samlesa 2.16.1 → 2.16.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of samlesa might be problematic. Click here for more details.
- package/build/src/binding-artifact.js +333 -0
- package/build/src/binding-redirect.js +97 -2
- package/build/src/entity-sp.js +138 -21
- package/build/src/extractor.js +13 -0
- package/build/src/flow.js +225 -5
- package/build/src/libsaml.js +233 -2
- package/build/src/metadata-idp.js +22 -0
- package/build/src/metadata-sp.js +19 -15
- package/build/src/metadata.js +50 -31
- package/build/src/schema/saml-schema-ecp-2.0.xsd +1 -1
- package/build/src/schema/saml-schema-metadata-2.0.xsd +3 -3
- package/build/src/schema/saml-schema-protocol-2.0.xsd +1 -1
- package/build/src/schema/soap-envelope.xsd +68 -0
- package/build/src/schema/xml.xsd +88 -0
- package/build/src/schemaValidator.js +28 -6
- package/build/src/soap.js +25 -0
- package/build/src/urn.js +5 -3
- package/package.json +2 -1
- package/types/{binding-post.d.ts → src/binding-artifact.d.ts} +25 -25
- package/types/src/binding-artifact.d.ts.map +1 -0
- package/types/src/binding-redirect.d.ts +14 -1
- package/types/src/binding-redirect.d.ts.map +1 -1
- package/types/src/entity-sp.d.ts +50 -20
- package/types/src/entity-sp.d.ts.map +1 -1
- package/types/src/extractor.d.ts +5 -0
- package/types/src/extractor.d.ts.map +1 -1
- package/types/src/flow.d.ts.map +1 -1
- package/types/src/libsaml.d.ts +16 -0
- package/types/src/libsaml.d.ts.map +1 -1
- package/types/src/metadata-idp.d.ts +6 -0
- package/types/src/metadata-idp.d.ts.map +1 -1
- package/types/src/metadata-sp.d.ts.map +1 -1
- package/types/src/metadata.d.ts +34 -27
- package/types/src/metadata.d.ts.map +1 -1
- package/types/src/schemaValidator.d.ts.map +1 -1
- package/types/src/soap.d.ts +2 -0
- package/types/src/soap.d.ts.map +1 -0
- package/types/src/urn.d.ts +2 -0
- package/types/src/urn.d.ts.map +1 -1
- package/build/.idea/build.iml +0 -12
- package/build/.idea/deployment.xml +0 -14
- package/build/.idea/modules.xml +0 -8
- package/types/api.d.ts +0 -15
- package/types/api.d.ts.map +0 -1
- package/types/binding-post.d.ts.map +0 -1
- package/types/binding-redirect.d.ts +0 -54
- package/types/binding-redirect.d.ts.map +0 -1
- package/types/binding-simplesign.d.ts +0 -41
- package/types/binding-simplesign.d.ts.map +0 -1
- package/types/entity-idp.d.ts +0 -38
- package/types/entity-idp.d.ts.map +0 -1
- package/types/entity-sp.d.ts +0 -38
- package/types/entity-sp.d.ts.map +0 -1
- package/types/entity.d.ts +0 -100
- package/types/entity.d.ts.map +0 -1
- package/types/extractor.d.ts +0 -26
- package/types/extractor.d.ts.map +0 -1
- package/types/flow.d.ts +0 -7
- package/types/flow.d.ts.map +0 -1
- package/types/libsaml.d.ts +0 -208
- package/types/libsaml.d.ts.map +0 -1
- package/types/metadata-idp.d.ts +0 -25
- package/types/metadata-idp.d.ts.map +0 -1
- package/types/metadata-sp.d.ts +0 -37
- package/types/metadata-sp.d.ts.map +0 -1
- package/types/metadata.d.ts +0 -58
- package/types/metadata.d.ts.map +0 -1
- package/types/types.d.ts +0 -128
- package/types/types.d.ts.map +0 -1
- package/types/urn.d.ts +0 -195
- package/types/urn.d.ts.map +0 -1
- package/types/utility.d.ts +0 -133
- package/types/utility.d.ts.map +0 -1
- package/types/validator.d.ts +0 -4
- package/types/validator.d.ts.map +0 -1
package/build/src/metadata.js
CHANGED
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file metadata.ts
|
|
3
|
-
* @author tngan
|
|
4
|
-
* @desc An abstraction for metadata of identity provider and service provider
|
|
5
|
-
*/
|
|
2
|
+
* @file metadata.ts
|
|
3
|
+
* @author tngan
|
|
4
|
+
* @desc An abstraction for metadata of identity provider and service provider
|
|
5
|
+
*/
|
|
6
6
|
import * as fs from 'fs';
|
|
7
7
|
import { namespace } from './urn.js';
|
|
8
8
|
import { extract } from './extractor.js';
|
|
9
9
|
import { isString } from './utility.js';
