samlesa 2.16.0 → 2.16.5

package/build/src/binding-artifact.js

@@ -0,0 +1,333 @@
+/**
+ * @file binding-post.ts
+ * @author tngan
+ * @desc Binding-level API, declare the functions using POST binding
+ */
+import { wording, StatusCode } from './urn.js';
+import libsaml from './libsaml.js';
+import utility, { get } from './utility.js';
+const binding = wording.binding;
+/**
+ * @desc Generate a base64 encoded login request
+ * @param  {string} referenceTagXPath           reference uri
+ * @param  {object} entity                      object includes both idp and sp
+ * @param  {function} customTagReplacement     used when developers have their own login response template
+ */
+function base64LoginRequest(referenceTagXPath, entity, customTagReplacement) {
+    const metadata = { idp: entity.idp.entityMeta, sp: entity.sp.entityMeta };
+    const spSetting = entity.sp.entitySetting;
+    let id = '';
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.idp.getSingleSignOnService(binding.post);
+        let rawSamlRequest;
+        if (spSetting.loginRequestTemplate && customTagReplacement) {
+            const info = customTagReplacement(spSetting.loginRequestTemplate.context);
+            id = get(info, 'id', null);
+            rawSamlRequest = get(info, 'context', null);
+        }
+        else {
+            const nameIDFormat = spSetting.nameIDFormat;
+            const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+            id = spSetting.generateID();
+            rawSamlRequest = libsaml.replaceTagsByValue(libsaml.defaultLoginRequestTemplate.context, {
+                ID: id,
+                Destination: base,
+                Issuer: metadata.sp.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),
+                EntityID: metadata.sp.getEntityID(),
+                AllowCreate: spSetting.allowCreate,
+                NameIDFormat: selectedNameIDFormat
+            });
+        }
+        if (metadata.idp.isWantAuthnRequestsSigned()) {
+            const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = spSetting;
+            return {
+                id,
+                context: libsaml.constructSAMLSignature({
+                    referenceTagXPath,
+                    privateKey,
+                    privateKeyPass,
+                    signatureAlgorithm,
+                    transformationAlgorithms,
+                    rawSamlMessage: rawSamlRequest,
+                    signingCert: metadata.sp.getX509Certificate('signing'),
+                    signatureConfig: spSetting.signatureConfig || {
+                        prefix: 'ds',
+                        location: { reference: "/*[local-name(.)='AuthnRequest']/*[local-name(.)='Issuer']", action: 'after' },
+                    }
+                }),
+            };
+        }
+        // No need to embeded XML signature
+        return {
+            id,
+            context: utility.base64Encode(rawSamlRequest),
+        };
+    }
+    throw new Error('ERR_GENERATE_POST_LOGIN_REQUEST_MISSING_METADATA');
+}
+/**
+ * @desc Generate a base64 encoded login response
+ * @param  {object} requestInfo                 corresponding request, used to obtain the id
+ * @param  {object} entity                      object includes both idp and sp
+ * @param  {object} user                        current logged user (e.g. req.user)
+ * @param  {function} customTagReplacement     used when developers have their own login response template
+ * @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
+ * @param AttributeStatement
+ */
+async function base64LoginResponse(requestInfo = {}, entity, user = {}, customTagReplacement, encryptThenSign = false, AttributeStatement = []) {
+    const idpSetting = entity.idp.entitySetting;
+    const spSetting = entity.sp.entitySetting;
+    const id = idpSetting.generateID();
+    const metadata = {
+        idp: entity.idp.entityMeta,
+        sp: entity.sp.entityMeta,
+    };
+    const nameIDFormat = idpSetting.nameIDFormat;
+    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+    if (metadata && metadata.idp && metadata.sp) {
+        const base = metadata.sp.getAssertionConsumerService(binding.post);
+        let rawSamlResponse;
+        const nowTime = new Date();
+        const spEntityID = metadata.sp.getEntityID();
+        const oneMinutesLaterTime = new Date(nowTime.getTime());
+        oneMinutesLaterTime.setMinutes(oneMinutesLaterTime.getMinutes() + 5);
+        const OneMinutesLater = oneMinutesLaterTime.toISOString();
+        const now = nowTime.toISOString();
+        const acl = metadata.sp.getAssertionConsumerService(binding.post);
+        const sessionIndex = 'session' + idpSetting.generateID(); // 这个是当前系统的会话索引，用于单点注销
