samlesa 3.5.0 → 4.1.0

package/build/index.js

@@ -13,6 +13,8 @@ import * as Soap from './src/soap.js';
 import { validate, validateMetadata } from './src/schemaValidator.js';
 // exposed methods for customizing samlify
 import { setSchemaValidator, setDOMParserOptions } from './src/api.js';
+// SAML 2.0 enhancements
+export * from './src/saml2-enhancements.js';
 export { Constants, Extractor, 
 // temp: resolve the conflict after version >= 3.0
 IdentityProvider, IdentityProviderInstance, ServiceProvider, ServiceProviderInstance, 

package/build/src/binding-artifact.js

@@ -15,6 +15,7 @@ import postBinding from './binding-post.js';
 import { artifactResolveFields, extract, loginRequestFields, loginResponseFields, logoutRequestFields, logoutResponseFields } from "./extractor.js";
 import { verifyTime } from "./validator.js";
 import { sendArtifactResolve } from "./soap.js";
+import { applyAuthnRequestEnhancements } from './saml2-enhancements-integration.js';
 const binding = wording.binding;
 /**
  * Get default extractor fields based on parser type
@@ -99,6 +100,10 @@ function soapLoginRequest(referenceTagXPath, entity, customTagReplacement) {
                 NameIDFormat: selectedNameIDFormat
             });
         }
+        // 应用 AuthnRequest 增强功能
+        if (spSetting.authnRequestEnhancements) {
+            rawSamlRequest = applyAuthnRequestEnhancements(rawSamlRequest, spSetting.authnRequestEnhancements);
+        }
         const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = spSetting;
         let signedAuthnRequest;
         if (metadata.idp.isWantAuthnRequestsSigned()) {

package/build/src/binding-post.js

@@ -1,12 +1,12 @@
 /**
  * @file binding-post.ts
- * @author tngan
  * @desc Binding-level API, declare the functions using POST binding
  */
 import { wording, namespace, StatusCode } from './urn.js';
 import { randomUUID } from 'node:crypto';
 import libsaml from './libsaml.js';
 import utility, { get } from './utility.js';
+import { applyAuthnRequestEnhancements } from './saml2-enhancements-integration.js';
 const binding = wording.binding;
 /**
  * @desc Generate a base64 encoded login request
@@ -41,6 +41,10 @@ function base64LoginRequest(referenceTagXPath, entity, customTagReplacement) {
                 NameIDFormat: selectedNameIDFormat
             });
         }
+        // 应用 AuthnRequest 增强功能（包括 ForceAuthn, IsPassive, Consent, ProviderName 等）
+        if (spSetting.authnRequestEnhancements) {
+            rawSamlRequest = applyAuthnRequestEnhancements(rawSamlRequest, spSetting.authnRequestEnhancements);
+        }
         if (metadata.idp.isWantAuthnRequestsSigned()) {
             const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = spSetting;
             return {

