samlesa 2.12.9 → 2.12.11

package/src/binding-post.ts

@@ -72,14 +72,15 @@ function base64LoginRequest(referenceTagXPath: string, entity: any, customTagRep
   throw new Error('ERR_GENERATE_POST_LOGIN_REQUEST_MISSING_METADATA');
 }
 /**
-* @desc Generate a base64 encoded login response
-* @param  {object} requestInfo                 corresponding request, used to obtain the id
-* @param  {object} entity                      object includes both idp and sp
-* @param  {object} user                        current logged user (e.g. req.user)
-* @param  {function} customTagReplacement     used when developers have their own login response template
-* @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
-*/
-async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any = {}, customTagReplacement?: (template: string) => BindingContext, encryptThenSign: boolean = false): Promise<BindingContext> {
+ * @desc Generate a base64 encoded login response
+ * @param  {object} requestInfo                 corresponding request, used to obtain the id
+ * @param  {object} entity                      object includes both idp and sp
+ * @param  {object} user                        current logged user (e.g. req.user)
+ * @param  {function} customTagReplacement     used when developers have their own login response template
+ * @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
+ * @param AttributeStatement
+ */
+async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any = {}, customTagReplacement?: (template: string) => BindingContext, encryptThenSign: boolean = false , AttributeStatement=[]): Promise<BindingContext> {
   const idpSetting = entity.idp.entitySetting;
   const spSetting = entity.sp.entitySetting;
   const id = idpSetting.generateID();
@@ -89,16 +90,24 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
   };
   const nameIDFormat = idpSetting.nameIDFormat;
   const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+
+
   if (metadata && metadata.idp && metadata.sp) {
     const base = metadata.sp.getAssertionConsumerService(binding.post);
-    let rawSamlResponse: string;
-    const nowTime = new Date();
-    const spEntityID = metadata.sp.getEntityID();
-    const fiveMinutesLaterTime = new Date(nowTime.getTime());
-    fiveMinutesLaterTime.setMinutes(fiveMinutesLaterTime.getMinutes() + 5);
-    const fiveMinutesLater = fiveMinutesLaterTime.toISOString();
+    let rawSamlResponse;
+    let  nowTime = new Date();
+    let  spEntityID = metadata.sp.getEntityID();
+    let  oneMinutesLaterTime = new Date(nowTime.getTime());
+    oneMinutesLaterTime.setMinutes(oneMinutesLaterTime.getMinutes() + 5);
+    const OneMinutesLater = oneMinutesLaterTime.toISOString();
     const now = nowTime.toISOString();
+    console.log(`现在是北京时间:${nowTime.toLocaleString()}`)
+    console.log(`现在是两分钟时间:${oneMinutesLaterTime.toLocaleString()}`)
     const acl = metadata.sp.getAssertionConsumerService(binding.post);
+    const sessionIndex = 'session'+idpSetting.generateID(); // 这个是当前系统的会话索引，用于单点注销
+    const tenHoursLaterTime = new Date(nowTime.getTime());
+    tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
+    const tenHoursLater = tenHoursLaterTime.toISOString();
     const tvalue: any = {
       ID: id,
       AssertionID: idpSetting.generateID(),
@@ -112,20 +121,20 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
       StatusCode: StatusCode.Success,
       // can be customized
       ConditionsNotBefore: now,
-      ConditionsNotOnOrAfter: fiveMinutesLater,
-      SubjectConfirmationDataNotOnOrAfter: fiveMinutesLater,
+      ConditionsNotOnOrAfter: OneMinutesLater,
+      SubjectConfirmationDataNotOnOrAfter: OneMinutesLater,
       NameIDFormat: selectedNameIDFormat,
-      NameID: user.NameID || '',
+      NameID: user?.NameID || '',
       InResponseTo: get(requestInfo, 'extract.request.id', ''),
-      AuthnStatement: '',
-      AttributeStatement: '',
+      AuthnStatement: `<saml:AuthnStatement AuthnInstant="${now}" SessionNotOnOrAfter="${tenHoursLater}" SessionIndex="${sessionIndex}"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>`,
+      AttributeStatement: libsaml.attributeStatementBuilder(AttributeStatement),
     };
     if (idpSetting.loginResponseTemplate && customTagReplacement) {
       const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
       rawSamlResponse = get(template, 'context', null);
     } else {
       if (requestInfo !== null) {
-        tvalue.InResponseTo = requestInfo.extract.request.id ?? '';
+        tvalue.InResponseTo = requestInfo?.extract?.request?.id ?? '';
       }
       rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLoginResponseTemplate.context, tvalue);
     }
@@ -167,8 +176,6 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
           location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
         },
       });
-      console.log(rawSamlResponse);
-      console.log('这他妈是什么------------------')
     }
 
     // console.debug('after message signed', rawSamlResponse);
@@ -204,6 +211,8 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
     });
 
