@steedos/accounts 2.5.3-beta.13 → 2.5.3-beta.15

package/lib/saml-idp/express-middleware.js

@@ -1,684 +0,0 @@
-/**
- * Module dependencies.
- */
-var tslib_1 = require("tslib");
-var chalk = require('chalk'), express = require('express'), os = require('os'), fs = require('fs'), http = require('http'), https = require('https'), path = require('path'), extend = require('extend'), hbs = require('hbs'), logger = require('morgan'), bodyParser = require('body-parser'), session = require('express-session'), yargs = require('yargs/yargs'), xmlFormat = require('xml-formatter'), samlp = require('samlp'), Parser = require('xmldom').DOMParser, SessionParticipants = require('samlp/lib/sessionParticipants'), SimpleProfileMapper = require('./simpleProfileMapper.js');
-/**
- * Globals
- */
-var IDP_PATHS = {
-    SSO: '/idp/sso',
-    SLO: '/idp/slo',
-    METADATA: '/metadata',
-    SIGN_IN: '/signin',
-    SIGN_OUT: '/signout',
-    SETTINGS: '/settings'
-};
-var CERT_OPTIONS = [
-    'cert',
-    'key',
-    'encryptionCert',
-    'encryptionPublicKey',
-    'httpsPrivateKey',
-    'httpsCert',
-];
-var WILDCARD_ADDRESSES = ['0.0.0.0', '::'];
-var UNDEFINED_VALUE = 'None';
-var CRYPT_TYPES = {
-    certificate: /-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----/,
-    'RSA private key': /-----BEGIN RSA PRIVATE KEY-----\n[^-]*\n-----END RSA PRIVATE KEY-----/,
-    'public key': /-----BEGIN PUBLIC KEY-----\n[^-]*\n-----END PUBLIC KEY-----/,
-};
-var KEY_CERT_HELP_TEXT = dedent(chalk(tslib_1.__makeTemplateObject(["\n  To generate a key/cert pair for the IdP, run the following command:\n\n  {gray openssl req -x509 -new -newkey rsa:2048 -nodes     -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider'     -keyout idp-private-key.pem     -out idp-public-cert.pem -days 7300}"], ["\n  To generate a key/cert pair for the IdP, run the following command:\n\n  {gray openssl req -x509 -new -newkey rsa:2048 -nodes \\\n    -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider' \\\n    -keyout idp-private-key.pem \\\n    -out idp-public-cert.pem -days 7300}"])));
-function matchesCertType(value, type) {
-    return CRYPT_TYPES[type] && CRYPT_TYPES[type].test(value);
-}
-function resolveFilePath(filePath) {
-    if (filePath.startsWith('saml-idp/')) {
-        // Allows file path options to files included in this package, like config.js
-        var resolvedPath = require.resolve(filePath.replace(/^saml\-idp\//, "".concat(__dirname, "/")));
-        return fs.existsSync(resolvedPath) && resolvedPath;
-    }
-    var possiblePath;
-    if (fs.existsSync(filePath)) {
-        return filePath;
-    }
-    if (filePath.startsWith('~/')) {
-        possiblePath = path.resolve(process.env.HOME, filePath.slice(2));
-        if (fs.existsSync(possiblePath)) {
-            return possiblePath;
-        }
-        else {
-            // for ~/ paths, don't try to resolve further
-            return filePath;
-        }
-    }
-    return ['.', __dirname]
-        .map(function (base) { return path.resolve(base, filePath); })
-        .find(function (possiblePath) { return fs.existsSync(possiblePath); });
-}
-function makeCertFileCoercer(type, description, helpText) {
-    return function certFileCoercer(value) {
-        if (matchesCertType(value, type)) {
-            return value;
-        }
-        var filePath = resolveFilePath(value);
-        if (filePath) {
-            return fs.readFileSync(filePath);
-        }
-        throw new Error(chalk(tslib_1.__makeTemplateObject(["{red Invalid / missing {bold ", "}} - {yellow not a valid crypt key/cert or file path}", ""], ["{red Invalid / missing {bold ", "}} - {yellow not a valid crypt key/cert or file path}", ""]), description, helpText ? '\n' + helpText : ''));
-    };
-}
-function getHashCode(str) {
-    var hash = 0;
-    if (str.length == 0)
-        return hash;
-    for (i = 0; i < str.length; i++) {
-        char = str.charCodeAt(i);
-        hash = ((hash << 5) - hash) + char;