|
|
10
10
|
export default class Metadata {
|
|
11
11
|
/**
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
12
|
+
* @param {string | Buffer} xml
|
|
13
|
+
* @param {object} extraParse for custom metadata extractor
|
|
14
|
+
*/
|
|
15
15
|
constructor(xml, extraParse = []) {
|
|
16
16
|
this.xmlString = xml.toString();
|
|
17
17
|
this.meta = extract(this.xmlString, extraParse.concat([
|
|
@@ -66,46 +66,46 @@ export default class Metadata {
|
|
|
66
66
|
}
|
|
67
67
|
}
|
|
68
68
|
/**
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
69
|
+
* @desc Get the metadata in xml format
|
|
70
|
+
* @return {string} metadata in xml format
|
|
71
|
+
*/
|
|
72
72
|
getMetadata() {
|
|
73
73
|
return this.xmlString;
|
|
74
74
|
}
|
|
75
75
|
/**
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
76
|
+
* @desc Export the metadata to specific file
|
|
77
|
+
* @param {string} exportFile is the output file path
|
|
78
|
+
*/
|
|
79
79
|
exportMetadata(exportFile) {
|
|
80
80
|
fs.writeFileSync(exportFile, this.xmlString);
|
|
81
81
|
}
|
|
82
82
|
/**
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
83
|
+
* @desc Get the entityID in metadata
|
|
84
|
+
* @return {string} entityID
|
|
85
|
+
*/
|
|
86
86
|
getEntityID() {
|
|
87
87
|
return this.meta.entityID;
|
|
88
88
|
}
|
|
89
89
|
/**
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
90
|
+
* @desc Get the x509 certificate declared in entity metadata
|
|
91
|
+
* @param {string} use declares the type of certificate
|
|
92
|
+
* @return {string} certificate in string format
|
|
93
|
+
*/
|
|
94
94
|
getX509Certificate(use) {
|
|
95
95
|
return this.meta.certificate[use] || null;
|
|
96
96
|
}
|
|
97
97
|
/**
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
98
|
+
* @desc Get the support NameID format declared in entity metadata
|
|
99
|
+
* @return {array} support NameID format
|
|
100
|
+
*/
|
|
101
101
|
getNameIDFormat() {
|
|
102
102
|
return this.meta.nameIDFormat;
|
|
103
103
|
}
|
|
104
104
|
/**
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
105
|
+
* @desc Get the entity endpoint for single logout service
|
|
106
|
+
* @param {string} binding e.g. redirect, post
|
|
107
|
+
* @return {string/object} location
|
|
108
|
+
*/
|
|
109
109
|
getSingleLogoutService(binding) {
|
|
110
110
|
if (binding && isString(binding)) {
|
|
111
111
|
const bindType = namespace.binding[binding];
|
|
@@ -121,10 +121,29 @@ export default class Metadata {
|
|
|
121
121
|
return this.meta.singleLogoutService;
|
|
122
122
|
}
|
|
123
123
|
/**
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
124
|
+
* @desc Get the entity endpoint for single logout service
|
|
125
|
+
* @param {string} binding e.g. redirect, post
|
|
126
|
+
* @return {string/object} location
|
|
127
|
+
*/
|
|
128
|
+
getArtifactResolutionService(binding) {
|
|
129
|
+
if (binding && isString(binding)) {
|
|
130
|
+
const bindType = namespace.binding[binding];
|
|
131
|
+
let artifactResolutionService = this.meta.artifactResolutionService;
|
|
132
|
+
if (!(artifactResolutionService instanceof Array)) {
|
|
133
|
+
artifactResolutionService = [artifactResolutionService];
|
|
134
|
+
}
|
|
135
|
+
const service = artifactResolutionService.find(obj => obj.binding === bindType);
|
|
136
|
+
if (service) {
|
|
137
|
+
return service.location;
|
|
138
|
+
}
|
|
139
|
+
}
|
|
140
|
+
return this.meta.artifactResolutionService;
|
|
141
|
+
}
|
|
142
|
+
/**
|
|
143
|
+
* @desc Get the support bindings
|
|
144
|
+
* @param {[string]} services
|
|
145
|
+
* @return {[string]} support bindings
|
|
146
|
+
*/
|
|
128
147
|
getSupportBindings(services) {
|
|
129
148
|
let supportBindings = [];
|
|
130
149
|
if (services) {
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
<import namespace="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
16
16
|
