samlesa 4.7.1 → 4.7.3

package/README.md

@@ -154,25 +154,25 @@ const { context: samlResponse } = await idp.createLoginResponse({
 });
 ```
 
-### Artifact Binding Support
-
-```typescript
-import { ServiceProvider, IdentityProvider } from 'samlesa';
-
-// Create front-channel artifact login request
-const loginRequest = sp.createLoginRequest(idp, 'artifact');
-
-// Parse ArtifactResolve request on the SP artifact resolution endpoint
-const artifactResolve = await sp.parseArtifactResolveRequest(idp, soapXml);
-
-// Create ArtifactResponse with the resolved SAML message
-const artifactResponse = await sp.createArtifactResolveResponse(idp, {
-  inResponseTo: artifactResolve.extract.request.id,
-});
-
-// Parse artifact-based login response from the ACS endpoint
-const responseResult = await sp.parseLoginResponse(idp, 'artifact', request);
-```
+### Artifact Binding Support
+
+```typescript
+import { ServiceProvider, IdentityProvider } from 'samlesa';
+
+// Create front-channel artifact login request
+const loginRequest = sp.createLoginRequest(idp, 'artifact');
+
+// Parse ArtifactResolve request on the SP artifact resolution endpoint
+const artifactResolve = await sp.parseArtifactResolveRequest(idp, soapXml);
+
+// Create ArtifactResponse with the resolved SAML message
+const artifactResponse = await sp.createArtifactResolveResponse(idp, {
+  inResponseTo: artifactResolve.extract.request.id,
+});
+
+// Parse artifact-based login response from the ACS endpoint
+const responseResult = await sp.parseLoginResponse(idp, 'artifact', request);
+```
 
 ---
 

package/build/src/extractor.js

@@ -176,6 +176,7 @@ export const logoutResponseStatusFields = [
 ];
 export const loginResponseFields = assertion => [
     { key: 'conditions', localPath: ['Assertion', 'Conditions'], attributes: ['NotBefore', 'NotOnOrAfter'], shortcut: assertion },
+    { key: 'audienceRestrictions', localPath: ['Assertion', 'Conditions', 'AudienceRestriction'], attributes: [], context: true, shortcut: assertion },
     { key: 'response', localPath: ['Response'], attributes: ['ID', 'IssueInstant', 'Destination', 'InResponseTo', 'Version'] },
     { key: 'responseIssuer', localPath: ['Response', 'Issuer'], attributes: [] },
     { key: 'audience', localPath: ['Assertion', 'Conditions', 'AudienceRestriction', 'Audience'], attributes: [], shortcut: assertion },

package/build/src/flow.js

@@ -101,6 +101,55 @@ function validateResponseTimes(parserType, extractedProperties, self) {
     }
     return null;
 }
+function normalizeStringList(value) {
+    if (Array.isArray(value)) {
+        return value.flatMap(item => normalizeStringList(item));
+    }
+    if (typeof value !== 'string') {
+        return [];
+    }
+    const normalized = value.trim();
+    return normalized ? [normalized] : [];
+}
+function collectAudienceValues(extractedProperties) {
+    return [
+        ...normalizeStringList(extractedProperties?.audience),
+        ...normalizeStringList(extractedProperties?.conditions?.audiences),
+    ];
+}
+function collectAudienceRestrictionGroups(extractedProperties) {
+    const restrictionFragments = normalizeStringList(extractedProperties?.audienceRestrictions);
+    if (restrictionFragments.length === 0) {
+        const flattenedAudiences = collectAudienceValues(extractedProperties);
+        return flattenedAudiences.length > 0 ? [flattenedAudiences] : [];
+    }
+    return restrictionFragments.map((fragment) => {
+        const parsedRestriction = extract(fragment, [{
+                key: 'audience',
+                localPath: ['AudienceRestriction', 'Audience'],
+                attributes: [],
+            }]);
+        return normalizeStringList(parsedRestriction?.audience);
+    });
+}
+function validateAudienceRestriction(parserType, extractedProperties, self) {
+    if (parserType !== ParserType.SAMLResponse) {
+        return null;
+    }
+    const expectedAudience = self?.entityMeta?.getEntityID?.();
+    if (typeof expectedAudience !== 'string' || expectedAudience.trim().length === 0) {
+        return null;
+    }
+    const audienceRestrictionGroups = collectAudienceRestrictionGroups(extractedProperties);
+    if (audienceRestrictionGroups.length === 0 ||
+        audienceRestrictionGroups.some(group => group.length === 0)) {
+        return self?.entitySetting?.strictSecurity === false ? null : 'ERR_MISSING_AUDIENCE';
+    }
+    if (!audienceRestrictionGroups.every(group => group.includes(expectedAudience.trim()))) {
+        return 'ERR_UNMATCH_AUDIENCE';
+    }
+    return null;
+}
 function validateEndpointConstraints(parserType, extractedProperties, self, from) {
     const requestData = extractedProperties?.request ?? {};
     const responseData = extractedProperties?.response ?? {};
@@ -170,6 +219,10 @@ function runCommonValidation(parserType, extractedProperties, self, from) {