-        hash = hash & hash; // Convert to 32bit integer
-    }
-    return hash;
-}
-function dedent(str) {
-    // Reduce the indentation of all lines by the indentation of the first line
-    var match = str.match(/^\n?( +)/);
-    if (!match) {
-        return str;
-    }
-    var indentRe = new RegExp("\n".concat(match[1]), 'g');
-    return str.replace(indentRe, '\n').replace(/^\n/, '');
-}
-function formatOptionValue(key, value) {
-    if (typeof value === 'string') {
-        return value;
-    }
-    if (CERT_OPTIONS.includes(key)) {
-        return chalk(tslib_1.__makeTemplateObject(["", "{white \u2026}"], ["", "{white \u2026}"]), value.toString()
-            .replace(/-----.+?-----|\n/g, '')
-            .substring(0, 80));
-    }
-    if (!value && value !== false) {
-        return UNDEFINED_VALUE;
-    }
-    if (typeof value === 'function') {
-        var lines = "".concat(value).split('\n');
-        return lines[0].slice(0, -2);
-    }
-    return "".concat(JSON.stringify(value));
-}
-function prettyPrintXml(xml, indent) {
-    // This works well, because we format the xml before applying the replacements
-    var prettyXml = xmlFormat(xml, { indentation: '  ' })
-        // Matches `<{prefix}:{name} .*?>`
-        .replace(/<(\/)?((?:[\w]+)(?::))?([\w]+)(.*?)>/g, chalk(tslib_1.__makeTemplateObject(["<{green $1$2{bold $3}}$4>"], ["<{green $1$2{bold $3}}$4>"])))
-        // Matches ` {attribute}="{value}"
-        .replace(/ ([\w:]+)="(.+?)"/g, chalk(tslib_1.__makeTemplateObject([" {white $1}={cyan \"$2\"}"], [" {white $1}={cyan \"$2\"}"])));
-    if (indent) {
-        return prettyXml.replace(/(^|\n)/g, "$1".concat(' '.repeat(indent)));
-    }
-    return prettyXml;
-}
-/**
- * Arguments
- */
-function processArgs(args, options) {
-    var baseArgv;
-    if (options) {
-        baseArgv = yargs(args).config(options);
-    }
-    else {
-        baseArgv = yargs(args);
-    }
-    return baseArgv
-        .usage('\nSimple IdP for SAML 2.0 WebSSO & SLO Profile\n\n' +
-        'Launches an IdP web server that mints SAML assertions or logout responses for a Service Provider (SP)\n\n' +
-        'Usage:\n\t$0 --acsUrl {url} --audience {uri}')
-        .alias({ h: 'help' })
-        .options({
-        host: {
-            description: 'IdP Web Server Listener Host',
-            required: false,
-            default: 'localhost'
-        },
-        port: {
-            description: 'IdP Web Server Listener Port',
-            required: true,
-            alias: 'p',
-            default: 7000
-        },
-        cert: {
-            description: 'IdP Signature PublicKey Certificate',
-            required: true,
-            default: './idp-public-cert.pem',
-            coerce: makeCertFileCoercer('certificate', 'IdP Signature PublicKey Certificate', KEY_CERT_HELP_TEXT)
-        },
-        key: {
-            description: 'IdP Signature PrivateKey Certificate',
-            required: true,
-            default: './idp-private-key.pem',
-            coerce: makeCertFileCoercer('RSA private key', 'IdP Signature PrivateKey Certificate', KEY_CERT_HELP_TEXT)
-        },
-        issuer: {
-            description: 'IdP Issuer URI',
-            required: true,
-            alias: 'iss',
-            default: 'urn:example:idp'
-        },
-        acsUrl: {
-            description: 'SP Assertion Consumer URL',
-            required: true,
-            alias: 'acs'
-        },
-        sloUrl: {
-            description: 'SP Single Logout URL',
-            required: false,
-            alias: 'slo'
-        },
-        audience: {
-            description: 'SP Audience URI',
-            required: true,
-            alias: 'aud'
-        },
-        serviceProviderId: {
-            description: 'SP Issuer/Entity URI',
-            required: false,
-            alias: 'spId',
-            string: true
-        },
-        relayState: {
-            description: 'Default SAML RelayState for SAMLResponse',