+        const tenHoursLaterTime = new Date(nowTime.getTime());
+        tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
+        const tenHoursLater = tenHoursLaterTime.toISOString();
+        const tvalue = {
+            ID: id,
+            AssertionID: idpSetting.generateID(),
+            Destination: base,
+            Audience: spEntityID,
+            EntityID: spEntityID,
+            SubjectRecipient: acl,
+            Issuer: metadata.idp.getEntityID(),
+            IssueInstant: now,
+            AssertionConsumerServiceURL: acl,
+            StatusCode: StatusCode.Success,
+            // can be customized
+            ConditionsNotBefore: now,
+            ConditionsNotOnOrAfter: OneMinutesLater,
+            SubjectConfirmationDataNotOnOrAfter: OneMinutesLater,
+            NameIDFormat: selectedNameIDFormat,
+            NameID: user?.NameID || '',
+            InResponseTo: get(requestInfo, 'extract.request.id', ''),
+            AuthnStatement: `<saml:AuthnStatement AuthnInstant="${now}" SessionNotOnOrAfter="${tenHoursLater}" SessionIndex="${sessionIndex}"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>`,
+            AttributeStatement: libsaml.attributeStatementBuilder(AttributeStatement),
+        };
+        if (idpSetting.loginResponseTemplate && customTagReplacement) {
+            const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
+            rawSamlResponse = get(template, 'context', null);
+        }
+        else {
+            if (requestInfo !== null) {
+                tvalue.InResponseTo = requestInfo?.extract?.request?.id ?? '';
+            }
+            rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLoginResponseTemplate.context, tvalue);
+        }
+        const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm } = idpSetting;
+        const config = {
+            privateKey,
+            privateKeyPass,
+            signatureAlgorithm,
+            signingCert: metadata.idp.getX509Certificate('signing'),
+            isBase64Output: false,
+        };
+        // step: sign assertion ? -> encrypted ? -> sign message ?
+        if (metadata.sp.isWantAssertionsSigned()) {
+            // console.debug('sp wants assertion signed');
+            rawSamlResponse = libsaml.constructSAMLSignature({
+                ...config,
+                rawSamlMessage: rawSamlResponse,
+                transformationAlgorithms: spSetting.transformationAlgorithms,
+                referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
+                signatureConfig: {
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
+                },
+            });
+        }
+        // console.debug('after assertion signed', rawSamlResponse);
+        // SAML response must be signed sign message first, then encrypt
+        if (!encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
+            // console.debug('sign then encrypt and sign entire message');
+            rawSamlResponse = libsaml.constructSAMLSignature({
+                ...config,
+                rawSamlMessage: rawSamlResponse,
+                isMessageSigned: true,
+                transformationAlgorithms: spSetting.transformationAlgorithms,
+                signatureConfig: spSetting.signatureConfig || {
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
+                },
+            });
+        }
+        // console.debug('after message signed', rawSamlResponse);
+        if (idpSetting.isAssertionEncrypted) {
+            // console.debug('idp is configured to do encryption');
+            const context = await libsaml.encryptAssertion(entity.idp, entity.sp, rawSamlResponse);
+            if (encryptThenSign) {
+                //need to decode it
+                rawSamlResponse = utility.base64Decode(context);
+            }
+            else {
+                return Promise.resolve({ id, context });
+            }
+        }
+        //sign after encrypting
+        if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
+            rawSamlResponse = libsaml.constructSAMLSignature({
+                ...config,
+                rawSamlMessage: rawSamlResponse,
+                isMessageSigned: true,
+                transformationAlgorithms: spSetting.transformationAlgorithms,
+                signatureConfig: spSetting.signatureConfig || {
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
+                },
+            });
+        }
+        return Promise.resolve({
+            id,
+            context: utility.base64Encode(rawSamlResponse),
+        });
+    }
+    throw new Error('ERR_GENERATE_POST_LOGIN_RESPONSE_MISSING_METADATA');
+}
+/**
+ * @desc Generate a base64 encoded logout request