schemaLocation="saml-schema-assertion-2.0.xsd"/>
|
|
17
17
|
<import namespace="http://schemas.xmlsoap.org/soap/envelope/"
|
|
18
|
-
schemaLocation="
|
|
18
|
+
schemaLocation="soap-envelope.xsd"/>
|
|
19
19
|
<annotation>
|
|
20
20
|
<documentation>
|
|
21
21
|
Document identifier: saml-schema-ecp-2.0
|
|
@@ -11,13 +11,13 @@
|
|
|
11
11
|
blockDefault="substitution"
|
|
12
12
|
version="2.0">
|
|
13
13
|
<import namespace="http://www.w3.org/2000/09/xmldsig#"
|
|
14
|
-
schemaLocation="
|
|
14
|
+
schemaLocation="xmldsig-core-schema.xsd"/>
|
|
15
15
|
<import namespace="http://www.w3.org/2001/04/xmlenc#"
|
|
16
|
-
schemaLocation="
|
|
16
|
+
schemaLocation="xenc-schema.xsd"/>
|
|
17
17
|
<import namespace="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
18
18
|
schemaLocation="saml-schema-assertion-2.0.xsd"/>
|
|
19
19
|
<import namespace="http://www.w3.org/XML/1998/namespace"
|
|
20
|
-
schemaLocation="
|
|
20
|
+
schemaLocation="xml.xsd"/>
|
|
21
21
|
<annotation>
|
|
22
22
|
<documentation>
|
|
23
23
|
Document identifier: saml-schema-metadata-2.0
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
<import namespace="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
13
13
|
schemaLocation="saml-schema-assertion-2.0.xsd"/>
|
|
14
14
|
<import namespace="http://www.w3.org/2000/09/xmldsig#"
|
|
15
|
-
schemaLocation="
|
|
15
|
+
schemaLocation="xmldsig-core-schema.xsd"/>
|
|
16
16
|
<annotation>
|
|
17
17
|
<documentation>
|
|
18
18
|
Document identifier: saml-schema-protocol-2.0
|
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="utf-8"?>
|
|
2
|
+
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://schemas.xmlsoap.org/soap/envelope/" targetNamespace="http://schemas.xmlsoap.org/soap/envelope/">
|
|
3
|
+
<!-- Envelope, header and body -->
|
|
4
|
+
<xs:element name="Envelope" type="tns:Envelope"/>
|
|
5
|
+
<xs:complexType name="Envelope">
|
|
6
|
+
<xs:sequence>
|
|
7
|
+
<xs:element ref="tns:Header" minOccurs="0"/>
|
|
8
|
+
<xs:element ref="tns:Body" minOccurs="1"/>
|
|
9
|
+
<xs:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax"/>
|
|
10
|
+
</xs:sequence>
|
|
11
|
+
<xs:anyAttribute namespace="##other" processContents="lax"/>
|
|
12
|
+
</xs:complexType>
|
|
13
|
+
<xs:element name="Header" type="tns:Header"/>
|
|
14
|
+
<xs:complexType name="Header">
|
|
15
|
+
<xs:sequence>
|
|
16
|
+
<xs:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax"/>
|
|
17
|
+
</xs:sequence>
|
|
18
|
+
<xs:anyAttribute namespace="##other" processContents="lax"/>
|
|
19
|
+
</xs:complexType>
|
|
20
|
+
<xs:element name="Body" type="tns:Body"/>
|
|
21
|
+
<xs:complexType name="Body">
|
|
22
|
+
<xs:sequence>
|
|
23
|
+
<xs:any namespace="##any" minOccurs="0" maxOccurs="unbounded" processContents="lax"/>
|
|
24
|
+
</xs:sequence>
|
|
25
|
+
<xs:anyAttribute namespace="##any" processContents="lax">
|
|
26
|
+
<xs:annotation>
|
|
27
|
+
<xs:documentation> Prose in the spec does not specify that attributes are allowed on the Body element </xs:documentation>
|
|
28
|
+
</xs:annotation>
|
|
29
|
+
</xs:anyAttribute>
|
|
30
|
+
</xs:complexType>
|
|
31
|
+
<!-- Global Attributes. The following attributes are intended to be usable via qualified attribute names on any complex type referencing them. -->
|
|
32
|
+
<xs:attribute name="mustUnderstand">
|
|
33
|
+
<xs:simpleType>
|
|
34
|
+
<xs:restriction base="xs:boolean">
|
|
35
|
+
<xs:pattern value="0|1"/>
|
|
36
|
+
</xs:restriction>
|
|
37
|
+
</xs:simpleType>
|
|
38
|
+
</xs:attribute>
|
|
39
|
+
<xs:attribute name="actor" type="xs:anyURI"/>
|
|
40
|
+
<xs:simpleType name="encodingStyle">
|
|
41
|
+
<xs:annotation>
|
|
42
|
+
<xs:documentation> 'encodingStyle' indicates any canonicalization conventions followed in the contents of the containing element. For example, the value 'http://schemas.xmlsoap.org/soap/encoding/' indicates the pattern described in SOAP specification </xs:documentation>