-            required: false,
-            alias: 'rs'
-        },
-        disableRequestAcsUrl: {
-            description: 'Disables ability for SP AuthnRequest to specify Assertion Consumer URL',
-            required: false,
-            boolean: true,
-            alias: 'static',
-            default: false
-        },
-        encryptAssertion: {
-            description: 'Encrypts assertion with SP Public Key',
-            required: false,
-            boolean: true,
-            alias: 'enc',
-            default: false
-        },
-        encryptionCert: {
-            description: 'SP Certificate (pem) for Assertion Encryption',
-            required: false,
-            string: true,
-            alias: 'encCert',
-            coerce: makeCertFileCoercer('certificate', 'Encryption cert')
-        },
-        encryptionPublicKey: {
-            description: 'SP RSA Public Key (pem) for Assertion Encryption ' +
-                '(e.g. openssl x509 -pubkey -noout -in sp-cert.pem)',
-            required: false,
-            string: true,
-            alias: 'encKey',
-            coerce: makeCertFileCoercer('public key', 'Encryption public key')
-        },
-        httpsPrivateKey: {
-            description: 'Web Server TLS/SSL Private Key (pem)',
-            required: false,
-            string: true,
-            coerce: makeCertFileCoercer('RSA private key')
-        },
-        httpsCert: {
-            description: 'Web Server TLS/SSL Certificate (pem)',
-            required: false,
-            string: true,
-            coerce: makeCertFileCoercer('certificate')
-        },
-        https: {
-            description: 'Enables HTTPS Listener (requires httpsPrivateKey and httpsCert)',
-            required: true,
-            boolean: true,
-            default: false
-        },
-        signResponse: {
-            description: 'Enables signing of responses',
-            required: false,
-            boolean: true,
-            default: true,
-            alias: 'signResponse'
-        },
-        configFile: {
-            description: 'Path to a SAML attribute config file',
-            required: true,
-            default: 'saml-idp/config.js',
-            alias: 'conf'
-        },
-        rollSession: {
-            description: 'Create a new session for every authn request instead of reusing an existing session',
-            required: false,
-            boolean: true,
-            default: false
-        },
-        authnContextClassRef: {
-            description: 'Authentication Context Class Reference',
-            required: false,
-            string: true,
-            default: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-            alias: 'acr'
-        },
-        authnContextDecl: {
-            description: 'Authentication Context Declaration (XML FilePath)',
-            required: false,
-            string: true,
-            alias: 'acd',
-            coerce: function (value) {
-                var filePath = resolveFilePath(value);
-                if (filePath) {
-                    return fs.readFileSync(filePath, 'utf8');
-                }
-            }
-        }
-    })
-        .example('$0 --acsUrl http://acme.okta.com/auth/saml20/exampleidp --audience https://www.okta.com/saml2/service-provider/spf5aFRRXFGIMAYXQPNV', '')
-        .check(function (argv, aliases) {
-        if (argv.encryptAssertion) {
-            if (argv.encryptionPublicKey === undefined) {
-                return 'encryptionPublicKey argument is also required for assertion encryption';
-            }
-            if (argv.encryptionCert === undefined) {
-                return 'encryptionCert argument is also required for assertion encryption';
-            }
-        }
-        return true;
-    })
-        .check(function (argv, aliases) {
-        if (argv.config) {
-            return true;
-        }
-        var configFilePath = resolveFilePath(argv.configFile);
