samlesa 3.4.1 → 3.4.3

package/build/src/binding-artifact.js

@@ -5,11 +5,13 @@
  */
 import { checkStatus } from "./flow.js";
 import { ParserType, StatusCode, wording } from './urn.js';
+import * as crypto from "node:crypto";
 import libsaml from './libsaml.js';
 import libsamlSoap from './libsamlSoap.js';
 import utility, { get } from './utility.js';
 import { fileURLToPath } from "node:url";
 import { randomUUID } from 'node:crypto';
+import postBinding from './binding-post.js';
 import { artifactResolveFields, extract, loginRequestFields, loginResponseFields, logoutRequestFields, logoutResponseFields } from "./extractor.js";
 import { verifyTime } from "./validator.js";
 import { sendArtifactResolve } from "./soap.js";
@@ -137,141 +139,111 @@ function soapLoginRequest(referenceTagXPath, entity, customTagReplacement) {
     throw new Error('ERR_GENERATE_POST_LOGIN_REQUEST_MISSING_METADATA');
 }
 /**
- * @desc Generate a base64 encoded login response
- * @param  {object} requestInfo                 corresponding request, used to obtain the id
- * @param  {object} entity                      object includes both idp and sp
- * @param  {object} user                        current logged user (e.g. req.user)
- * @param  {function} customTagReplacement     used when developers have their own login response template
- * @param  {boolean}  encryptThenSign           whether or not to encrypt then sign first (if signing). Defaults to sign-then-encrypt
- * @param AttributeStatement
+ * Generates a SAML 2.0 compliant Artifact ID.
+ * Format: [4-byte source ID][2-byte endpoint index][20-byte sequence value]
+ * @param issuerId The entity ID of the issuing party (IdP).
+ * @param endpointIndex The index of the destination endpoint (default is '0004' for Artifact Resolution Service).
+ * @returns The Base64 encoded Artifact ID string.
  */
-async function soapLoginResponse(requestInfo = {}, entity, user = {}, customTagReplacement, encryptThenSign = false, AttributeStatement = []) {
-    const idpSetting = entity.idp.entitySetting;
-    const spSetting = entity.sp.entitySetting;
-    const id = idpSetting.generateID();
+/**
+ * 生成符合 SAML 2.0 规范的 Artifact
+ * 结构: [TypeCode: 2 bytes] + [EndpointIndex: 2 bytes] + [SourceID: 20 bytes] + [MessageHandle: 20 bytes]
+ */
+function generateArtifactId(issuerId, endpointIndex = 1) {
+    // 1. SourceID: 20 bytes SHA-1
+    const issuerHash = crypto.createHash('sha1').update(issuerId).digest();
+    const sourceId = issuerHash.subarray(0, 20); // 必须 20 字节
+    // 2. TypeCode: 0x0004
+    const typeCode = Buffer.from([0x00, 0x04]);
+    // 3. EndpointIndex: 2 bytes Big Endian
+    const indexBuffer = Buffer.alloc(2);
+    indexBuffer.writeUInt16BE(endpointIndex, 0);
+    // 4. MessageHandle: 20 random bytes
+    const messageHandle = crypto.randomBytes(20);
+    // 5. Concat: 2 + 2 + 20 + 20 = 44 bytes
+    const artifactBytes = Buffer.concat([typeCode, indexBuffer, sourceId, messageHandle]);
+    // 6. Base64
+    return artifactBytes.toString('base64');
+}
+// Initial response that sends only the artifact ID
+async function soapLoginResponse(params) {
+    const { entity } = params;
     const metadata = {
         idp: entity.idp.entityMeta,
         sp: entity.sp.entityMeta,
     };
-    const nameIDFormat = idpSetting.nameIDFormat;
-    const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
-    if (metadata && metadata.idp && metadata.sp) {
-        const base = metadata.sp.getAssertionConsumerService(binding.post);
-        let rawSamlResponse;
-        const nowTime = new Date();
-        const spEntityID = metadata.sp.getEntityID();
-        const oneMinutesLaterTime = new Date(nowTime.getTime());
-        oneMinutesLaterTime.setMinutes(oneMinutesLaterTime.getMinutes() + 5);
-        const OneMinutesLater = oneMinutesLaterTime.toISOString();
-        const now = nowTime.toISOString();
-        const acl = metadata.sp.getAssertionConsumerService(binding.post);
-        const sessionIndex = 'session' + idpSetting.generateID(); // 这个是当前系统的会话索引，用于单点注销
-        const tenHoursLaterTime = new Date(nowTime.getTime());
-        tenHoursLaterTime.setHours(tenHoursLaterTime.getHours() + 10);
-        const tenHoursLater = tenHoursLaterTime.toISOString();
-        const tvalue = {
-            ID: id,
-            AssertionID: idpSetting.generateID(),
-            Destination: base,
-            Audience: spEntityID,
-            EntityID: spEntityID,
-            SubjectRecipient: acl,
-            Issuer: metadata.idp.getEntityID(),
-            IssueInstant: now,
-            AssertionConsumerServiceURL: acl,
-            StatusCode: StatusCode.Success,
-            // can be customized
-            ConditionsNotBefore: now,