+ * @param  {object} user                         current logged user (e.g. req.user)
+ * @param  {string} referenceTagXPath            reference uri
+ * @param  {object} entity                       object includes both idp and sp
+ * @param  {function} customTagReplacement      used when developers have their own login response template
+ * @return {string} base64 encoded request
+ */
+function base64LogoutRequest(user, referenceTagXPath, entity, customTagReplacement) {
+    const metadata = { init: entity.init.entityMeta, target: entity.target.entityMeta };
+    const initSetting = entity.init.entitySetting;
+    const nameIDFormat = initSetting.nameIDFormat;
+    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
+    let id = '';
+    if (metadata && metadata.init && metadata.target) {
+        let rawSamlRequest;
+        if (initSetting.logoutRequestTemplate && customTagReplacement) {
+            const template = customTagReplacement(initSetting.logoutRequestTemplate.context);
+            id = get(template, 'id', null);
+            rawSamlRequest = get(template, 'context', null);
+        }
+        else {
+            id = initSetting.generateID();
+            const tvalue = {
+                ID: id,
+                Destination: metadata.target.getSingleLogoutService(binding.post),
+                Issuer: metadata.init.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                EntityID: metadata.init.getEntityID(),
+                NameIDFormat: selectedNameIDFormat,
+                NameID: user.NameID || '',
+            };
+            rawSamlRequest = libsaml.replaceTagsByValue(libsaml.defaultLogoutRequestTemplate.context, tvalue);
+        }
+        if (entity.target.entitySetting.wantLogoutRequestSigned) {
+            // Need to embeded XML signature
+            const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = initSetting;
+            return {
+                id,
+                context: libsaml.constructSAMLSignature({
+                    referenceTagXPath,
+                    privateKey,
+                    privateKeyPass,
+                    signatureAlgorithm,
+                    transformationAlgorithms,
+                    rawSamlMessage: rawSamlRequest,
+                    signingCert: metadata.init.getX509Certificate('signing'),
+                    signatureConfig: initSetting.signatureConfig || {
+                        prefix: 'ds',
+                        location: { reference: "/*[local-name(.)='LogoutRequest']/*[local-name(.)='Issuer']", action: 'after' },
+                    }
+                }),
+            };
+        }
+        return {
+            id,
+            context: utility.base64Encode(rawSamlRequest),
+        };
+    }
+    throw new Error('ERR_GENERATE_POST_LOGOUT_REQUEST_MISSING_METADATA');
+}
+/**
+ * @desc Generate a base64 encoded logout response
+ * @param  {object} requestInfo                 corresponding request, used to obtain the id
+ * @param  {string} referenceTagXPath           reference uri
+ * @param  {object} entity                      object includes both idp and sp
+ * @param  {function} customTagReplacement     used when developers have their own login response template
+ */
+function base64LogoutResponse(requestInfo, entity, customTagReplacement) {
+    const metadata = {
+        init: entity.init.entityMeta,
+        target: entity.target.entityMeta,
+    };
+    let id = '';
+    const initSetting = entity.init.entitySetting;
+    if (metadata && metadata.init && metadata.target) {
+        let rawSamlResponse;
+        if (initSetting.logoutResponseTemplate) {
+            const template = customTagReplacement(initSetting.logoutResponseTemplate.context);
+            id = template.id;
+            rawSamlResponse = template.context;
+        }
+        else {
+            id = initSetting.generateID();
+            const tvalue = {
+                ID: id,
+                Destination: metadata.target.getSingleLogoutService(binding.post),
+                EntityID: metadata.init.getEntityID(),
+                Issuer: metadata.init.getEntityID(),
+                IssueInstant: new Date().toISOString(),
+                StatusCode: StatusCode.Success,
+                InResponseTo: get(requestInfo, 'extract.request.id', '')
+            };
+            rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLogoutResponseTemplate.context, tvalue);
+        }
+        if (entity.target.entitySetting.wantLogoutResponseSigned) {
+            const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = initSetting;
+            return {
+                id,
+                context: libsaml.constructSAMLSignature({
+                    isMessageSigned: true,