-        if (!configFilePath) {
-            return 'SAML attribute config file path "' + argv.configFile + '" is not a valid path.\n';
-        }
-        try {
-            argv.config = require(configFilePath);
-        }
-        catch (error) {
-            return 'Encountered an exception while loading SAML attribute config file "' + configFilePath + '".\n' + error;
-        }
-        return true;
-    })
-        .wrap(baseArgv.terminalWidth());
-}
-var app = express.Router();
-function _runServer(argv) {
-    var blocks = {};
-    console.log(dedent(chalk(tslib_1.__makeTemplateObject(["\n    Listener Port:\n      {cyan ", ":", "}\n    HTTPS Enabled:\n      {cyan ", "}\n\n    {bold [{yellow Identity Provider}]}\n\n    Issuer URI:\n      {cyan ", "}\n    Sign Response Message:\n      {cyan ", "}\n    Encrypt Assertion:\n      {cyan ", "}\n    Authentication Context Class Reference:\n      {cyan ", "}\n    Authentication Context Declaration:\n      {cyan ", "}\n    Default RelayState:\n      {cyan ", "}\n\n    {bold [{yellow Service Provider}]}\n\n    serviceProviderId URI:\n      {cyan ", "}\n    Audience URI:\n      {cyan ", "}\n    ACS URL:\n      {cyan ", "}\n    SLO URL:\n      {cyan ", "}\n    Trust ACS URL in Request:\n      {cyan ", "}\n  "], ["\n    Listener Port:\n      {cyan ", ":", "}\n    HTTPS Enabled:\n      {cyan ", "}\n\n    {bold [{yellow Identity Provider}]}\n\n    Issuer URI:\n      {cyan ", "}\n    Sign Response Message:\n      {cyan ", "}\n    Encrypt Assertion:\n      {cyan ", "}\n    Authentication Context Class Reference:\n      {cyan ", "}\n    Authentication Context Declaration:\n      {cyan ", "}\n    Default RelayState:\n      {cyan ", "}\n\n    {bold [{yellow Service Provider}]}\n\n    serviceProviderId URI:\n      {cyan ", "}\n    Audience URI:\n      {cyan ", "}\n    ACS URL:\n      {cyan ", "}\n    SLO URL:\n      {cyan ", "}\n    Trust ACS URL in Request:\n      {cyan ", "}\n  "]), argv.host, argv.port, argv.https, argv.issuer, argv.signResponse, argv.encryptAssertion, argv.authnContextClassRef || UNDEFINED_VALUE, argv.authnContextDecl || UNDEFINED_VALUE, argv.relayState || UNDEFINED_VALUE, argv.serviceProviderId || UNDEFINED_VALUE, argv.audience || UNDEFINED_VALUE, argv.acsUrl || UNDEFINED_VALUE, argv.sloUrl || UNDEFINED_VALUE, !argv.disableRequestAcsUrl)));
-    /**
-     * IdP Configuration
-     */
-    var idpOptions = {
-        issuer: argv.issuer,
-        serviceProviderId: argv.serviceProviderId || argv.audience,
-        cert: argv.cert,
-        key: argv.key,
-        audience: argv.audience,
-        recipient: argv.acsUrl,
-        destination: argv.acsUrl,
-        acsUrl: argv.acsUrl,
-        sloUrl: argv.sloUrl,
-        RelayState: argv.relayState,
-        allowRequestAcsUrl: !argv.disableRequestAcsUrl,
-        digestAlgorithm: 'sha256',
-        signatureAlgorithm: 'rsa-sha256',
-        signResponse: argv.signResponse,
-        encryptAssertion: argv.encryptAssertion,
-        encryptionCert: argv.encryptionCert,
-        encryptionPublicKey: argv.encryptionPublicKey,
-        encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
-        keyEncryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
-        lifetimeInSeconds: 3600,
-        authnContextClassRef: argv.authnContextClassRef,
-        authnContextDecl: argv.authnContextDecl,
-        includeAttributeNameFormat: true,
-        profileMapper: SimpleProfileMapper.fromMetadata(argv.config.metadata),
-        postEndpointPath: IDP_PATHS.SSO,
-        redirectEndpointPath: IDP_PATHS.SSO,
-        logoutEndpointPaths: argv.sloUrl ?
-            {
-                redirect: IDP_PATHS.SLO,
-                post: IDP_PATHS.SLO
-            } : {},
-        getUserFromRequest: function (req) { return req.user; },
-        getPostURL: function (audience, authnRequestDom, req, callback) {
-            return callback(null, (req.authnRequest && req.authnRequest.acsUrl) ?