|
|
43
|
+
</xs:annotation>
|
|
44
|
+
<xs:list itemType="xs:anyURI"/>
|
|
45
|
+
</xs:simpleType>
|
|
46
|
+
<xs:attribute name="encodingStyle" type="tns:encodingStyle"/>
|
|
47
|
+
<xs:attributeGroup name="encodingStyle">
|
|
48
|
+
<xs:attribute ref="tns:encodingStyle"/>
|
|
49
|
+
</xs:attributeGroup>
|
|
50
|
+
<xs:element name="Fault" type="tns:Fault"/>
|
|
51
|
+
<xs:complexType name="Fault" final="extension">
|
|
52
|
+
<xs:annotation>
|
|
53
|
+
<xs:documentation> Fault reporting structure </xs:documentation>
|
|
54
|
+
</xs:annotation>
|
|
55
|
+
<xs:sequence>
|
|
56
|
+
<xs:element name="faultcode" type="xs:QName"/>
|
|
57
|
+
<xs:element name="faultstring" type="xs:string"/>
|
|
58
|
+
<xs:element name="faultactor" type="xs:anyURI" minOccurs="0"/>
|
|
59
|
+
<xs:element name="detail" type="tns:detail" minOccurs="0"/>
|
|
60
|
+
</xs:sequence>
|
|
61
|
+
</xs:complexType>
|
|
62
|
+
<xs:complexType name="detail">
|
|
63
|
+
<xs:sequence>
|
|
64
|
+
<xs:any namespace="##any" minOccurs="0" maxOccurs="unbounded" processContents="lax"/>
|
|
65
|
+
</xs:sequence>
|
|
66
|
+
<xs:anyAttribute namespace="##any" processContents="lax"/>
|
|
67
|
+
</xs:complexType>
|
|
68
|
+
</xs:schema>
|
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!-- DOCTYPE xs:schema PUBLIC "-//W3C//DTD XMLSCHEMA 200102//EN" "XMLSchema.dtd" -->
|
|
3
|
+
<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace"
|
|
4
|
+
xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
|
5
|
+
xml:lang="en">
|
|
6
|
+
|
|
7
|
+
<xs:annotation>
|
|
8
|
+
<xs:documentation>
|
|
9
|
+
See http://www.w3.org/XML/1998/namespace.html and
|
|
10
|
+
http://www.w3.org/TR/REC-xml for information about this namespace.
|
|
11
|
+
</xs:documentation>
|
|
12
|
+
</xs:annotation>
|
|
13
|
+
|
|
14
|
+
<xs:annotation>
|
|
15
|
+
<xs:documentation>
|
|
16
|
+
This schema defines attributes and an attribute group
|
|
17
|
+
suitable for use by schemas wishing to allow xml:base,
|
|
18
|
+
xml:lang or xml:space attributes on elements they define.
|
|
19
|
+
To enable this, such a schema must import this schema
|
|
20
|
+
for the XML namespace, e.g. as follows:
|
|
21
|
+
<schema . . .>
|
|
22
|
+
. . .
|
|
23
|
+
<import namespace="http://www.w3.org/XML/1998/namespace"
|
|
24
|
+
schemaLocation="http://www.w3.org/2001/03/xml.xsd"/>
|
|
25
|
+
|
|
26
|
+
Subsequently, qualified reference to any of the attributes
|
|
27
|
+
or the group defined below will have the desired effect, e.g.
|
|
28
|
+
|
|
29
|
+
<type . . .>
|
|
30
|
+
. . .
|
|
31
|
+
<attributeGroup ref="xml:specialAttrs"/>
|
|
32
|
+
|
|
33
|
+
will define a type which will schema-validate an instance
|
|
34
|
+
element with any of those attributes
|
|
35
|
+
</xs:documentation>
|
|
36
|
+
</xs:annotation>
|
|
37
|
+
|
|
38
|
+
<xs:annotation>
|
|
39
|
+
<xs:documentation>
|
|
40
|
+
In keeping with the XML Schema WG's standard versioning
|
|
41
|
+
policy, this schema document will persist at
|
|
42
|
+
http://www.w3.org/2001/03/xml.xsd.
|
|
43
|
+
At the date of issue it can also be found at
|
|
44
|
+
http://www.w3.org/2001/xml.xsd.
|
|
45
|
+
The schema document at that URI may however change in the future,
|
|
46
|
+
in order to remain compatible with the latest version of XML Schema
|
|
47
|
+
itself. In other words, if the XML Schema namespace changes, the version
|
|
48
|
+
of this document at
|
|
49
|
+
http://www.w3.org/2001/xml.xsd will change
|
|
50
|
+
accordingly; the version at
|
|
51
|
+
http://www.w3.org/2001/03/xml.xsd will not change.
|
|
52
|
+
</xs:documentation>
|
|
53
|
+
</xs:annotation>
|
|
54
|
+
|
|
55
|
+
<xs:attribute name="lang" type="xs:language">
|
|
56
|
+
<xs:annotation>
|
|
57
|
+
<xs:documentation>
|
|
58
|
+
In due course, we should install the relevant ISO 2- and 3-letter
|
|
59
|
+
codes as the enumerated possible values . . .