     if (timeError) {
         return timeError;
     }
+    const audienceError = validateAudienceRestriction(parserType, extractedProperties, self);
+    if (audienceError) {
+        return audienceError;
+    }
     return validateEndpointConstraints(parserType, extractedProperties, self, from);
 }
 // proceed the redirect binding flow

package/build/src/libsaml.js

@@ -28,6 +28,47 @@ const signatureAlgorithms = algorithms.signature;
 const digestAlgorithms = algorithms.signatureToDigestMap;
 const certUse = wording.certUse;
 const urlParams = wording.urlParams;
+function resolveSignaturePublicKeys(signatureNode, metadata) {
+    const certificateNode = toNodeArray(select(".//*[local-name(.)='X509Certificate']", signatureNode));
+    const metadataCerts = normalizeCertificates(metadata.getX509Certificate(certUse.signing));
+    if (certificateNode.length === 0 && metadataCerts.length === 0) {
+        throw new Error('NO_SELECTED_CERTIFICATE');
+    }
+    if (certificateNode.length !== 0) {
+        const x509CertificateData = certificateNode[0].firstChild?.nodeValue || '';
+        const x509Certificate = utility.normalizeCerString(x509CertificateData);
+        if (metadataCerts.length >= 1 && !metadataCerts.find((cert) => cert.trim() === x509Certificate.trim())) {
+            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
+        }
+        return [utility.getPublicKeyPemFromCertificate(x509Certificate).toString()];
+    }
+    return metadataCerts.map((cert) => utility.getPublicKeyPemFromCertificate(cert).toString());
+}
+function verifyXmlSignatureWithPublicKeys(signatureNode, xmlCandidates, publicKeys, signatureAlgorithm) {
+    let lastError = null;
+    for (const publicKey of publicKeys) {
+        try {
+            const sig = new SignedXml();
+            sig.publicCert = publicKey;
+            if (signatureAlgorithm) {
+                sig.signatureAlgorithm = signatureAlgorithm;
+            }
+            sig.loadSignature(signatureNode);
+            for (const xmlCandidate of xmlCandidates) {
+                if (sig.checkSignature(xmlCandidate)) {
+                    return { verified: true, sig };
+                }
+            }
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    if (lastError && publicKeys.length === 1) {
+        throw lastError;
+    }
+    return { verified: false, sig: null };
+}
 let conList = [
     "http://www.w3.org/2001/10/xml-exc-c14n#",
     "http://www.w3.org/2001/10/xml-exc-c14n#WithComments",
@@ -49,9 +90,9 @@ const libSaml = () => {
         throw new Error('ERR_UNDEFINED_QUERY_PARAMS');
     }
     /**
-     * 检测是否使用了不安全的SHA1系列签名算法
-     * @param signatureAlgorithm 签名算法URI
-     * @returns {Object} 包含是否使用不安全算法和具体算法名称的对象
+      * Detect whether an unsafe SHA1-family signature algorithm is used.
+      * @param signatureAlgorithm Signature algorithm URI.
+      * @returns {Object} Whether an unsafe algorithm is used and its name.
      */
     function checkUnsafeSignatureAlgorithm(signatureAlgorithm) {
         const unsafeAlgorithms = [
@@ -217,16 +258,16 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
         throw new Error('ERR_UNSUPPORTED_SIGNATURE_ALGORITHM');
     }
     function validateAndInflateSamlResponse(urlEncodedResponse) {
-        // 3. 尝试DEFLATE解压（SAML规范要求使用原始DEFLATE）
+        // Try raw DEFLATE first, as required by the SAML binding.
         let xml = "";
         let compressed = true;
-        try { // 1. URL解码
+        try { // URL decode.
             const base64Encoded = decodeURIComponent(urlEncodedResponse);
-            // 2. Base64解码为Uint8Array
+            // Decode Base64 into a Uint8Array.
             xml = inflateString(base64Encoded);
         }
         catch (inflateError) {
-            // 4. 解压失败，尝试直接解析为未压缩的XML
+            // If decompression fails, try parsing as uncompressed XML.
             try {
                 const base64Encoded = decodeURIComponent(urlEncodedResponse);
                 xml = atob(base64Encoded);
@@ -321,32 +362,32 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          */
         /** For Test */
         attributeStatementBuilder(attributeData) {
-            // 构建 XML 元素数组
-            // 构建 XML 结构
+            // Build the XML element array.
+            // Build the XML structure.
             const attributeStatement = {
                 'saml:AttributeStatement': [
-                    // 命名空间声明（在 AttributeStatement 上定义）
+                    // Namespace declaration on AttributeStatement.
                     {},
-                    // 遍历生成多个 Attribute
+                    // Generate each Attribute.
                     ...attributeData.map(attr => ({
                         'saml:Attribute ': [
-                            // Attribute 属性
+                            // Attribute properties.