-                req.authnRequest.acsUrl :
-                argv.acsUrl);
-        },
-        transformAssertion: function (assertionDom) {
-            if (argv.authnContextDecl) {
-                var declDoc;
-                try {
-                    declDoc = new Parser().parseFromString(argv.authnContextDecl);
-                }
-                catch (err) {
-                    console.log('Unable to parse Authentication Context Declaration XML', err);
-                }
-                if (declDoc) {
-                    var authnContextDeclEl = assertionDom.createElementNS('urn:oasis:names:tc:SAML:2.0:assertion', 'saml:AuthnContextDecl');
-                    authnContextDeclEl.appendChild(declDoc.documentElement);
-                    var authnContextEl = assertionDom.getElementsByTagName('saml:AuthnContext')[0];
-                    authnContextEl.appendChild(authnContextDeclEl);
-                }
-            }
-        },
-        responseHandler: function (response, opts, req, res, next) {
-            console.log(dedent(chalk(tslib_1.__makeTemplateObject(["\n                                Sending SAML Response to {cyan ", "} =>\n                                  {bold RelayState} =>\n                                    {cyan ", "}\n                                  {bold SAMLResponse} =>"], ["\n                                Sending SAML Response to {cyan ", "} =>\n                                  {bold RelayState} =>\n                                    {cyan ", "}\n                                  {bold SAMLResponse} =>"]), opts.postUrl, opts.RelayState || UNDEFINED_VALUE)));
-            console.log(prettyPrintXml(response.toString(), 4));
-            res.render('samlresponse', {
-                AcsUrl: opts.postUrl,
-                SAMLResponse: response.toString('base64'),
-                RelayState: opts.RelayState
-            });
-        }
-    };
-    /**
-     * App Environment
-     */
-    // app.set('host', process.env.HOST || argv.host);
-    // app.set('port', process.env.PORT || argv.port);
-    // app.set('views', path.join(__dirname, 'views'));
-    /**
-     * View Engine
-     */
-    // app.set('view engine', 'hbs');
-    // app.set('view options', { layout: 'layout' })
-    // app.engine('handlebars', hbs.__express);
-    // Register Helpers
-    hbs.registerHelper('extend', function (name, context) {
-        var block = blocks[name];
-        if (!block) {
-            block = blocks[name] = [];
-        }
-        block.push(context.fn(this));
-    });
-    hbs.registerHelper('block', function (name) {
-        var val = (blocks[name] || []).join('\n');
-        // clear the block
-        blocks[name] = [];
-        return val;
-    });
-    hbs.registerHelper('select', function (selected, options) {
-        return options.fn(this).replace(new RegExp(' value=\"' + selected + '\"'), '$& selected="selected"');
-    });
-    hbs.registerHelper('getProperty', function (attribute, context) {
-        return context[attribute];
-    });
-    hbs.registerHelper('serialize', function (context) {
-        return new Buffer(JSON.stringify(context)).toString('base64');
-    });
-    /**
-     * Middleware
-     */
-    app.use(logger(':date> :method :url - {:referrer} => :status (:response-time ms)', {
-        skip: function (req, res) {
-            return req.path.startsWith('/bower_components') || req.path.startsWith('/css');
-        }
-    }));
-    app.use(bodyParser.urlencoded({ extended: true }));
-    app.use(express.static(path.join(__dirname, 'public')));
-    app.use(session({
-        secret: 'The universe works on a math equation that never even ever really ends in the end',
-        resave: false,
-        saveUninitialized: true,
-        name: 'idp_sid',
-        cookie: { maxAge: 60 * 60 * 1000 }
-    }));
-    /**
-     * View Handlers
-     */
-    var showUser = function (req, res, next) {
-        res.render('user', {
-            user: req.user,
-            participant: req.participant,
-            metadata: req.metadata,
-            authnRequest: req.authnRequest,
-            idp: req.idp.options,
-            paths: IDP_PATHS
-        });
-    };
-    /**
-     * Shared Handlers
-     */
-    var parseSamlRequest = function (req, res, next) {
-        samlp.parseRequest(req, function (err, data) {
-            if (err) {
-                return res.render('error', {
-                    message: 'SAML AuthnRequest Parse Error: ' + err.message,
-                    error: err
-                });