|
|
60
|
+
</xs:documentation>
|
|
61
|
+
</xs:annotation>
|
|
62
|
+
</xs:attribute>
|
|
63
|
+
|
|
64
|
+
<xs:attribute name="space" default="preserve">
|
|
65
|
+
<xs:simpleType>
|
|
66
|
+
<xs:restriction base="xs:NCName">
|
|
67
|
+
<xs:enumeration value="default"/>
|
|
68
|
+
<xs:enumeration value="preserve"/>
|
|
69
|
+
</xs:restriction>
|
|
70
|
+
</xs:simpleType>
|
|
71
|
+
</xs:attribute>
|
|
72
|
+
|
|
73
|
+
<xs:attribute name="base" type="xs:anyURI">
|
|
74
|
+
<xs:annotation>
|
|
75
|
+
<xs:documentation>
|
|
76
|
+
See http://www.w3.org/TR/xmlbase/ for
|
|
77
|
+
information about this attribute.
|
|
78
|
+
</xs:documentation>
|
|
79
|
+
</xs:annotation>
|
|
80
|
+
</xs:attribute>
|
|
81
|
+
|
|
82
|
+
<xs:attributeGroup name="specialAttrs">
|
|
83
|
+
<xs:attribute ref="xml:base"/>
|
|
84
|
+
<xs:attribute ref="xml:lang"/>
|
|
85
|
+
<xs:attribute ref="xml:space"/>
|
|
86
|
+
</xs:attributeGroup>
|
|
87
|
+
|
|
88
|
+
</xs:schema>
|
|
@@ -4,17 +4,35 @@ import * as path from 'node:path';
|
|
|
4
4
|
import { fileURLToPath } from 'node:url';
|
|
5
5
|
const __filename = fileURLToPath(import.meta.url);
|
|
6
6
|
const __dirname = path.dirname(__filename);
|
|
7
|
-
|
|
7
|
+
let obj = [
|
|
8
|
+
'soap-envelope.xsd',
|
|
9
|
+
'xml.xsd',
|
|
8
10
|
'saml-schema-protocol-2.0.xsd',
|
|
9
|
-
'datatypes.dtd',
|
|
10
11
|
'saml-schema-assertion-2.0.xsd',
|
|
11
12
|
'xmldsig-core-schema.xsd',
|
|
12
|
-
'XMLSchema.dtd',
|
|
13
13
|
'xenc-schema.xsd',
|
|
14
14
|
'saml-schema-metadata-2.0.xsd',
|
|
15
15
|
'saml-schema-ecp-2.0.xsd',
|
|
16
16
|
'saml-schema-dce-2.0.xsd'
|
|
17
17
|
];
|
|
18
|
+
let normal = [
|
|
19
|
+
'soap-envelope.xsd',
|
|
20
|
+
'xml.xsd',
|
|
21
|
+
// 2. SOAP核心模式(所有SOAP消息的基础)
|
|
22
|
+
// 3. XML签名模式(SAML签名的前置依赖)
|
|
23
|
+
'xmldsig-core-schema.xsd',
|
|
24
|
+
// 4. XML加密模式(SAML断言加密的前置依赖)
|
|
25
|
+
'xenc-schema.xsd',
|
|
26
|
+
// 5. SAML核心模式(最基础的SAML组件)
|
|
27
|
+
'saml-schema-assertion-2.0.xsd', // 断言定义
|
|
28
|
+
// 6. SAML协议模式(依赖断言模式)
|
|
29
|
+
'saml-schema-protocol-2.0.xsd',
|
|
30
|
+
// 7. SAML扩展模式(依赖核心模式)
|
|
31
|
+
'saml-schema-metadata-2.0.xsd', // 元数据
|
|
32
|
+
'saml-schema-ecp-2.0.xsd', // ECP扩展
|
|
33
|
+
'saml-schema-dce-2.0.xsd' // DCE扩展
|
|
34
|
+
];
|
|
35
|
+
const schemas = obj;
|
|
18
36
|
function detectXXEIndicators(samlString) {
|
|
19
37
|
const xxePatterns = [
|
|
20
38
|
/<!DOCTYPE\s[^>]*>/i,
|
|
@@ -44,7 +62,7 @@ export const validate = async (xml) => {
|
|
|
44
62
|
throw new Error('ERR_EXCEPTION_VALIDATE_XML');
|
|
45
63
|
}
|
|
46
64
|
const schemaPath = path.resolve(__dirname, 'schema');
|
|
47
|
-
const [
|
|
65
|
+
const [xmlParse, ...preload] = await Promise.all(schemas.map(async (file) => ({
|
|
48
66
|
fileName: file,
|
|
49
67
|
contents: await fs.promises.readFile(`${schemaPath}/${file}`, 'utf-8')
|
|
50
68
|
})));
|
|
@@ -57,16 +75,20 @@ export const validate = async (xml) => {
|
|
|
57
75
|
},
|
|
58
76
|
],
|
|
59
77
|
extension: 'schema',
|
|
60
|
-
schema: [
|
|
61
|
-
preload: preload
|
|
78
|
+
schema: [xmlParse],
|
|
79
|
+
preload: [xmlParse, ...preload],
|
|
62
80
|
});
|
|
63
81
|
if (validationResult.valid) {
|
|
82
|
+
console.log("---------------------验证通过--------------------");
|
|
83
|
+
console.log("---------------------验证通过--------------------");
|
|
64
84
|
return true;
|
|
65
85
|
}
|
|
86
|
+
