@mcp-abap-adt/auth-providers 3.0.0 → 4.1.0

package/dist/providers/saml2Utils.js

@@ -4,16 +4,69 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateSamlConfig = validateSamlConfig;
+exports.resolveAssertionValidator = resolveAssertionValidator;
 exports.resolveTokenUrl = resolveTokenUrl;
 exports.getSamlAssertion = getSamlAssertion;
 const saml2Auth_1 = require("../auth/saml2Auth");
+const TokenProviderErrors_1 = require("../errors/TokenProviderErrors");
 const strategies_1 = require("../strategies");
+const assertionValidator_1 = require("../validation/assertionValidator");
 /** Throw at construction rather than half-verify at runtime. */
 function validateSamlConfig(config) {
     if (config.authorizationUrl && !config.acsUrl) {
         throw new Error('acsUrl is required when authorizationUrl is set: the ACS inside a ' +
             'pre-built SAML request cannot be read, so it must be declared.');
     }
+    // The runtime check in resolveExpectedRequestId stays for a direct caller
+    // of getSamlAssertion; through a provider this refuses first, before any
+    // browser opens.
+    if (config.idpInitiated && config.authnRequestId) {
+        throw new TokenProviderErrors_1.ValidationError('SAML idpInitiated is true and authnRequestId is set: an IdP-initiated ' +
+            'login sends no request, so the two describe different logins. ' +
+            'Remove one of them.', ['idpInitiated']);
+    }
+}
+/**
+ * The consumer's validator when supplied, otherwise the provider's default —
+ * `createSignedAssertionValidator` for `"bearer"`, since the token endpoint
+ * receives the Assertion alone (#40) and its own signature is what that
+ * endpoint verifies; `createSignedResponseValidator` for `"pure"`, since the
+ * whole response is handed on and `Status`/`Destination` must be inside a
+ * signature. See the spec's "A bare Assertion, and which validator each
+ * provider defaults to".
+ */
+function resolveAssertionValidator(config, provider) {
+    if (config.assertionValidator) {
+        // A shipped validator fails closed without expectedIssuer, so supplying
+        // one without idpEntityId would construct fine and then refuse every
+        // login at `issuer` — after the browser step. A custom validator needs
+        // no idpEntityId: it may establish trust some other way.
+        if ((0, assertionValidator_1.isShippedValidator)(config.assertionValidator) && !config.idpEntityId) {
+            throw new TokenProviderErrors_1.ValidationError('The supplied assertionValidator is a shipped one ' +
+                '(createSignedResponseValidator or createSignedAssertionValidator), ' +
+                'which refuses every assertion without an expected issuer: missing ' +
+                'idpEntityId.', ['idpEntityId']);
+        }
+        return config.assertionValidator;
+    }
+    const missing = [];
+    if (!config.idpCertificates?.length)
+        missing.push('idpCertificates');
+    if (!config.idpEntityId)
+        missing.push('idpEntityId');
+    if (missing.length > 0) {
+        throw new TokenProviderErrors_1.ValidationError(`The default assertion validator needs the identity provider it should ` +
+            `trust: missing ${missing.join(', ')}. Supply these, or supply an ` +
+            `assertionValidator of your own.`, missing);
+    }
+    const options = {
+        idpCertificates: config.idpCertificates,
+        clockSkewMs: config.clockSkewMs,
+        replayStore: config.assertionReplayStore,
+    };
+    return provider === 'bearer'
+        ? (0, assertionValidator_1.createSignedAssertionValidator)(options)
+        : (0, assertionValidator_1.createSignedResponseValidator)(options);
 }
 function resolveTokenUrl(config) {
     if (config.tokenUrl) {
@@ -26,9 +79,21 @@ function resolveTokenUrl(config) {
 }
 async function getSamlAssertion(config) {
     const declaredAcs = config.acsUrl;
+    let mintedRequestId;
     const request = {
         logger: config.logger,
         buildAuthorizationUrl: async (redirectUri) => {
+            // An IdP-initiated login sends no AuthnRequest, and without a pre-built
+            // authorizationUrl the only URL this could produce is one carrying a
+            // freshly minted request. Refused here, before any URL exists, so the
+            // mistake surfaces before a browser opens rather than after a login.
+            if (config.idpInitiated && !config.authorizationUrl) {
+                throw new TokenProviderErrors_1.ValidationError('SAML idpInitiated is true and no authorizationUrl is configured, ' +
+                    'but the authorization strategy asked for an authorization URL: ' +
+                    'the only one this package can build carries an AuthnRequest. ' +
+                    'Configure the IdP-initiated SSO URL as authorizationUrl, or use a ' +
+                    'strategy that does not call buildAuthorizationUrl.', ['authorizationUrl']);
+            }
             // A declared ACS is registered with the IdP; the strategy must be
             // listening exactly there, and an ephemeral port cannot be.
             const acsUrl = declaredAcs ?? redirectUri;
@@ -36,13 +101,15 @@ async function getSamlAssertion(config) {
                 throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy is ` +
                     `listening on ${redirectUri}. They must match.`);
             }
-            return (0, saml2Auth_1.buildSamlAuthorizationUrl)({
+            const built = (0, saml2Auth_1.buildSamlAuthorizationUrl)({
                 idpSsoUrl: config.idpSsoUrl,
                 spEntityId: config.spEntityId,
                 acsUrl,
                 relayState: config.relayState,
                 authorizationUrl: config.authorizationUrl,
             });
+            mintedRequestId = built.requestId;
+            return built.url;
         },
     };
     const supplied = config.authorization;
@@ -55,7 +122,12 @@ async function getSamlAssertion(config) {
             throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy used ` +
                 `${outcome.redirectUri}. They must match.`);
         }
-        return outcome.payload;
+        const requestId = resolveExpectedRequestId(config, mintedRequestId);
+        return {
+            payload: outcome.payload,
+            requestId,
+            acsUrl: outcome.redirectUri,
+        };
     }
     finally {
         if (!supplied) {
@@ -67,3 +139,31 @@ async function getSamlAssertion(config) {
         }
     }
 }
+/**
+ * The ID `InResponseTo` must answer, from the three sources the spec allows:
+ * minted, declared, or none by explicit `idpInitiated: true`. Anything else —
+ * no ID and no declaration, or `idpInitiated` combined with an ID from either
+ * of the other two sources — is a configuration error, not a validation
+ * failure blamed on the assertion.
+ */
+function resolveExpectedRequestId(config, mintedRequestId) {
+    const declaredRequestId = config.authnRequestId;
+    if (config.idpInitiated) {
+        if (mintedRequestId || declaredRequestId) {
+            throw new TokenProviderErrors_1.ValidationError('SAML idpInitiated is true, but a request ID was also minted or ' +
+                'configured (an authorization strategy called buildAuthorizationUrl, ' +
+                'or authnRequestId is set). An IdP-initiated login sends no request, ' +
+                'so an ID means the configuration describes two different logins.', ['idpInitiated']);
+        }
+        return undefined;
+    }
+    const requestId = mintedRequestId ?? declaredRequestId;
+    if (!requestId) {
+        throw new TokenProviderErrors_1.ValidationError('Cannot validate InResponseTo: this login did not build its own AuthnRequest, ' +
+            'so authnRequestId must be configured — or, if the identity provider ' +
+            'starts this login itself, idpInitiated: true. This happens with a ' +
+            'pre-built authorizationUrl, or an authorization strategy that supplies an ' +
+            'assertion without asking for a URL.', ['authnRequestId']);
+    }
+    return requestId;
+}

