samlesa 4.3.5 → 4.5.0

package/build/src/binding-post.js

@@ -87,7 +87,7 @@ function base64LoginRequest(referenceTagXPath, entity, customTagReplacement) {
  * @param AttributeStatement
  * @param idpInit
  */
-async function base64LoginResponse({ requestInfo = {}, entity, user = {}, customTagReplacement, encryptThenSign = false, AttributeStatement = [], idpInit }) {
+async function base64LoginResponse({ requestInfo = {}, entity, user = {}, customTagReplacement, encryptThenSign = false, AttributeStatement = [], idpInit, destinationBinding = binding.post, }) {
     const idpSetting = entity.idp.entitySetting;
     const spSetting = entity.sp.entitySetting;
     // @ts-ignore
@@ -100,7 +100,9 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
     const nameIDFormat = idpSetting.nameIDFormat;
     const selectedNameIDFormat = Array.isArray(nameIDFormat) ? nameIDFormat[0] : namespace.format.unspecified;
     if (metadata && metadata.idp && metadata.sp) {
-        const base = metadata.sp.getAssertionConsumerService(binding.post);
+        const base = destinationBinding === binding.artifact
+            ? metadata.sp.getAssertionConsumerService(binding.artifact, { mode: 'lenient' })
+            : metadata.sp.getAssertionConsumerService(binding.post);
         let rawSamlResponse;
         const nowTime = new Date();
         const spEntityID = metadata.sp.getEntityID();
@@ -108,7 +110,9 @@ async function base64LoginResponse({ requestInfo = {}, entity, user = {}, custom
         oneMinutesLaterTime.setMinutes(oneMinutesLaterTime.getMinutes() + 5);
         const OneMinutesLater = oneMinutesLaterTime.toISOString();
         const now = nowTime.toISOString();
-        const acl = metadata.sp.getAssertionConsumerService(binding.post);
+        const acl = destinationBinding === binding.artifact
+            ? metadata.sp.getAssertionConsumerService(binding.artifact, { mode: 'lenient' })
+            : metadata.sp.getAssertionConsumerService(binding.post);
         // @ts-ignore
         const sessionID = idpSetting?.generateID() ?? `_${randomUUID()}`;
         const sessionIndex = 'session' + sessionID; // 这个是当前系统的会话索引，用于单点注销

package/build/src/entity-idp.js

@@ -3,8 +3,6 @@
  * @author tngan
  * @desc  Declares the actions taken by identity provider
  */
-import { wording, } from './urn.js';
-const binding = wording.binding;
 import Entity from './entity.js';
 import { namespace } from './urn.js';
 import postBinding from './binding-post.js';
@@ -68,7 +66,7 @@ export class IdentityProvider extends Entity {
                     sp,
                 }, user, relayState, customTagReplacement, AttributeStatement);
             case namespace.binding.artifact:
-                context = await artifactBinding.soapLoginResponse({
+                context = await artifactBinding.createLoginResponse({
                     requestInfo,
                     entity: {
                         idp: this,
@@ -91,6 +89,49 @@ export class IdentityProvider extends Entity {
             type: 'SAMLResponse'
         };
     }
+    createArtifactResolveRequest(sp, artifact) {
+        return artifactBinding.createArtifactResolveRequest({
+            requester: this,
+            responder: sp,
+            artifact,
+        });
+    }
+    async createArtifactResolveResponse(params) {
+        const { sp, samlMessage, requestInfo = {}, user = {}, customTagReplacement, encryptThenSign = false, AttributeStatement = [], idpInit = false, inResponseTo = '', } = params;
+        const resolvedMessage = samlMessage ?? (await artifactBinding.createLoginResponse({
+            requestInfo,
+            entity: {
+                idp: this,
+                sp,
+            },
+            user,
+            customTagReplacement,
+            encryptThenSign,
+            AttributeStatement,
+            idpInit,
+        })).samlContent;
+        return artifactBinding.createArtifactResolveResponse({
+            requester: sp,
+            responder: this,
+            inResponseTo,
+            samlMessage: resolvedMessage,
+        });
+    }
+    parseArtifactResolveRequest(sp, xml) {
+        return artifactBinding.parseArtifactResolveRequest({
+            requester: sp,
+            responder: this,
+            xml,
+        });
+    }
+    parseArtifactResolveResponse(sp, xml, inResponseTo) {
+        return artifactBinding.parseArtifactResolveResponse({
+            requester: this,
+            responder: sp,
+            xml,
+            inResponseTo,
+        });
+    }
     /**
      * Validation of the parsed URL parameters
      * @param sp ServiceProvider instance
@@ -98,6 +139,13 @@ export class IdentityProvider extends Entity {
      * @param req RequesmessageSigningOrderst
      */
     parseLoginRequest(sp, binding, req) {
+        if (binding === namespace.binding.artifact || binding === 'artifact') {
+            return artifactBinding.parseLoginRequest({
+                idp: this,
+                sp,
+                request: req,
+            });
+        }
         const self = this;
         return flow({
             from: sp,