   }
+
+
   throw new Error('ERR_GENERATE_POST_LOGIN_RESPONSE_MISSING_METADATA');
 }
 /**

package/src/binding-redirect.ts

@@ -144,8 +144,9 @@ function loginRequestRedirectURL(entity: {
  * @param  {object} user                         current logged user (e.g. req.user)
  * @param  {String} relayState                the relaystate sent by sp corresponding request
  * @param  {function} customTagReplacement     used when developers have their own login response template
+ * @param AttributeStatement
  */
-function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {}, relayState?: string, customTagReplacement?: (template: string) => BindingContext): BindingContext {
+function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {}, relayState?: string, customTagReplacement?: (template: string) => BindingContext,AttributeStatement =[]): BindingContext {
   const idpSetting = entity.idp.entitySetting;
   const spSetting = entity.sp.entitySetting;
   const metadata = {
@@ -159,7 +160,6 @@ function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {},
     if(!base){
       throw new Error('dont have a base url');
     }
-
     let rawSamlResponse: string;
     //
     const nameIDFormat = idpSetting.nameIDFormat;
@@ -167,6 +167,12 @@ function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {},
     const nowTime = new Date();
     // Five minutes later : nowtime  + 5 * 60 * 1000 (in milliseconds)
     const fiveMinutesLaterTime = new Date(nowTime.getTime() + 300_000);
+    const now = nowTime.toISOString();
+    console.log(`现在是北京时间:${nowTime.toLocaleString()}`)
+    const sessionIndex = 'session'+idpSetting.generateID(); // 这个是当前系统的会话索引，用于单点注销
+    const tenHoursLaterTime = new Date(nowTime.getTime());
+    tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
+    const tenHoursLater = tenHoursLaterTime.toISOString();
     const tvalue: any = {
       ID: id,
       AssertionID: idpSetting.generateID(),
@@ -185,8 +191,8 @@ function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {},
       NameIDFormat: selectedNameIDFormat,
       NameID: user.NameID || '',
       InResponseTo: get(requestInfo, 'extract.request.id', ''),
-      AuthnStatement: '',
-      AttributeStatement: '',
+      AuthnStatement: `<saml:AuthnStatement AuthnInstant="${now}" SessionNotOnOrAfter="${tenHoursLater}" SessionIndex="${sessionIndex}"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>`,
+      AttributeStatement: libsaml.attributeStatementBuilder(AttributeStatement),
     };
 
     if (idpSetting.loginResponseTemplate && customTagReplacement) {
@@ -196,7 +202,7 @@ function loginResponseRedirectURL(requestInfo: any, entity: any, user: any = {},
     } else {
 
       if (requestInfo !== null) {
-        tvalue.InResponseTo = requestInfo.extract.request.id;
+        tvalue.InResponseTo = requestInfo?.extract?.request?.id;
       }
       rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLoginResponseTemplate.context, tvalue);
     }
@@ -321,7 +327,7 @@ function logoutResponseRedirectURL(requestInfo: any, entity: any, relayState?: s
         StatusCode: namespace.statusCode.success,
       };
       if (requestInfo && requestInfo.extract && requestInfo.extract.request) {
-        tvalue.InResponseTo = requestInfo.extract.request.id;
+        tvalue.InResponseTo = requestInfo?.extract?.request?.id;
       }
       rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLogoutResponseTemplate.context, tvalue);
     }