+                    transformationAlgorithms: transformationAlgorithms,
+                    privateKey,
+                    privateKeyPass,
+                    signatureAlgorithm,
+                    rawSamlMessage: rawSamlResponse,
+                    signingCert: metadata.init.getX509Certificate('signing'),
+                    signatureConfig: {
+                        prefix: 'ds',
+                        location: {
+                            reference: "/*[local-name(.)='LogoutResponse']/*[local-name(.)='Issuer']",
+                            action: 'after'
+                        }
+                    }
+                }),
+            };
+        }
+        return {
+            id,
+            context: utility.base64Encode(rawSamlResponse),
+        };
+    }
+    throw new Error('ERR_GENERATE_POST_LOGOUT_RESPONSE_MISSING_METADATA');
+}
+const artifactSignBinding = {
+    base64LoginRequest,
+    base64LoginResponse,
+    base64LogoutRequest,
+    base64LogoutResponse,
+};
+export default artifactSignBinding;

package/build/src/entity-sp.js

@@ -8,6 +8,7 @@ import { namespace } from './urn.js';
 import redirectBinding from './binding-redirect.js';
 import postBinding from './binding-post.js';
 import simpleSignBinding from './binding-simplesign.js';
+import artifactSignBinding from './binding-artifact.js';
 import { flow } from './flow.js';
 /*
  * @desc interface function
@@ -56,6 +57,9 @@ export class ServiceProvider extends Entity {
                 // Object context = {id, context, signature, sigAlg}
                 context = simpleSignBinding.base64LoginRequest({ idp, sp: this }, customTagReplacement);
                 break;
+            case nsBinding.artifact:
+                context = artifactSignBinding.base64LoginRequest("/*[local-name(.)='AuthnRequest']", { idp, sp: this }, customTagReplacement);
+                break;
             default:
                 // Will support artifact in the next release
                 throw new Error('ERR_SP_LOGIN_REQUEST_UNDEFINED_BINDING');
@@ -85,4 +89,23 @@ export class ServiceProvider extends Entity {
             request: request
         });
     }
+    /**
+     * @desc   request SamlResponse by Arc id
+     * @param  {IdentityProvider}   idp             object of identity provider
+     * @param  {string}   binding                   protocol binding
+     * @param  {request}   req                      request
+     */
+    artifactResolveResponse(idp, binding, request) {
+        const self = this;
+        return flow({
+            soap: true,
+            from: idp,
+            self: self,
+            checkSignature: true, // saml response must have signature
+            parserType: 'SAMLResponse',
+            type: 'login',
+            binding: binding,
+            request: request
+        });
+    }
 }

package/build/src/flow.js

@@ -1,6 +1,10 @@
 import { base64Decode } from './utility.js';
 import { verifyTime } from './validator.js';
 import libsaml from './libsaml.js';
+import * as uuid from 'uuid';
+import { select } from 'xpath';
+import { DOMParser } from '@xmldom/xmldom';
+import { sendArtifactResolve } from "./soap.js";
 import { extract, loginRequestFields, loginResponseFields, logoutRequestFields, logoutResponseFields, logoutResponseStatusFields, loginResponseStatusFields } from './extractor.js';
 import { BindingNamespace, ParserType, wording, StatusCode } from './urn.js';
 const bindDict = wording.binding;
@@ -122,6 +126,237 @@ async function redirectFlow(options) {
 }
 // proceed the post flow
 async function postFlow(options) {
+    const { soap = false, request, from, self, parserType, checkSignature = true } = options;
+    const { body } = request;
+    const direction = libsaml.getQueryParamByType(parserType);
+    let encodedRequest = '';
+    let samlContent = '';
+    if (soap === false) {
+        encodedRequest = body[direction];
+        // @ts-ignore
+        samlContent = String(base64Decode(encodedRequest));
+    }
+    /** 增加判断是不是Soap 工件绑定*/
+    if (soap) {
+        const metadata = {
+            idp: from.entityMeta,
+            sp: self.entityMeta,
+        };
+        const spSetting = self.entitySetting;
+        let ID = '_' + uuid.v4();
+        let url = metadata.idp.getArtifactResolutionService(bindDict.soap);
+        let samlSoapRaw = libsaml.replaceTagsByValue(libsaml.defaultArtifactResolveTemplate.context, {
+            ID: request?.messageHandle,
+            Destination: url,
+            Issuer: metadata.sp.getEntityID(),
+            IssueInstant: new Date().toISOString(),
+            Art: request.Art
+        });
+        if (metadata.idp.isWantAuthnRequestsSigned()) {
+            const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = spSetting;