package/build/src/binding-redirect.js

@@ -6,6 +6,7 @@
 import utility, { get } from './utility.js';
 import libsaml from './libsaml.js';
 import { namespace, wording } from './urn.js';
+import { applyAuthnRequestEnhancements } from './saml2-enhancements-integration.js';
 const binding = wording.binding;
 const urlParams = wording.urlParams;
 /**
@@ -87,6 +88,10 @@ function loginRequestRedirectURL(entity, customTagReplacement) {
                 AllowCreate: spSetting.allowCreate,
             });
         }
+        // 应用 AuthnRequest 增强功能（包括 ForceAuthn, IsPassive, Consent, ProviderName 等）
+        if (spSetting.authnRequestEnhancements) {
+            rawSamlRequest = applyAuthnRequestEnhancements(rawSamlRequest, spSetting.authnRequestEnhancements);
+        }
         return {
             id,
             context: buildRedirectURL({
@@ -124,6 +129,12 @@ function loginRequestRedirectURLArt(entity, customTagReplacement) {
             const nameIDFormat = spSetting.nameIDFormat;
             const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : nameIDFormat;
             id = spSetting.generateID();
+            // 构建 AuthnRequest 增强属性
+            const authnEnhancements = spSetting.authnRequestEnhancements || {};
+            const forceAuthn = authnEnhancements.forceAuthn !== undefined ? String(authnEnhancements.forceAuthn) : '';
+            const isPassive = authnEnhancements.isPassive !== undefined ? String(authnEnhancements.isPassive) : '';
+            const consent = authnEnhancements.consent || '';
+            const providerName = authnEnhancements.providerName || '';
             rawSamlRequest = libsaml.replaceTagsByValue(libsaml.defaultLoginRequestTemplate.context, {
                 ID: id,
                 Destination: base,
@@ -133,6 +144,10 @@ function loginRequestRedirectURLArt(entity, customTagReplacement) {
                 AssertionConsumerServiceURL: metadata.sp.getAssertionConsumerService(binding.post),
                 EntityID: metadata.sp.getEntityID(),
                 AllowCreate: spSetting.allowCreate,
+                ForceAuthn: forceAuthn,
+                IsPassive: isPassive,
+                Consent: consent,
+                ProviderName: providerName
             });
         }
         const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms } = spSetting;

package/build/src/libsaml.js

@@ -5,7 +5,7 @@
  */
 import { X509Certificate } from 'node:crypto';
 import xml from 'xml';
-import utility, { flattenDeep, inflateString, isString } from './utility.js';
+import utility, { inflateString, isString, normalizeCertificates } from './utility.js';
 ;
 import * as crypto from 'node:crypto';
 import { algorithms, namespace, wording } from './urn.js';
@@ -524,13 +524,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     else if (opts.metadata) {
                         const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
                         let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                        if (Array.isArray(metadataCert)) {
-                            metadataCert = flattenDeep(metadataCert);
-                        }
-                        else if (typeof metadataCert === 'string') {
-                            metadataCert = [metadataCert];
-                        }
-                        metadataCert = metadataCert.map(utility.normalizeCerString);
+                        metadataCert = normalizeCertificates(metadataCert);
                         if (certificateNode.length === 0 && metadataCert.length === 0) {
                             throw new Error('NO_SELECTED_CERTIFICATE');
                         }
@@ -581,13 +575,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 else if (opts.metadata) {
                     const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
                     let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    if (Array.isArray(metadataCert)) {
-                        metadataCert = flattenDeep(metadataCert);
-                    }
-                    else if (typeof metadataCert === 'string') {
-                        metadataCert = [metadataCert];
-                    }
-                    metadataCert = metadataCert.map(utility.normalizeCerString);
+                    metadataCert = normalizeCertificates(metadataCert);
                     if (certificateNode.length === 0 && metadataCert.length === 0) {
                         throw new Error('NO_SELECTED_CERTIFICATE');
                     }
@@ -627,13 +615,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 else if (opts.metadata) {
                     const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
                     let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    if (Array.isArray(metadataCert)) {
-                        metadataCert = flattenDeep(metadataCert);
-                    }
-                    else if (typeof metadataCert === 'string') {
-                        metadataCert = [metadataCert];
-                    }
-                    metadataCert = metadataCert.map(utility.normalizeCerString);
+                    metadataCert = normalizeCertificates(metadataCert);
                     if (certificateNode.length === 0 && metadataCert.length === 0) {
                         throw new Error('NO_SELECTED_CERTIFICATE');
                     }
@@ -791,13 +773,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
                     // 证书处理逻辑
                     let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    if (Array.isArray(metadataCert)) {
-                        metadataCert = flattenDeep(metadataCert);
-                    }
-                    else if (typeof metadataCert === 'string') {
-                        metadataCert = [metadataCert];
-                    }
-                    metadataCert = metadataCert.map(utility.normalizeCerString);
+                    metadataCert = normalizeCertificates(metadataCert);
                     // 没有证书的情况
                     if (certificateNode.length === 0 && metadataCert.length === 0) {
                         throw new Error('NO_SELECTED_CERTIFICATE');
@@ -1070,13 +1046,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 else if (opts.metadata) {
                     const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
                     let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    if (Array.isArray(metadataCert)) {
-                        metadataCert = flattenDeep(metadataCert);
-                    }
-                    else if (typeof metadataCert === 'string') {
-                        metadataCert = [metadataCert];
-                    }
-                    metadataCert = metadataCert.map(utility.normalizeCerString);
+                    metadataCert = normalizeCertificates(metadataCert);
                     if (certificateNode.length === 0 && metadataCert.length === 0) {
                         throw new Error('NO_SELECTED_CERTIFICATE');
                     }