package/src/binding-simplesign.ts

@@ -127,14 +127,15 @@ function base64LoginRequest(entity: any, customTagReplacement?: (template: strin
   throw new Error('ERR_GENERATE_POST_SIMPLESIGN_LOGIN_REQUEST_MISSING_METADATA');
 }
 /**
-* @desc Generate a base64 encoded login response
-* @param  {object} requestInfo                 corresponding request, used to obtain the id
-* @param  {object} entity                      object includes both idp and sp
-* @param  {object} user                        current logged user (e.g. req.user)
-* @param  {string}  relayState               the relay state
-* @param  {function} customTagReplacement     used when developers have their own login response template
-*/
-async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any = {}, relayState?: string, customTagReplacement?: (template: string) => BindingContext): Promise<BindingSimpleSignContext> {
+ * @desc Generate a base64 encoded login response
+ * @param  {object} requestInfo                 corresponding request, used to obtain the id
+ * @param  {object} entity                      object includes both idp and sp
+ * @param  {object} user                        current logged user (e.g. req.user)
+ * @param  {string}  relayState               the relay state
+ * @param  {function} customTagReplacement     used when developers have their own login response template
+ * @param AttributeStatement
+ */
+async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any = {}, relayState?: string, customTagReplacement?: (template: string) => BindingContext, AttributeStatement:[] = []): Promise<BindingSimpleSignContext> {
   const idpSetting = entity.idp.entitySetting;
   const spSetting = entity.sp.entitySetting;
   const id = idpSetting.generateID();
@@ -150,6 +151,12 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
     const nowTime = new Date();
     // Five minutes later : nowtime  + 5 * 60 * 1000 (in milliseconds)
     const fiveMinutesLaterTime = new Date(nowTime.getTime() + 300_000 );
+    const now = nowTime.toISOString();
+    console.log(`现在是北京时间:${nowTime.toLocaleString()}`)
+    const sessionIndex = 'session'+idpSetting.generateID(); // 这个是当前系统的会话索引，用于单点注销
+    const tenHoursLaterTime = new Date(nowTime.getTime());
+    tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
+    const tenHoursLater = tenHoursLaterTime.toISOString();
     const tvalue: any = {
       ID: id,
       AssertionID: idpSetting.generateID(),
@@ -168,15 +175,15 @@ async function base64LoginResponse(requestInfo: any = {}, entity: any, user: any
       NameIDFormat: selectedNameIDFormat,
       NameID: user.NameID || '',
       InResponseTo: get(requestInfo, 'extract.request.id', ''),
-      AuthnStatement: '',
-      AttributeStatement: '',
+      AuthnStatement: `<saml:AuthnStatement AuthnInstant="${now}" SessionNotOnOrAfter="${tenHoursLater}" SessionIndex="${sessionIndex}"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>`,
+      AttributeStatement: libsaml.attributeStatementBuilder(AttributeStatement),
     };
     if (idpSetting.loginResponseTemplate && customTagReplacement) {
       const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
       rawSamlResponse = get(template, 'context', null);
     } else {
       if (requestInfo !== null) {
-        tvalue.InResponseTo = requestInfo.extract.request.id;
+        tvalue.InResponseTo = requestInfo?.extract?.request?.id;
       }
       rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLoginResponseTemplate.context, tvalue);
     }

package/src/entity-idp.ts

@@ -49,7 +49,7 @@ export class IdentityProvider extends Entity {
     };
     const entitySetting = Object.assign(defaultIdpEntitySetting, idpSetting);
     // build attribute part
-    if (idpSetting.loginResponseTemplate) {
+/*    if (idpSetting.loginResponseTemplate) {
       if (isString(idpSetting.loginResponseTemplate.context) && Array.isArray(idpSetting.loginResponseTemplate.attributes)) {
         let attributeStatementTemplate;
         let attributeTemplate;
@@ -73,7 +73,7 @@ export class IdentityProvider extends Entity {
       } else {
         console.warn('Invalid login response template');
       }
-    }
+    }*/
     super(entitySetting, 'idp');
   }
 
@@ -89,9 +89,11 @@ export class IdentityProvider extends Entity {
     customTagReplacement?: (template: string) => BindingContext,
     encryptThenSign?: boolean,
     relayState?: string,
+    context: Record<string, any>,
+    AttributeStatement:[]
   }) {
 const bindType = params?.binding ?? 'post';
-    const {  sp,requestInfo ={}, user = {},customTagReplacement,encryptThenSign = false ,relayState=''} = params
+    const {  sp,requestInfo ={}, user = {},customTagReplacement,encryptThenSign = false ,relayState='',AttributeStatement= [] } = params
     const protocol = namespace.binding[bindType];
     // can support post, redirect and post simple sign bindings for login response
     let context: any = null;
@@ -100,25 +102,25 @@ const bindType = params?.binding ?? 'post';
         context = await postBinding.base64LoginResponse(requestInfo, {
           idp: this,
           sp,
-        }, user, customTagReplacement, encryptThenSign);
+        }, user, customTagReplacement, encryptThenSign,AttributeStatement);
         break;
 
       case namespace.binding.simpleSign:
         context = await simpleSignBinding.base64LoginResponse( requestInfo, {
           idp: this, sp,
-        }, user, relayState, customTagReplacement);
+        }, user, relayState, customTagReplacement,AttributeStatement);
         break;
 
       case namespace.binding.redirect:
         return redirectBinding.loginResponseRedirectURL(requestInfo, {
           idp: this,
           sp,
-        }, user, relayState, customTagReplacement);
+        }, user, relayState, customTagReplacement,AttributeStatement);
       default:
         context = await postBinding.base64LoginResponse(requestInfo, {
           idp: this,
           sp,
-        }, user, customTagReplacement, encryptThenSign);
+        }, user, customTagReplacement, encryptThenSign,AttributeStatement);
  /*       throw new Error('ERR_CREATE_RESPONSE_UNDEFINED_BINDING');*/
     }
 

package/src/extractor.ts

@@ -44,7 +44,7 @@ export const loginRequestFields: ExtractorFields = [
   {
     key: 'request',
     localPath: ['AuthnRequest'],
-    attributes: ['ID', 'IssueInstant', 'Destination', 'AssertionConsumerServiceURL']
+    attributes: ['ID', 'IssueInstant', 'Destination', 'AssertionConsumerServiceURL','ProtocolBinding','ForceAuthn','IsPassive','AssertionConsumerServiceIndex','AttributeConsumingServiceIndex']
   },
   {
     key: 'issuer',