package/dist/validation/assertionValidator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The shipped assertion validator: the spec's check table, in order.
+ *
+ * Two properties matter more than any individual check. First, the signature
+ * is resolved to an element and every assertion-level field is read *from that
+ * element* — a document holding a validly signed fragment beside a forged one
+ * is the wrapping attack, and reading the wrong node is how it succeeds.
+ * Second, no two refusals share a distinguishing phrase, so a test cannot pass
+ * for a neighbouring check's reason.
+ *
+ * Three fields live on the Response rather than the assertion: Status,
+ * Response/Issuer and Destination. The signed-Response validator reads them,
+ * because there they are inside the signature. The assertion-only validator
+ * does not read them at all — not weakly. That is safe because a declined
+ * login carries no assertion, so flipping Status buys an attacker nothing they
+ * can sign, and addressing rests on Recipient inside the signed assertion.
+ */
+import type { IAssertionReplayStore, IAssertionValidator } from '@mcp-abap-adt/interfaces-auth';
+export interface ShippedValidatorOptions {
+    readonly idpCertificates: readonly string[];
+    readonly clockSkewMs?: number;
+    readonly replayStore?: IAssertionReplayStore;
+}
+/** Whether this validator came from one of the two shipped factories. */
+export declare function isShippedValidator(validator: IAssertionValidator): boolean;
+export declare const createSignedResponseValidator: (options: ShippedValidatorOptions) => IAssertionValidator;
+export declare const createSignedAssertionValidator: (options: ShippedValidatorOptions) => IAssertionValidator;
+//# sourceMappingURL=assertionValidator.d.ts.map

package/dist/validation/assertionValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertionValidator.d.ts","sourceRoot":"","sources":["../../src/validation/assertionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AA8BvC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAsCD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAE1E;AAED,eAAO,MAAM,6BAA6B,GACxC,SAAS,uBAAuB,KAC/B,mBAAkE,CAAC;AAEtE,eAAO,MAAM,8BAA8B,GACzC,SAAS,uBAAuB,KAC/B,mBAAmE,CAAC"}