+            let signatureSoap = libsaml.constructSAMLSignature({
+                referenceTagXPath: "//*[local-name(.)='ArtifactResolve']",
+                isMessageSigned: false,
+                isBase64Output: false,
+                transformationAlgorithms: transformationAlgorithms,
+                privateKey,
+                privateKeyPass,
+                signatureAlgorithm,
+                rawSamlMessage: samlSoapRaw,
+                signingCert: metadata.sp.getX509Certificate('signing'),
+                signatureConfig: {
+                    prefix: 'ds',
+                    location: {
+                        reference: "//*[local-name(.)='Issuer']",
+                        action: 'after'
+                    }
+                }
+            });
+            let data = await sendArtifactResolve(url, signatureSoap);
+            /*            console.log(signatureSoap)
+                        console.log("签过名的")*/
+            console.log(data);
+            console.log("keycloak数据----------------------");
+            samlContent = data;
+        }
+        // No need to embeded XML signature
+    }
+    const verificationOptions = {
+        metadata: from.entityMeta,
+        signatureAlgorithm: from.entitySetting.requestSignatureAlgorithm,
+    };
+    /** 断言是否加密应根据响应里面的字段判断*/
+    let decryptRequired = from.entitySetting.isAssertionEncrypted;
+    let extractorFields = [];
+    // validate the xml first
+    /*    let res = await libsaml.isValidXml(samlContent).catch((error)=>{
+            console.log(error);
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+            console.log("验证和结果-----------------------")
+        });
+        console.log(res);
+        console.log("验证和结果-----------------------")*/
+    if (parserType !== urlParams.samlResponse) {
+        extractorFields = getDefaultExtractorFields(parserType, null);
+    }
+    // check status based on different scenarios
+    /*    await checkStatus(samlContent, parserType);*/
+    /**检查签名顺序 */
+    /*  if (
+        checkSignature &&
+        from.entitySetting.messageSigningOrder === MessageSignatureOrder.ETS
+      ) {
+        console.log("===============我走的这里=========================")
+        const [verified, verifiedAssertionNode,isDecryptRequired] = libsaml.verifySignature(samlContent, verificationOptions);
+        console.log(verified);
+        console.log("verified")
+        decryptRequired = isDecryptRequired
+        if (!verified) {
+          return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
+        }
+        if (!decryptRequired) {
+          extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
+        }
+      }*/
+    if (soap === true) {
+        const [verified, verifiedAssertionNode, isDecryptRequired] = libsaml.verifySignatureSoap(samlContent, verificationOptions);
+        decryptRequired = isDecryptRequired;
+        if (!verified) {
+            return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
+        }
+        if (!decryptRequired) {
+            console.log("-------------------走到了这里----------------------");
+            extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
+        }
+        if (parserType === 'SAMLResponse' && decryptRequired) {
+            // 1. 解密断言
+            const [decryptedSAML, decryptedAssertion] = await libsaml.decryptAssertionSoap(self, samlContent);
+            console.log(decryptedAssertion);
+            console.log("解密数据-----------------------------");
+            // 2. 检查解密后的断言是否包含签名
+            const assertionDoc = new DOMParser().parseFromString(decryptedAssertion, 'text/xml');
+            const assertionSignatureNodes = select("./*[local-name()='Signature']", assertionDoc.documentElement);
+            // 3. 如果存在签名则验证
+            if (assertionSignatureNodes.length > 0) {
+                // 3.1 创建新的验证选项（保持原配置）
+                const assertionVerificationOptions = {
+                    ...verificationOptions,
+                    isAssertion: true // 添加标识表示正在验证断言
+                };
+                // 3.2 验证断言签名
+                const [assertionVerified, result] = libsaml.verifySignatureSoap(decryptedAssertion, assertionVerificationOptions);
+                console.log(assertionVerified);
+                console.log(result);
+                console.log("验证机结果--------------");
+                if (!assertionVerified) {
+                    console.error("解密后的断言签名验证失败");
+                    return Promise.reject('ERR_FAIL_TO_VERIFY_ASSERTION_SIGNATURE');
+                }
+                if (assertionVerified) {
+                    // @ts-ignore
+                    samlContent = result;
