }
-            if (ssoPostUrl) {
-                ret.sso.postUrl = ssoPostUrl;
-            }
-            if (ssoRedirectUrl) {
-                ret.sso.redirectUrl = ssoRedirectUrl;
-            }
-            if (sloRedirectUrl) {
-                ret.slo.redirectUrl = sloRedirectUrl;
-            }
-            if (sloPostUrl) {
-                ret.slo.postUrl = sloPostUrl;
-            }
-            ret.loginType = loginType;
-            resolve(ret);
-        });
-    });
-});
-const certToPEM = (cert) => {
-    if (cert.indexOf('BEGIN CERTIFICATE') === -1 && cert.indexOf('END CERTIFICATE') === -1) {
-        const matches = cert.match(/.{1,64}/g);
-        if (matches) {
-            cert = matches.join('\n');
-            cert = '-----BEGIN CERTIFICATE-----\n' + cert;
-            cert = cert + '\n-----END CERTIFICATE-----\n';
-        }
-    }
-    return cert;
-};
-exports.default = { request, parseAsync, validateAsync, parseMetadataAsync, PubKeyInfo, certToPEM };