console.log('-----------------------没验证通过-----------------------');
|
|
66
87
|
console.debug(validationResult);
|
|
67
88
|
throw validationResult.errors;
|
|
68
89
|
}
|
|
69
90
|
catch (error) {
|
|
91
|
+
console.log('-----------------------没验证通过error-----------------------');
|
|
70
92
|
console.error('[ERROR] validateXML', error);
|
|
71
93
|
throw new Error('ERR_EXCEPTION_VALIDATE_XML');
|
|
72
94
|
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
import axios from 'axios';
|
|
2
|
+
import https from 'node:https';
|
|
3
|
+
// 2. 配置 Axios 实例(处理自签名证书)
|
|
4
|
+
const axiosInstance = axios.create({
|
|
5
|
+
httpsAgent: new https.Agent({
|
|
6
|
+
rejectUnauthorized: false // 允许自签名证书
|
|
7
|
+
})
|
|
8
|
+
});
|
|
9
|
+
export async function sendArtifactResolve(url, soapRequest) {
|
|
10
|
+
try {
|
|
11
|
+
const response = await axiosInstance.post(url, soapRequest, {
|
|
12
|
+
headers: {
|
|
13
|
+
'Content-Type': 'application/soap+xml; charset=utf-8',
|
|
14
|
+
'SOAPAction': '"ArtifactResolve"'
|
|
15
|
+
},
|
|
16
|
+
timeout: 5000 // 5秒超时
|
|
17
|
+
});
|
|
18
|
+
console.log('✅ Resolve请求成功');
|
|
19
|
+
return response.data;
|
|
20
|
+
}
|
|
21
|
+
catch (error) {
|
|
22
|
+
console.error('❌ Resolve请求失败');
|
|
23
|
+
throw error.response.data;
|
|
24
|
+
}
|
|
25
|
+
}
|
package/build/src/urn.js
CHANGED
|
@@ -49,6 +49,7 @@ const namespace = {
|
|
|
49
49
|
post: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
|
|
50
50
|
simpleSign: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign',
|
|
51
51
|
artifact: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
|
|
52
|
+
soap: 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
|
|
52
53
|
},
|
|
53
54
|
names: {
|
|
54
55
|
protocol: 'urn:oasis:names:tc:SAML:2.0:protocol',
|
|
@@ -184,6 +185,7 @@ const wording = {
|
|
|
184
185
|
post: 'post',
|
|
185
186
|
simpleSign: 'simpleSign',
|
|
186
187
|
artifact: 'artifact',
|
|
188
|
+
soap: 'soap',
|
|
187
189
|
},
|
|
188
190
|
certUse: {
|
|
189
191
|
signing: 'signing',
|
|
@@ -197,8 +199,8 @@ const wording = {
|
|
|
197
199
|
// https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP
|
|
198
200
|
// some idps restrict the order of elements in entity descriptors
|
|
199
201
|
const elementsOrder = {
|
|
200
|
-
default: ['KeyDescriptor', 'NameIDFormat', 'SingleLogoutService', 'AssertionConsumerService', 'AttributeConsumingService'],
|
|
201
|
-
onelogin: ['KeyDescriptor', 'NameIDFormat', 'SingleLogoutService', 'AssertionConsumerService', 'AttributeConsumingService'],
|
|
202
|
-
shibboleth: ['KeyDescriptor', 'SingleLogoutService', 'NameIDFormat', 'AssertionConsumerService', 'AttributeConsumingService'],
|
|
202
|
+
default: ['KeyDescriptor', 'NameIDFormat', 'ArtifactResolutionService', 'SingleLogoutService', 'AssertionConsumerService', 'AttributeConsumingService'],
|
|
203
|
+
onelogin: ['KeyDescriptor', 'NameIDFormat', 'ArtifactResolutionService', 'SingleLogoutService', 'AssertionConsumerService', 'AttributeConsumingService'],
|
|
204
|
+
shibboleth: ['KeyDescriptor', 'ArtifactResolutionService', 'SingleLogoutService', 'NameIDFormat', 'AssertionConsumerService', 'AttributeConsumingService',],
|
|
203
205
|
};
|
|
204
206
|
export { namespace, tags, algorithms, wording, elementsOrder, messageConfigurations };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "samlesa",
|
|
3
|
-
"version": "2.16.