-            }
-            ;
-            if (data) {
-                req.authnRequest = {
-                    relayState: req.query.RelayState || req.body.RelayState,
-                    id: data.id,
-                    issuer: data.issuer,
-                    destination: data.destination,
-                    acsUrl: data.assertionConsumerServiceURL,
-                    forceAuthn: data.forceAuthn === 'true'
-                };
-                console.log('Received AuthnRequest => \n', req.authnRequest);
-            }
-            if (req.user != undefined) {
-                return showUser(req, res, next);
-            }
-            else {
-                console.log('Redirect to login => \n');
-                res.redirect("/accounts/a/#/login?redirect_uri=" + encodeURIComponent(req.originalUrl));
-                return res.end();
-            }
-        });
-    };
-    var getSessionIndex = function (req) {
-        if (req && req.session) {
-            return Math.abs(getHashCode(req.session.id)).toString();
-        }
-    };
-    var getParticipant = function (req) {
-        return {
-            serviceProviderId: req.idp.options.serviceProviderId,
-            sessionIndex: getSessionIndex(req),
-            nameId: req.user.username,
-            nameIdFormat: req.user.nameIdFormat,
-            serviceProviderLogoutURL: req.idp.options.sloUrl
-        };
-    };
-    var parseLogoutRequest = function (req, res, next) {
-        if (!req.idp.options.sloUrl) {
-            return res.render('error', {
-                message: 'SAML Single Logout Service URL not defined for Service Provider'
-            });
-        }
-        ;
-        console.log('Processing SAML SLO request for participant => \n', req.participant);
-        return samlp.logout({
-            issuer: req.idp.options.issuer,
-            cert: req.idp.options.cert,
-            key: req.idp.options.key,
-            digestAlgorithm: req.idp.options.digestAlgorithm,
-            signatureAlgorithm: req.idp.options.signatureAlgorithm,
-            sessionParticipants: new SessionParticipants([
-                req.participant
-            ]),
-            clearIdPSession: function (callback) {
-                console.log('Destroying session ' + req.session.id + ' for participant', req.participant);
-                req.session.destroy();
-                callback();
-            }
-        })(req, res, next);
-    };
-    /**
-     * Routes
-     */
-    app.use(function (req, res, next) {
-        if (argv.rollSession) {
-            req.session.regenerate(function (err) {
-                return next();
-            });
-        }
-        else {
-            next();
-        }
-    });
-    app.use(function (req, res, next) {
-        //req.user = argv.config.user;
-        req.metadata = argv.config.metadata;
-        req.idp = { options: idpOptions };
-        if (req.user)
-            req.participant = getParticipant(req);
-        next();
-    });
-    app.get(['/', '/idp', IDP_PATHS.SSO], parseSamlRequest);
-    app.post(['/', '/idp', IDP_PATHS.SSO], parseSamlRequest);
-    app.get(IDP_PATHS.SLO, parseLogoutRequest);
-    app.post(IDP_PATHS.SLO, parseLogoutRequest);
-    app.post(IDP_PATHS.SIGN_IN, function (req, res) {
-        var authOptions = extend({}, req.idp.options);
-        Object.keys(req.body).forEach(function (key) {
-            var buffer;
-            if (key === '_authnRequest') {
-                buffer = new Buffer(req.body[key], 'base64');
-                req.authnRequest = JSON.parse(buffer.toString('utf8'));
-                // Apply AuthnRequest Params
-                authOptions.inResponseTo = req.authnRequest.id;
-                if (req.idp.options.allowRequestAcsUrl && req.authnRequest.acsUrl) {
-                    authOptions.acsUrl = req.authnRequest.acsUrl;
-                    authOptions.recipient = req.authnRequest.acsUrl;
-                    authOptions.destination = req.authnRequest.acsUrl;
-                    authOptions.forceAuthn = req.authnRequest.forceAuthn;
-                }
-                if (req.authnRequest.relayState) {
-                    authOptions.RelayState = req.authnRequest.relayState;
-                }
-            }
-            else {
-                req.user[key] = req.body[key];
-            }
-        });
-        if (!authOptions.encryptAssertion) {
-            delete authOptions.encryptionCert;
-            delete authOptions.encryptionPublicKey;
-        }
-        // Set Session Index