-            ConditionsNotOnOrAfter: OneMinutesLater,
-            SubjectConfirmationDataNotOnOrAfter: OneMinutesLater,
-            NameIDFormat: selectedNameIDFormat,
-            NameID: user?.NameID || '',
-            InResponseTo: get(requestInfo, 'extract.request.id', ''),
-            AuthnStatement: `<saml:AuthnStatement AuthnInstant="${now}" SessionNotOnOrAfter="${tenHoursLater}" SessionIndex="${sessionIndex}"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>`,
-            AttributeStatement: libsaml.attributeStatementBuilder(AttributeStatement),
-        };
-        if (idpSetting.loginResponseTemplate && customTagReplacement) {
-            const template = customTagReplacement(idpSetting.loginResponseTemplate.context);
-            rawSamlResponse = get(template, 'context', null);
-        }
-        else {
-            if (requestInfo !== null) {
-                tvalue.InResponseTo = requestInfo?.extract?.request?.id ?? '';
-            }
-            rawSamlResponse = libsaml.replaceTagsByValue(libsaml.defaultLoginResponseTemplate.context, tvalue);
-        }
-        const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm } = idpSetting;
-        const config = {
-            privateKey,
-            privateKeyPass,
-            signatureAlgorithm,
-            signingCert: metadata.idp.getX509Certificate('signing'),
-            isBase64Output: false,
-        };
-        // step: sign assertion ? -> encrypted ? -> sign message ?
-        if (metadata.sp.isWantAssertionsSigned()) {
-            rawSamlResponse = libsaml.constructSAMLSignature({
-                ...config,
-                rawSamlMessage: rawSamlResponse,
-                transformationAlgorithms: spSetting.transformationAlgorithms,
-                referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']",
-                signatureConfig: {
-                    prefix: 'ds',
-                    location: {
-                        reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']",
-                        action: 'after'
-                    },
-                },
-            });
-        }
-        // console.debug('after assertion signed', rawSamlResponse);
-        // SAML response must be signed sign message first, then encrypt
-        if (!encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
-            // console.debug('sign then encrypt and sign entire message');
-            // @ts-ignore
-            rawSamlResponse = libsaml.constructSAMLSignature({
-                ...config,
-                rawSamlMessage: rawSamlResponse,
-                isMessageSigned: true,
-                transformationAlgorithms: spSetting.transformationAlgorithms,
-                signatureConfig: spSetting.signatureConfig || {
-                    prefix: 'ds',
-                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
-                },
-            });
-        }
-        // console.debug('after message signed', rawSamlResponse);
-        if (idpSetting.isAssertionEncrypted) {
-            // console.debug('idp is configured to do encryption');
-            const context = await libsaml.encryptAssertion(entity.idp, entity.sp, rawSamlResponse);
-            if (encryptThenSign) {
-                //need to decode it
-                rawSamlResponse = utility.base64Decode(context);
-            }
-            else {
-                return Promise.resolve({ id, context });
-            }
-        }
-        //sign after encrypting
-        if (encryptThenSign && (spSetting.wantMessageSigned || !metadata.sp.isWantAssertionsSigned())) {
-            // @ts-ignore
-            rawSamlResponse = libsaml.constructSAMLSignature({
-                ...config,
-                rawSamlMessage: rawSamlResponse,
-                isMessageSigned: true,
-                transformationAlgorithms: spSetting.transformationAlgorithms,
-                signatureConfig: spSetting.signatureConfig || {
-                    prefix: 'ds',
-                    location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
-                },
-            });
-        }
-        return Promise.resolve({
-            id,
-            context: utility.base64Encode(rawSamlResponse),
-        });
+    if (!metadata.idp || !metadata.sp) {
+        throw new Error('ERR_GENERATE_ARTIFACT_MISSING_METADATA');
     }
-    throw new Error('ERR_GENERATE_POST_LOGIN_RESPONSE_MISSING_METADATA');
+    // 1. Generate the base SAML Response (Base64 encoded)
+    const samlResponseResult = await postBinding.base64LoginResponse(params);
+    const samlResponseXml = utility.base64Decode(samlResponseResult.context);
+    console.log(samlResponseXml);
+    console.log("我日你妈==");