|
|
3
|
+
"version": "2.16.6",
|
|
4
4
|
"description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
|
|
5
5
|
"main": "build/index.js",
|
|
6
6
|
"keywords": [
|
|
@@ -43,6 +43,7 @@
|
|
|
43
43
|
"license": "MIT",
|
|
44
44
|
"dependencies": {
|
|
45
45
|
"@xmldom/xmldom": "^0.8.10",
|
|
46
|
+
"axios": "^1.10.0",
|
|
46
47
|
"camelcase": "^8.0.0",
|
|
47
48
|
"pako": "^2.1.0",
|
|
48
49
|
"uuid": "^11.1.0",
|
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* @file binding-post.ts
|
|
3
|
-
* @author tngan
|
|
4
|
-
* @desc Binding-level API, declare the functions using POST binding
|
|
5
|
-
*/
|
|
2
|
+
* @file binding-post.ts
|
|
3
|
+
* @author tngan
|
|
4
|
+
* @desc Binding-level API, declare the functions using POST binding
|
|
5
|
+
*/
|
|
6
6
|
import type { BindingContext } from './entity.js';
|
|
7
7
|
/**
|
|
8
|
-
* @desc Generate a base64 encoded login request
|
|
9
|
-
* @param {string} referenceTagXPath reference uri
|
|
10
|
-
* @param {object} entity object includes both idp and sp
|
|
11
|
-
* @param {function} customTagReplacement used when developers have their own login response template
|
|
12
|
-
*/
|
|
8
|
+
* @desc Generate a base64 encoded login request
|
|
9
|
+
* @param {string} referenceTagXPath reference uri
|
|
10
|
+
* @param {object} entity object includes both idp and sp
|
|
11
|
+
* @param {function} customTagReplacement used when developers have their own login response template
|
|
12
|
+
*/
|
|
13
13
|
declare function base64LoginRequest(referenceTagXPath: string, entity: any, customTagReplacement?: (template: string) => BindingContext): BindingContext;
|
|
14
14
|
/**
|
|
15
15
|
* @desc Generate a base64 encoded login response
|
|
@@ -22,27 +22,27 @@ declare function base64LoginRequest(referenceTagXPath: string, entity: any, cust
|
|
|
22
22
|
*/
|
|
23
23
|
declare function base64LoginResponse(requestInfo: any | undefined, entity: any, user?: any, customTagReplacement?: (template: string) => BindingContext, encryptThenSign?: boolean, AttributeStatement?: never[]): Promise<BindingContext>;
|
|
24
24
|
/**
|
|
25
|
-
* @desc Generate a base64 encoded logout request
|
|
26
|
-
* @param {object} user current logged user (e.g. req.user)
|
|
27
|
-
* @param {string} referenceTagXPath reference uri
|
|
28
|
-
* @param {object} entity object includes both idp and sp
|
|
29
|
-
* @param {function} customTagReplacement used when developers have their own login response template
|
|
30
|
-
* @return {string} base64 encoded request
|
|
31
|
-
*/
|
|
25
|
+
* @desc Generate a base64 encoded logout request
|
|
26
|
+
* @param {object} user current logged user (e.g. req.user)
|
|
27
|
+
* @param {string} referenceTagXPath reference uri
|
|
28
|
+
* @param {object} entity object includes both idp and sp
|
|
29
|
+
* @param {function} customTagReplacement used when developers have their own login response template
|
|
30
|
+
* @return {string} base64 encoded request
|
|
31
|
+
*/
|
|
32
32
|
declare function base64LogoutRequest(user: Record<string, unknown>, referenceTagXPath: string, entity: any, customTagReplacement?: (template: string) => BindingContext): BindingContext;
|
|
33
33
|
/**
|
|
34
|
-
* @desc Generate a base64 encoded logout response
|
|
35
|
-
* @param {object} requestInfo corresponding request, used to obtain the id
|
|
36
|
-
* @param {string} referenceTagXPath reference uri
|
|
37
|
-
* @param {object} entity object includes both idp and sp
|
|
38
|
-
* @param {function} customTagReplacement used when developers have their own login response template
|
|
39
|
-
*/
|
|
34
|
+
* @desc Generate a base64 encoded logout response
|
|
35
|
+
* @param {object} requestInfo corresponding request, used to obtain the id
|
|
36
|
+
* @param {string} referenceTagXPath reference uri
|
|
37
|
+
* @param {object} entity object includes both idp and sp
|
|
38
|
+
* @param {function} customTagReplacement used when developers have their own login response template
|
|
39
|
+
*/
|
|
40
40
|
declare function base64LogoutResponse(requestInfo: any, entity: any, customTagReplacement: (template: string) => BindingContext): BindingContext;
|
|
41
|
-
declare const
|
|
41
|
+
declare const artifactSignBinding: {
|
|
42
42
|
base64LoginRequest: typeof base64LoginRequest;
|
|
43
43
|