-        authOptions.sessionIndex = getSessionIndex(req);
-        // Keep calm and Single Sign On
-        console.log(dedent(chalk(tslib_1.__makeTemplateObject(["\n      Generating SAML Response using =>\n        {bold User} => ", "\n        {bold SAMLP Options} => ", "\n    "], ["\n      Generating SAML Response using =>\n        {bold User} => ", "\n        {bold SAMLP Options} => ", "\n    "]), Object.entries(req.user).map(function (_a) {
-            var key = _a[0], value = _a[1];
-            return chalk(tslib_1.__makeTemplateObject(["\n          ", ": {cyan ", "}"], ["\n          ", ": {cyan ", "}"]), key, value);
-        }).join(''), Object.entries(authOptions).map(function (_a) {
-            var key = _a[0], value = _a[1];
-            return chalk(tslib_1.__makeTemplateObject(["\n          ", ": {cyan ", "}"], ["\n          ", ": {cyan ", "}"]), key, formatOptionValue(key, value));
-        }).join(''))));
-        samlp.auth(authOptions)(req, res);
-    });
-    app.get(IDP_PATHS.METADATA, function (req, res, next) {
-        samlp.metadata(req.idp.options)(req, res);
-    });
-    app.post(IDP_PATHS.METADATA, function (req, res, next) {
-        if (req.body && req.body.attributeName && req.body.name) {
-            var attributeExists = false;
-            var attribute_1 = {
-                id: req.body.attributeName,
-                optional: true,
-                name: req.body.name,
-                description: req.body.description || '',
-                multiValue: req.body.valueType === 'multi'
-            };
-            req.metadata.forEach(function (entry) {
-                if (entry.id === req.body.attributeName) {
-                    entry = attribute_1;
-                    attributeExists = true;
-                }
-            });
-            if (!attributeExists) {
-                req.metadata.push(attribute_1);
-            }
-            console.log("Updated SAML Attribute Metadata => \n", req.metadata);
-            res.status(200).end();
-        }
-    });
-    app.get(IDP_PATHS.SIGN_OUT, function (req, res, next) {
-        if (req.idp.options.sloUrl) {
-            console.log('Initiating SAML SLO request for user: ' + req.user.username +
-                ' with sessionIndex: ' + getSessionIndex(req));
-            res.redirect(IDP_PATHS.SLO);
-        }
-        else {
-            console.log('SAML SLO is not enabled for SP, destroying IDP session');
-            req.session.destroy(function (err) {
-                if (err) {
-                    throw err;
-                }
-                res.redirect('back');
-            });
-        }
-    });
-    app.get([IDP_PATHS.SETTINGS], function (req, res, next) {
-        res.render('settings', {
-            idp: req.idp.options
-        });
-    });
-    app.post([IDP_PATHS.SETTINGS], function (req, res, next) {
-        Object.keys(req.body).forEach(function (key) {
-            switch (req.body[key].toLowerCase()) {
-                case "true":
-                case "yes":
-                case "1":
-                    req.idp.options[key] = true;
-                    break;
-                case "false":
-                case "no":
-                case "0":
-                    req.idp.options[key] = false;
-                    break;
-                default:
-                    req.idp.options[key] = req.body[key];
-                    break;
-            }
-            if (req.body[key].match(/^\d+$/)) {
-                req.idp.options[key] = parseInt(req.body[key], '10');
-            }
-        });
-        console.log('Updated IdP Configuration => \n', req.idp.options);
-        res.redirect('/');
-    });
-    // catch 404 and forward to error handler
-    app.use(function (req, res, next) {
-        var err = new Error('Route Not Found');
-        err.status = 404;
-        next(err);
-    });
-    // development error handler
-    app.use(function (err, req, res, next) {
-        if (err) {
-            res.status(err.status || 500);
-            res.render('error', {
-                message: err.message,
-                error: err
-            });
-        }
-    });
-}
-function runServer(options) {
-    var args = processArgs([], options);
-    return _runServer(args.argv);
-}
-function main() {
-    var args = processArgs(process.argv.slice(2));
-    _runServer(args.argv);
-}
-module.exports = {
-    samlIdp: {
-        run: runServer,
-        expressMiddleware: app
-    }
-};
-//# sourceMappingURL=express-middleware.js.map