+    // 2. Generate the SAML 2.0 Artifact ID
+    const artifactId = generateArtifactId(metadata.idp.getEntityID());
+    // 3. Cache the SAML Response XML using the artifactId as the key
+    // TODO: Implement your Redis caching logic here
+    // Example:
+    // const redisExpirySeconds = 300; // e.g., expire after 5 minutes
+    // await redis.setex(`artifact_cache:${artifactId}`, redisExpirySeconds, samlResponseXml);
+    // --- INSERT YOUR REDIS LOGIC HERE ---
+    // Example: await cacheInRedis(artifactId, samlResponseXml);
+    // 4. Prepare config for SOAP signing (reusing IDP settings)
+    const idpSetting = entity.idp.entitySetting;
+    const spSetting = entity.sp.entitySetting;
+    const config = {
+        privateKey: idpSetting.privateKey,
+        privateKeyPass: idpSetting.privateKeyPass,
+        signatureAlgorithm: idpSetting.requestSignatureAlgorithm,
+        signingCert: metadata.idp.getX509Certificate('signing'),
+        isBase64Output: false,
+    };
+    // 5. Construct the SOAP Envelope containing the Artifact ID
+    // This is CORRECT - in the initial response we only send the artifact ID
+    // The actual SAML response will be retrieved by the SP using the artifact resolution service
+    const soapBodyContent = `<samlp:ArtifactResponse
+                     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+                                  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+                                  ID="${samlResponseResult.id}_artifact_resp"
+                                  InResponseTo="${params.requestInfo?.extract?.request?.id || ''}"
+                                  Version="2.0"
+                                  IssueInstant="${new Date().toISOString()}">
+                                       <saml2:Issuer>${metadata.idp.getEntityID()}</saml2:Issuer>
+        <samlp:Status>
+            <samlp:StatusCode Value="${StatusCode.Success}"/>
+        </samlp:Status>
+       ${samlResponseXml}
+    </samlp:ArtifactResponse>`;
+    const soapEnvelope = `
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+    <soap:Header/>
+    <soap:Body>${soapBodyContent}</soap:Body>
+</soap:Envelope>`;
+    // 6. Sign the SOAP Envelope
+    // Reference the Body element for signature
+    // @ts-ignore
+    // @ts-ignore
+    const signedSoapEnvelope = libsaml.constructSAMLSignature({
+        ...config,
+        rawSamlMessage: soapEnvelope,
+        transformationAlgorithms: spSetting.transformationAlgorithms,
+        isMessageSigned: true,
+        referenceTagXPath: "/*[local-name(.)='Envelope']/*[local-name(.)='Body']/*[local-name(.)='ArtifactResponse']",
+        signatureConfig: {
+            prefix: 'ds',
+            location: {
+                // Place signature inside the ArtifactResponse element, before the Status element
+                reference: "/*[local-name(.)='Envelope']/*[local-name(.)='Body']/*[local-name(.)='ArtifactResponse']/*[local-name(.)='Status']",
+                action: 'before'
+            },
+        },
+    });
+    // 7. Return the Artifact ID and the Base64 encoded signed SOAP message
+    return {
+        id: artifactId, // This is the key you'll need for resolving the artifact later
+        context: utility.base64Encode(signedSoapEnvelope), // The SOAP message to send back
+    };
 }
 async function parseLoginRequestResolve(params) {
     let { idp, sp, xml, } = params;

package/build/src/entity-idp.js

@@ -10,6 +10,7 @@ import { namespace } from './urn.js';
 import postBinding from './binding-post.js';
 import redirectBinding from './binding-redirect.js';
 import simpleSignBinding from './binding-simplesign.js';
+import artifactBinding from './binding-artifact.js';
 import { flow } from './flow.js';
 /**
  * Identity provider can be configured using either metadata importing or idpSetting
@@ -36,7 +37,7 @@ export class IdentityProvider extends Entity {
      * @param params
      */
     async createLoginResponse(params) {
-        const bindType = params?.binding ?? 'post';
+        const bindType = (params?.binding ?? 'post');
         const { sp, requestInfo = {}, user = {}, customTagReplacement, encryptThenSign = false, relayState = '', AttributeStatement = [], idpInit = false, } = params;
         const protocol = namespace.binding[bindType];
         // can support post, redirect and post simple sign bindings for login response
@@ -66,6 +67,19 @@ export class IdentityProvider extends Entity {
                     idp: this,
                     sp,
                 }, user, relayState, customTagReplacement, AttributeStatement);
+            case namespace.binding.artifact:
+                return artifactBinding.soapLoginResponse({
+                    requestInfo,