package/build/src/entity-sp.js

@@ -61,7 +61,7 @@ export class ServiceProvider extends Entity {
                 context = simpleSignBinding.base64LoginRequest({ idp, sp: this }, customTagReplacement);
                 break;
             case nsBinding.artifact:
-                context = artifactBinding.soapLoginRequest("/*[local-name(.)='AuthnRequest']", {
+                context = artifactBinding.createLoginRequest("/*[local-name(.)='AuthnRequest']", {
                     idp,
                     sp: this
                 }, customTagReplacement);
@@ -76,14 +76,24 @@ export class ServiceProvider extends Entity {
             type: 'SAMLRequest',
         };
     }
-    async createLoginSoapRequest(idp, binding = 'artifact', config) {
-        const context = await artifactBinding.soapLoginRequest("/*[local-name(.)='AuthnRequest']", {
+    createArtifactResolveRequest(idp, artifact) {
+        return artifactBinding.createArtifactResolveRequest({
+            requester: this,
+            responder: idp,
+            artifact,
+        });
+    }
+    async createArtifactResolveResponse(idp, config) {
+        const samlMessage = config?.samlMessage ?? artifactBinding.createLoginRequest("/*[local-name(.)='AuthnRequest']", {
             idp,
             sp: this,
-            inResponse: config?.inResponseTo,
-            relayState: config?.relayState,
-        }, config?.customTagReplacement);
-        return context;
+        }, config?.customTagReplacement).samlContent;
+        return artifactBinding.createArtifactResolveResponse({
+            requester: idp,
+            responder: this,
+            inResponseTo: config?.inResponseTo || '',
+            samlMessage,
+        });
     }
     /**
      * @desc   Validation of the parsed the URL parameters
@@ -92,6 +102,13 @@ export class ServiceProvider extends Entity {
      * @param  {request}   req                      request
      */
     parseLoginResponse(idp, binding, request) {
+        if (binding === namespace.binding.artifact || binding === 'artifact') {
+            return artifactBinding.parseLoginResponse({
+                idp,
+                sp: this,
+                request,
+            });
+        }
         const self = this;
         return flow({
             from: idp,
@@ -103,31 +120,19 @@ export class ServiceProvider extends Entity {
             request: request
         });
     }
-    /**
-     * @desc   Parse and validate Artifact Resolve request
-     * @param  {IdentityProvider}   idp             object of identity provider
-     * @param  {string}   xml                       SOAP request XML string
-     */
-    parseLoginRequestResolve(idp, xml) {
-        const self = this;
-        return artifactBinding.parseLoginRequestResolve({
-            idp: idp,
-            sp: self,
-            xml: xml
+    parseArtifactResolveRequest(idp, xml) {
+        return artifactBinding.parseArtifactResolveRequest({
+            requester: idp,
+            responder: this,
+            xml,
         });
     }
-    /**
-     * @desc   Resolve SAML Response by Artifact ID
-     * @param  {IdentityProvider}   idp             object of identity provider
-     * @param  {string}   art                       Artifact string
-     * @param  {request}   req                      request
-     */
-    parseLoginResponseResolve(idp, art, request) {
-        const self = this;
-        return artifactBinding.parseLoginResponseResolve({
-            idp: idp,
-            sp: self,
-            art: art
+    parseArtifactResolveResponse(idp, xml, inResponseTo) {
+        return artifactBinding.parseArtifactResolveResponse({
+            requester: this,
+            responder: idp,
+            xml,
+            inResponseTo,
         });
     }
 }

package/build/src/extractor.js

@@ -140,10 +140,27 @@ export const artifactResolveFields = [
     },
 ];
 export const artifactResponseFields = [
-    { key: 'request', localPath: ['Envelope', 'Body', 'ArtifactResolve'], attributes: ['ID', 'IssueInstant', 'Version'] },
-    { key: 'issuer', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Issuer'], attributes: [] },
-    { key: 'Artifact', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Artifact'], attributes: [] },
-    { key: 'signature', localPath: ['Envelope', 'Body', 'ArtifactResolve', 'Signature'], attributes: [], context: true },
+    {
+        key: 'response',
+        localPath: ['Envelope', 'Body', 'ArtifactResponse'],
+        attributes: ['ID', 'IssueInstant', 'Version', 'InResponseTo', 'Destination']
+    },
+    {
+        key: 'issuer',
+        localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Issuer'],
+        attributes: []
+    },
+    {
+        key: 'status',
+        localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Status', 'StatusCode'],
+        attributes: ['Value']
+    },
+    {
+        key: 'signature',
+        localPath: ['Envelope', 'Body', 'ArtifactResponse', 'Signature'],
+        attributes: [],
+        context: true
+    },
 ];
 export const loginResponseStatusFields = [
     { key: 'top', localPath: ['Response', 'Status', 'StatusCode'], attributes: ['Value'] },
@@ -160,6 +177,7 @@ export const logoutResponseStatusFields = [
 export const loginResponseFields = assertion => [
     { key: 'conditions', localPath: ['Assertion', 'Conditions'], attributes: ['NotBefore', 'NotOnOrAfter'], shortcut: assertion },
     { key: 'response', localPath: ['Response'], attributes: ['ID', 'IssueInstant', 'Destination', 'InResponseTo', 'Version'] },
+    { key: 'responseIssuer', localPath: ['Response', 'Issuer'], attributes: [] },
     { key: 'audience', localPath: ['Assertion', 'Conditions', 'AudienceRestriction', 'Audience'], attributes: [], shortcut: assertion },
     { key: 'issuer', localPath: ['Assertion', 'Issuer'], attributes: [], shortcut: assertion },
     { key: 'nameID', localPath: ['Assertion', 'Subject', 'NameID'], attributes: [], shortcut: assertion },