package/build/src/saml2-enhancements-integration.js

@@ -0,0 +1,146 @@
+/**
+ * @file saml2-enhancements-integration.ts
+ * @desc SAML 2.0 增强功能集成 - 自动应用到绑定和元数据生成
+ */
+import { buildScoping, buildRequestedAuthnContext, buildOneTimeUse, buildProxyRestriction, buildOrganization, buildContactPerson, xmlToString, AuthnContextClassRef, Consent, } from './saml2-enhancements.js';
+import { DOMParser, XMLSerializer } from '@xmldom/xmldom';
+/**
+ * 将增强功能应用到 AuthnRequest
+ */
+export function applyAuthnRequestEnhancements(rawSamlRequest, enhancements) {
+    const doc = new DOMParser().parseFromString(rawSamlRequest, 'application/xml');
+    const authnRequestElement = doc.documentElement;
+    if (!authnRequestElement) {
+        throw new Error('Invalid AuthnRequest XML');
+    }
+    // 1. 添加可选属性（仅当配置了值时）
+    if (enhancements.forceAuthn !== undefined) {
+        authnRequestElement.setAttribute('ForceAuthn', String(enhancements.forceAuthn));
+    }
+    if (enhancements.isPassive !== undefined) {
+        authnRequestElement.setAttribute('IsPassive', String(enhancements.isPassive));
+    }
+    if (enhancements.consent) {
+        authnRequestElement.setAttribute('Consent', enhancements.consent);
+    }
+    if (enhancements.attributeConsumingServiceIndex !== undefined) {
+        authnRequestElement.setAttribute('AttributeConsumingServiceIndex', String(enhancements.attributeConsumingServiceIndex));
+    }
+    if (enhancements.providerName) {
+        authnRequestElement.setAttribute('ProviderName', enhancements.providerName);
+    }
+    // 2. 添加 Scoping 元素
+    if (enhancements.scoping) {
+        const scopingElement = buildScopingElement(enhancements.scoping, doc);
+        authnRequestElement.appendChild(scopingElement);
+    }
+    // 3. 添加 RequestedAuthnContext 元素
+    if (enhancements.requestedAuthnContext) {
+        const contextElement = buildRequestedAuthnContextElement(enhancements.requestedAuthnContext, doc);
+        authnRequestElement.appendChild(contextElement);
+    }
+    return new XMLSerializer().serializeToString(doc);
+}
+/**
+ * 将增强功能应用到 Conditions 元素
+ */
+export function applyConditionsEnhancements(rawSamlResponse, enhancements) {
+    const doc = new DOMParser().parseFromString(rawSamlResponse, 'application/xml');
+    const conditionsElements = doc.getElementsByTagName('saml:Conditions');
+    if (conditionsElements.length > 0) {
+        const conditionsElement = conditionsElements[0];
+        // 1. 添加 OneTimeUse
+        if (enhancements.oneTimeUse?.enabled) {
+            const oneTimeUseElement = buildOneTimeUseElement(doc);
+            conditionsElement.appendChild(oneTimeUseElement);
+        }
+        // 2. 添加 ProxyRestriction
+        if (enhancements.proxyRestriction) {
+            const proxyRestrictionElement = buildProxyRestrictionElement(enhancements.proxyRestriction, doc);
+            conditionsElement.appendChild(proxyRestrictionElement);
+        }
+    }
+    return new XMLSerializer().serializeToString(doc);
+}
+/**
+ * 将增强功能应用到 SubjectConfirmationData 元素
+ */
+export function applySubjectConfirmationEnhancements(rawSamlResponse, enhancements) {
+    const doc = new DOMParser().parseFromString(rawSamlResponse, 'application/xml');
+    const subjectConfirmationDataElements = doc.getElementsByTagName('saml:SubjectConfirmationData');