+                    entity: {
+                        idp: this,
+                        sp,
+                    },
+                    user,
+                    customTagReplacement,
+                    encryptThenSign,
+                    AttributeStatement,
+                    idpInit,
+                });
             default:
                 throw new Error('ERR_CREATE_RESPONSE_UNDEFINED_BINDING');
         }

package/build/src/extractor.js

@@ -2,6 +2,13 @@ import { select } from 'xpath';
 import { uniq, last, zipObject, notEmpty } from './utility.js'; // 假设这些工具函数存在
 import { getContext } from './api.js'; // 假设这个API存在
 import camelCase from 'camelcase';
+function toNodeArray(result) {
+    if (Array.isArray(result))
+        return result;
+    if (result != null && typeof result === 'object' && 'nodeType' in result)
+        return [result];
+    return [];
+}
 function buildAbsoluteXPath(paths) {
     if (!paths || paths.length === 0)
         return '';
@@ -110,10 +117,27 @@ export const loginRequestFields = [
     { key: 'signature', localPath: ['AuthnRequest', 'Signature'], attributes: [], context: true }
 ];
 export const artifactResolveFields = [
-    { key: 'request', localPath: ['ArtifactResolve'], attributes: ['ID', 'IssueInstant', 'Version'] },
-    { key: 'issuer', localPath: ['ArtifactResolve', 'Issuer'], attributes: [] },
-    { key: 'Artifact', localPath: ['ArtifactResolve', 'Artifact'], attributes: [] },
-    { key: 'signature', localPath: ['ArtifactResolve', 'Signature'], attributes: [], context: true },
+    {
+        key: 'request',
+        localPath: ['Envelope', 'Body', 'ArtifactResolve'],
+        attributes: ['ID', 'IssueInstant', 'Version', 'Destination']
+    },
+    {
+        key: 'issuer',
+        localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Issuer'],
+        attributes: []
+    },
+    {
+        key: 'artifact',
+        localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Artifact'],
+        attributes: []
+    },
+    {
+        key: 'signature',
+        localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Signature'],
+        attributes: [],
+        context: true
+    },
 ];
 export const artifactResponseFields = [
     { key: 'request', localPath: ['Envelope', 'Body', 'ArtifactResolve'], attributes: ['ID', 'IssueInstant', 'Version'] },
@@ -693,7 +717,7 @@ export function extract(context, fields) {
             }
             try {
                 // @ts-ignore
-                const nodes = select(fullXPath, targetDoc);
+                const nodes = toNodeArray(select(fullXPath, targetDoc));
                 if (isKeyName) {
                     const keyNames = nodes.map((n) => n.nodeValue).filter(notEmpty);
                     return {
@@ -721,7 +745,7 @@ export function extract(context, fields) {
         if (Array.isArray(localPath) && localPath.length > 0 && Array.isArray(localPath[0])) {
             const multiXPaths = localPath.map(path => `${buildAbsoluteXPath(path)}/text()`).join(' | ');
             // @ts-ignore
-            const nodes = select(multiXPaths, targetDoc);
+            const nodes = toNodeArray(select(multiXPaths, targetDoc));
             return {
                 ...result,
                 [key]: uniq(nodes.map((n) => n.nodeValue).filter(notEmpty))
@@ -738,7 +762,7 @@ export function extract(context, fields) {
         // --- 新增：列表模式处理 (用于 SSO Service, ACS 等) ---
         if (listMode && attributes.length > 0) {
             // @ts-ignore
-            const nodes = select(baseXPath, targetDoc);
+            const nodes = toNodeArray(select(baseXPath, targetDoc));
             const resultList = nodes.map((node) => {
                 const attrResult = {};
                 attributes.forEach(attr => {
@@ -762,7 +786,7 @@ export function extract(context, fields) {
             const indexPath = buildAttributeXPath(index);
             const fullLocalXPath = `${baseXPath}${indexPath}`;
             // @ts-ignore
-            const parentNodes = select(baseXPath, targetDoc);
+            const parentNodes = toNodeArray(select(baseXPath, targetDoc));
             // @ts-ignore
             const parentAttributes = select(fullLocalXPath, targetDoc).map((n) => n.value);
             const childXPath = buildAbsoluteXPath([last(currentLocalPath)].concat(attributePath));
@@ -788,7 +812,7 @@ export function extract(context, fields) {
         // 特殊 case: 获取整个节点内容 (原有逻辑)
         if (isEntire) {
             // @ts-ignore
-            const node = select(baseXPath, targetDoc);
+            const node = toNodeArray(select(baseXPath, targetDoc));
             let value = null;
             if (node.length === 1) {
                 value = node[0].toString();
