samlesa 3.3.7 → 3.4.0

package/build/src/binding-artifact.js

@@ -9,7 +9,7 @@ import libsaml from './libsaml.js';
 import libsamlSoap from './libsamlSoap.js';
 import utility, { get } from './utility.js';
 import { fileURLToPath } from "node:url";
-import * as uuid from 'uuid';
+import { randomUUID } from 'node:crypto';
 import { artifactResolveFields, extract, loginRequestFields, loginResponseFields, logoutRequestFields, logoutResponseFields } from "./extractor.js";
 import { verifyTime } from "./validator.js";
 import { sendArtifactResolve } from "./soap.js";
@@ -328,7 +328,7 @@ async function parseLoginResponseResolve(params) {
     let extractorFields = [];
     let samlContent = '';
     const spSetting = sp.entitySetting;
-    let ID = '_' + uuid.v4();
+    let ID = '_' + randomUUID();
     let url = metadata.idp.getArtifactResolutionService('soap');
     let samlSoapRaw = libsaml.replaceTagsByValue(libsaml.defaultArtifactResolveTemplate.context, {
         ID: ID,

package/build/src/binding-post.js

@@ -106,7 +106,7 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
         const now = nowTime.toISOString();
         const acl = metadata.sp.getAssertionConsumerService(binding.post);
         // @ts-ignore
-        const sessionID = idpSetting?.generateID() ?? `${randomUUID()}`;
+        const sessionID = idpSetting?.generateID() ?? `_${randomUUID()}`;
         const sessionIndex = 'session' + sessionID; // 这个是当前系统的会话索引，用于单点注销
         const tenHoursLaterTime = new Date(nowTime.getTime());
         tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
@@ -159,6 +159,7 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
         };
         // step: sign assertion ? -> encrypted ? -> sign message ?
         if (metadata.sp.isWantAssertionsSigned()) {
+            // console.debug('sp wants assertion signed');
             // @ts-ignore
             rawSamlResponse = libsaml.constructSAMLSignature({
                 ...config,
@@ -167,10 +168,7 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
                 referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
                 signatureConfig: {
                     prefix: 'ds',
-                    location: {
-                        reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']",
-                        action: 'after'
-                    },
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
                 },
             });
         }
@@ -190,19 +188,6 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
                 },
             });
         }
-        /*    if (spSetting.wantMessageSigned) {
-              // console.debug('sign then encrypt and sign entire message');
-              rawSamlResponse = libsaml.constructSAMLSignature({
-                ...config,
-                rawSamlMessage: rawSamlResponse,
-                isMessageSigned: true,
-                transformationAlgorithms: spSetting.transformationAlgorithms,
-                signatureConfig: spSetting.signatureConfig || {
-                  prefix: 'ds',
-                  location: {reference: "/!*[local-name(.)='Response']/!*[local-name(.)='Issuer']", action: 'after'},
-                },
-              });
-            }*/
         if (idpSetting.isAssertionEncrypted) {
             // console.debug('idp is configured to do encryption');
             const context = await libsaml.encryptAssertion(entity.idp, entity.sp, rawSamlResponse);
@@ -215,18 +200,22 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
             }
         }
         //sign after encrypting
-        /*    if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
-              rawSamlResponse = libsaml.constructSAMLSignature({
+        /*       console.log(encryptThenSign)
+               console.log(encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned()))
+               console.log("结果====================")*/
+        if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
+            rawSamlResponse = libsaml.constructSAMLSignature({
                 ...config,
                 rawSamlMessage: rawSamlResponse,
                 isMessageSigned: true,
                 transformationAlgorithms: spSetting.transformationAlgorithms,
+                // @ts-ignore
                 signatureConfig: spSetting.signatureConfig || {
-                  prefix: 'ds',
-                  location: {reference: "/!*[local-name(.)='Response']/!*[local-name(.)='Issuer']", action: 'after'},
+                    prefix: 'ds',
+                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
                 },
-              });
-            }*/
+            });
+        }
         return Promise.resolve({
             id,
             context: utility.base64Encode(rawSamlResponse),

package/build/src/entity.js

@@ -5,7 +5,7 @@
 */
 import { isString, isNonEmptyArray } from './utility.js';
 import { namespace, wording, algorithms, messageConfigurations } from './urn.js';
-import * as uuid from 'uuid';
+import { randomUUID } from 'node:crypto';
 import IdpMetadata from './metadata-idp.js';
 import SpMetadata from './metadata-sp.js';
 import redirectBinding from './binding-redirect.js';
@@ -24,7 +24,7 @@ const defaultEntitySetting = {
     requestSignatureAlgorithm: signatureAlgorithms.RSA_SHA512,
     dataEncryptionAlgorithm: dataEncryptionAlgorithm.AES_256_GCM,
     keyEncryptionAlgorithm: keyEncryptionAlgorithm.RSA_OAEP_MGF1P,
-    generateID: () => ('_' + uuid.v4()),
+    generateID: () => ('_' + randomUUID()),
     relayState: '',
 };
 export default class Entity {