+    if (subjectConfirmationDataElements.length > 0) {
+        const element = subjectConfirmationDataElements[0];
+        if (enhancements.address) {
+            element.setAttribute('Address', enhancements.address);
+        }
+        if (enhancements.notBefore) {
+            element.setAttribute('NotBefore', enhancements.notBefore);
+        }
+        if (enhancements.inResponseTo) {
+            element.setAttribute('InResponseTo', enhancements.inResponseTo);
+        }
+    }
+    return new XMLSerializer().serializeToString(doc);
+}
+/**
+ * 将增强功能应用到元数据
+ */
+export function applyMetadataEnhancements(rawMetadata, enhancements) {
+    const doc = new DOMParser().parseFromString(rawMetadata, 'application/xml');
+    const entityDescriptor = doc.documentElement;
+    if (!entityDescriptor) {
+        throw new Error('Invalid Metadata XML');
+    }
+    // 1. 添加 Organization
+    if (enhancements.organization) {
+        const orgElement = buildOrganizationElement(enhancements.organization, doc);
+        entityDescriptor.appendChild(orgElement);
+    }
+    // 2. 添加 ContactPerson
+    if (enhancements.contactPerson && enhancements.contactPerson.length > 0) {
+        enhancements.contactPerson.forEach(contact => {
+            const contactElement = buildContactPersonElement(contact, doc);
+            entityDescriptor.appendChild(contactElement);
+        });
+    }
+    return new XMLSerializer().serializeToString(doc);
+}
+// ============================================================================
+// 辅助函数：构建 DOM 元素
+// ============================================================================
+function buildScopingElement(config, doc) {
+    const scoping = buildScoping(config);
+    return xmlObjectToElement(scoping, doc, 'samlp');
+}
+function buildRequestedAuthnContextElement(config, doc) {
+    const context = buildRequestedAuthnContext(config);
+    return xmlObjectToElement(context, doc, 'samlp');
+}
+function buildOneTimeUseElement(doc) {
+    const oneTimeUse = buildOneTimeUse();
+    return xmlObjectToElement(oneTimeUse, doc, 'saml');
+}
+function buildProxyRestrictionElement(config, doc) {
+    const proxyRestriction = buildProxyRestriction(config);
+    return xmlObjectToElement(proxyRestriction, doc, 'saml');
+}
+function buildOrganizationElement(config, doc) {
+    const organization = buildOrganization(config);
+    return xmlObjectToElement(organization, doc, 'md');
+}
+function buildContactPersonElement(config, doc) {
+    const contactPerson = buildContactPerson(config);
+    return xmlObjectToElement(contactPerson, doc, 'md');
+}
+// ============================================================================
+// 工具函数：将 XML 对象转换为 DOM 元素
+// ============================================================================
+function xmlObjectToElement(xmlObj, doc, defaultNs) {
+    const xmlStr = xmlToString(xmlObj);
+    const tempDoc = new DOMParser().parseFromString(xmlStr, 'application/xml');
+    return doc.importNode(tempDoc.documentElement, true);
+}
+// ============================================================================
+// 导出常量
+// ============================================================================
+export { AuthnContextClassRef, Consent };