@@ -829,7 +853,7 @@ export function extract(context, fields) {
         if (attributes.length === 0 && !listMode) {
             let attributeValue = null;
             // @ts-ignore
-            const node = select(baseXPath, targetDoc);
+            const node = toNodeArray(select(baseXPath, targetDoc));
             if (node.length === 1) {
                 const fullPath = `string(${baseXPath}${attributeXPath})`;
                 // @ts-ignore
@@ -1258,7 +1282,7 @@ export function extractSpToll(context, fields) {
             }
             try {
                 // @ts-ignore
-                const nodes = select(fullXPath, targetDoc);
+                const nodes = toNodeArray(select(fullXPath, targetDoc));
                 if (isKeyName) {
                     const keyNames = nodes.map((n) => n.nodeValue).filter(notEmpty);
                     return { ...result, [key]: keyNames.length > 0 ? keyNames[0] : null };
@@ -1280,7 +1304,7 @@ export function extractSpToll(context, fields) {
             const multiXPaths = localPath.map(path => `${buildAbsoluteXPath(path)}/text()`).join(' | ');
             try {
                 // @ts-ignore
-                const nodes = select(multiXPaths, targetDoc);
+                const nodes = toNodeArray(select(multiXPaths, targetDoc));
                 return { ...result, [key]: uniq(nodes.map((n) => n.nodeValue).filter(notEmpty)) };
             }
             catch (e) {
@@ -1296,7 +1320,7 @@ export function extractSpToll(context, fields) {
         if (listMode) {
             try {
                 // @ts-ignore
-                const nodes = select(baseXPath, targetDoc);
+                const nodes = toNodeArray(select(baseXPath, targetDoc));
                 if (parseCallback) {
                     // 使用自定义回调函数处理列表
                     return { ...result, [key]: parseCallback(nodes) };
@@ -1337,7 +1361,7 @@ export function extractSpToll(context, fields) {
                 const indexPath = buildAttributeXPath(index);
                 const fullLocalXPath = `${baseXPath}${indexPath}`;
                 // @ts-ignore
-                const parentNodes = select(baseXPath, targetDoc);
+                const parentNodes = toNodeArray(select(baseXPath, targetDoc));
                 // @ts-ignore
                 const parentAttributes = select(fullLocalXPath, targetDoc).map((n) => n.value);
                 const childXPath = buildAbsoluteXPath([last(currentLocalPath)].concat(attributePath));
@@ -1376,7 +1400,7 @@ export function extractSpToll(context, fields) {
         if (isEntire) {
             try {
                 // @ts-ignore
-                const node = select(baseXPath, targetDoc);
+                const node = toNodeArray(select(baseXPath, targetDoc));
                 let value = null;
                 if (node.length === 1) {
                     value = node[0].toString();
@@ -1399,7 +1423,7 @@ export function extractSpToll(context, fields) {
         if (attributes.length > 1 && !listMode) {
             try {
                 // @ts-ignore
-                const baseNodeList = select(baseXPath, targetDoc);
+                const baseNodeList = toNodeArray(select(baseXPath, targetDoc));
                 if (baseNodeList.length === 0)
                     return { ...result, [key]: null };
                 const attributeValues = baseNodeList.map((node) => {
@@ -1438,7 +1462,7 @@ export function extractSpToll(context, fields) {
         if (attributes.length === 0 && !listMode) {
             try {
                 // @ts-ignore
-                const node = select(baseXPath, targetDoc);
+                const node = toNodeArray(select(baseXPath, targetDoc));
                 if (parseCallback) {
                     // 使用自定义回调函数处理单个节点
                     return { ...result, [key]: parseCallback(node[0]) };
@@ -1447,7 +1471,7 @@ export function extractSpToll(context, fields) {
                 if (node.length === 1) {
                     const fullPath = `string(${baseXPath})`;
                     // @ts-ignore
-                    attributeValue = select(fullPath, targetDoc);
+                    attributeValue = toNodeArray(select(fullPath, targetDoc));
                 }
                 if (node.length > 1) {
                     attributeValue = node.filter((n) => n.firstChild)
@@ -1480,6 +1504,9 @@ export function extractSp(context) {
 export function extractAuthRequest(context) {
     return extract(context, loginRequestFields);
 }
-export function extractResponse(context, ass) {
+export function extractResponse(context) {
     return extractSpToll(context, loginResponseFieldsFullList);
 }
+export function extractArtifactResolve(context) {
+    return extract(context, artifactResolveFields);
+}