+                    extractorFields = getDefaultExtractorFields(parserType, result);
+                }
+            }
+            else {
+                samlContent = decryptedAssertion;
+                extractorFields = getDefaultExtractorFields(parserType, decryptedAssertion);
+            }
+        }
+    }
+    if (soap === false) {
+        const [verified, verifiedAssertionNode, isDecryptRequired] = libsaml.verifySignature(samlContent, verificationOptions);
+        decryptRequired = isDecryptRequired;
+        if (!verified) {
+            return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
+        }
+        if (!decryptRequired) {
+            extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
+        }
+        if (parserType === 'SAMLResponse' && decryptRequired) {
+            const result = await libsaml.decryptAssertion(self, samlContent);
+            samlContent = result[0];
+            extractorFields = getDefaultExtractorFields(parserType, result[1]);
+        }
+    }
+    // verify the signatures (the response is signed then encrypted, then decrypt first then verify)
+    /*  if (
+        checkSignature &&
+        from.entitySetting.messageSigningOrder === MessageSignatureOrder.STE
+      ) {
+        const [verified, verifiedAssertionNode,isDecryptRequired] = libsaml.verifySignature(samlContent, verificationOptions);
+        decryptRequired = isDecryptRequired
+        if (verified) {
+          extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
+        } else {
+          return Promise.reject('ERR_FAIL_TO_VERIFY_STE_SIGNATURE');
+        }
+      }*/
+    const parseResult = {
+        samlContent: samlContent,
+        extract: extract(samlContent, extractorFields),
+    };
+    /**
+     *  Validation part: validate the context of response after signature is verified and decrypted (optional)
+     */
+    const targetEntityMetadata = from.entityMeta;
+    const issuer = targetEntityMetadata.getEntityID();
+    const extractedProperties = parseResult.extract;
+    console.log(extractedProperties);
+    console.log(parseResult);
+    console.log("解析结果----------------------------------");
+    console.log("签发这-----------");
+    // unmatched issuer
+    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
+        && extractedProperties
+        && extractedProperties.issuer !== issuer) {
+        return Promise.reject('ERR_UNMATCH_ISSUER');
+    }
+    // invalid session time
+    // only run the verifyTime when `SessionNotOnOrAfter` exists
+    if (parserType === 'SAMLResponse'
+        && extractedProperties.sessionIndex.sessionNotOnOrAfter
+        && !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
+        return Promise.reject('ERR_EXPIRED_SESSION');
+    }
+    // invalid time
+    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
+    if (parserType === 'SAMLResponse'
+        && extractedProperties.conditions
+        && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
+        return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
+    }
+    //valid destination
+    //There is no validation of the response here. The upper-layer application
+    // should verify the result by itself to see if the destination is equal to the SP acs and
+    // whether the response.id is used to prevent replay attacks.
+    /*
+        let destination = extractedProperties?.response?.destination
+        let isExit = self.entitySetting?.assertionConsumerService?.filter((item) => {
+            return item?.Location === destination
+        })
+        if (isExit?.length === 0) {
+            return Promise.reject('ERR_Destination_URL');
+        }
+        if (parserType === 'SAMLResponse') {
+            let destination = extractedProperties?.response?.destination
+            let isExit = self.entitySetting?.assertionConsumerService?.filter((item: { Location: any; }) => {
+                return item?.Location === destination
+            })
+            if (isExit?.length === 0) {
+                return Promise.reject('ERR_Destination_URL');
+            }
+        }
+    */
+    return Promise.resolve(parseResult);
+}
+// proceed the post Artifact flow
+async function postArtifactFlow(options) {
     const { request, from, self, parserType, checkSignature = true } = options;
     const { body } = request;
     const direction = libsaml.getQueryParamByType(parserType);
@@ -339,7 +574,6 @@ function checkStatus(content, parserType) {
         ? loginResponseStatusFields
         : logoutResponseStatusFields;
     const { top, second } = extract(content, fields);
-    console.log(top, second);
     // only resolve when top-tier status code is success
     if (top === StatusCode.Success) {
         return Promise.resolve('OK');