base64LoginResponse: typeof base64LoginResponse;
|
|
44
44
|
base64LogoutRequest: typeof base64LogoutRequest;
|
|
45
45
|
base64LogoutResponse: typeof base64LogoutResponse;
|
|
46
46
|
};
|
|
47
|
-
export default
|
|
48
|
-
//# sourceMappingURL=binding-
|
|
47
|
+
export default artifactSignBinding;
|
|
48
|
+
//# sourceMappingURL=binding-artifact.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"binding-artifact.d.ts","sourceRoot":"","sources":["../../src/binding-artifact.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD;;;;;GAKG;AACH,iBAAS,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,cAAc,CAqD/I;AACD;;;;;;;;GAQG;AACH,iBAAe,mBAAmB,CAAC,WAAW,EAAE,GAAG,YAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,EAAE,eAAe,GAAE,OAAe,EAAG,kBAAkB,UAAG,GAAG,OAAO,CAAC,cAAc,CAAC,CAmIrO;AACD;;;;;;;GAOG;AACH,iBAAS,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAC,MAAM,EAAE,MAAM,KAAA,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,cAAc,CAkDzK;AACD;;;;;;GAMG;AACH,iBAAS,oBAAoB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,cAAc,CAsDvI;AAED,QAAA,MAAM,mBAAmB;;;;;CAKxB,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
|
|
@@ -18,7 +18,19 @@ export interface BuildRedirectConfig {
|
|
|
18
18
|
declare function loginRequestRedirectURL(entity: {
|
|
19
19
|
idp: Idp;
|
|
20
20
|
sp: Sp;
|
|
21
|
-
|
|
21
|
+
soap?: Boolean;
|
|
22
|
+
}, customTagReplacement?: (template: string) => BindingContext): any;
|
|
23
|
+
/**
|
|
24
|
+
* @desc Redirect URL for login request
|
|
25
|
+
* @param {object} entity object includes both idp and sp
|
|
26
|
+
* @param {function} customTagReplacement used when developers have their own login response template
|
|
27
|
+
* @return {string} redirect URL
|
|
28
|
+
*/
|
|
29
|
+
declare function loginRequestRedirectURLArt(entity: {
|
|
30
|
+
idp: Idp;
|
|
31
|
+
sp: Sp;
|
|
32
|
+
inResponse?: string;
|
|
33
|
+
}, customTagReplacement?: (template: string) => BindingContext): any;
|
|
22
34
|
/**
|
|
23
35
|
* @desc Redirect URL for login response
|
|
24
36
|
* @param {object} requestInfo corresponding request, used to obtain the id
|
|
@@ -45,6 +57,7 @@ declare function logoutRequestRedirectURL(user: any, entity: any, relayState?: s
|
|
|
45
57
|
*/
|
|
46
58
|
declare function logoutResponseRedirectURL(requestInfo: any, entity: any, relayState?: string, customTagReplacement?: (template: string) => BindingContext): BindingContext;
|
|
47
59
|
declare const redirectBinding: {
|
|
60
|
+
loginRequestRedirectURLArt: typeof loginRequestRedirectURLArt;
|
|
48
61
|
loginRequestRedirectURL: typeof loginRequestRedirectURL;
|
|
49
62
|
loginResponseRedirectURL: typeof loginResponseRedirectURL;
|
|
50
63
|
logoutRequestRedirectURL: typeof logoutRequestRedirectURL;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binding-redirect.d.ts","sourceRoot":"","sources":["../../src/binding-redirect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAChD,OAAO,EAAC,gBAAgB,IAAI,GAAG,EAAC,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAC,eAAe,IAAI,EAAE,EAAC,MAAM,gBAAgB,CAAC;AAOrD,MAAM,WAAW,mBAAmB;
|
|
1
|
+
{"version":3,"file":"binding-redirect.d.ts","sourceRoot":"","sources":["../../src/binding-redirect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAChD,OAAO,EAAC,gBAAgB,IAAI,GAAG,EAAC,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAC,eAAe,IAAI,EAAE,EAAC,MAAM,gBAAgB,CAAC;AAOrD,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,GAAG,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAiED;;;;;GAKG;AAEH,iBAAS,uBAAuB,CAAC,MAAM,EAAE;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,CAAC,EAAE,OAAO,CAAA;CACjB,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,GAAG,CA0CnE;AACD;;;;;GAKG;AAEH,iBAAS,0BAA0B,CAAC,MAAM,EAAE;IACxC,GAAG,EAAE,GAAG,CAAC;IACT,EAAE,EAAE,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC9B,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,GAAG,CAgGnE;AAID;;;;;;;;GAQG;AACH,iBAAS,wBAAwB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,EAAE,kBAAkB,UAAK,GAAG,cAAc,CAoG1M;AAED;;;;;;GAMG;AACH,iBAAS,wBAAwB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,cAAc,GAAG,cAAc,CAwC9J;AAED;;;;;GAKG;AACH,iBAAS,yBAAyB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,cAAc,GAAG,cAAc,CAyClK;AAED,QAAA,MAAM,eAAe;;;;;;CAMpB,CAAC;AAEF,eAAe,eAAe,CAAC"}
|