                             {
                                 _attr: {
                                     Name: attr.Name,
                                     NameFormat: attr.NameFormat
                                 }
                             },
-                            // 遍历生成多个 AttributeValue
+                            // Generate each AttributeValue.
                             ...attr.valueArray.map((valueObj) => ({
                                 'saml:AttributeValue ': [
-                                    // 数据类型（根据 ValueType）
+                                    // Data type based on ValueType.
                                     {
                                         _attr: attr.ValueType === 1
                                             ? { 'xsi:type': 'xs:string' }
                                             : {}
                                     },
-                                    // 值内容
+                                    // Value content.
                                     valueObj.value
                                 ]
                             }))
@@ -354,7 +395,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     }))
                 ]
             };
-            // 生成 XML（关闭自动声明头）
+            // Generate XML without an automatic declaration.
             const xmlString = xml([attributeStatement], { declaration: false });
             if (xmlString.trim() === '<saml:AttributeStatement></saml:AttributeStatement>') {
                 return '';
@@ -392,10 +433,10 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             sig.publicCert = this.getKeyInfo(signingCert, signatureConfig).getKey();
             sig.getKeyInfoContent = this.getKeyInfo(signingCert, signatureConfig).getKeyInfo;
             sig.privateKey = utility.readPrivateKey(privateKey, privateKeyPass, true);
-            // 获取目标算法 (即 transformationAlgorithms[1])
+            // Read the target canonicalization algorithm.
             const targetAlgo = transformationAlgorithms[1];
-            // 逻辑：如果 conList 包含 targetAlgo，则用 targetAlgo；否则用默认值
-            // 注意：因为 targetAlgo 本身就在 conList 里，所以这里一定会命中 true
+            // Use targetAlgo when supported, otherwise use the default.
+            // In normal configuration targetAlgo is already in conList.
             const selectedAlgo = conList.includes(targetAlgo)
                 ? targetAlgo
                 : 'http://www.w3.org/2001/10/xml-exc-c14n#';
@@ -409,20 +450,20 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             }
             return isBase64Output ? utility.base64Encode(sig.getSignedXml()) : sig.getSignedXml();
         },
-        // 安全的证书验证函数
+        // Certificate validation helper.
         validateCertificate(certificateBase64, expectedIssuer) {
             try {
                 const cert = new X509Certificate(Buffer.from(certificateBase64, 'base64'));
-                // 1. 检查有效期
+                // Check certificate validity period.
                 const now = new Date();
                 if (new Date(cert.validFrom) > now || new Date(cert.validTo) < now) {
                     throw new Error('Certificate has expired or is not yet valid');
                 }
-                // 2. 检查颁发者（如果提供）
+                // Check issuer when an expected issuer is provided.
                 if (expectedIssuer && !cert.subject.includes(expectedIssuer)) {
                     throw new Error('Certificate issuer does not match expected value');
                 }
-                // 3. 检查公钥类型（推荐 RSA 或 EC）
+                // Check public key type. RSA and EC are preferred.
                 if (!['rsa', 'ec'].includes(cert.publicKey.type.toLowerCase())) {
                     throw new Error('Certificate uses unsupported public key type');
                 }
@@ -441,31 +482,31 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             }
         },
         /**
-         * 改进的SAML签名验证函数，支持多种签名和加密组合场景
-         * @param xml SAML XML内容
-         * @param opts 验证选项
+         * Verify SAML signatures across message, assertion, and encryption combinations.
+         * @param xml SAML XML content.
+         * @param opts Verification options.
          * @param self
-         * @returns 验证结果对象
+         * @returns Verification result object.
          */
         async verifySignature(xml, opts, self) {
-            const { dom } = getContext(); // 现在正常了
+            const { dom } = getContext();
             const doc = dom.parseFromString(xml, 'application/xml');
             const docParser = new DOMParser();
-            // ✅ 优化1: 所有 XPath 路径改为精确匹配 SAML 2.0 标准
+            // Use exact SAML 2.0 XPath targets.
             const messageSignatureXpath = "/*[local-name() = 'Response' or local-name() = 'AuthnRequest' or local-name() = 'LogoutRequest' or local-name() = 'LogoutResponse']/*[local-name() = 'Signature']";
             const assertionSignatureXpath = "/*[local-name() = 'Response' or local-name() = 'AuthnRequest']/*[local-name() = 'Assertion']/*[local-name() = 'Signature']";
             const wrappingElementsXPath = "/*[local-name() = 'Response']/*[local-name() = 'Assertion']/*[local-name() = 'Subject']/*[local-name() = 'SubjectConfirmation']/*[local-name() = 'SubjectConfirmationData']//*[local-name() = 'Assertion' or local-name() = 'Signature']";
             const encryptedAssertionsXPath = "/*[local-name() = 'Response']/*[local-name() = 'EncryptedAssertion']";
-            // 检测包装攻击
+            // Detect wrapping attacks.
             const wrappingElementNode = toNodeArray(select(wrappingElementsXPath, doc));
             if (wrappingElementNode.length !== 0) {
                 throw new Error('ERR_POTENTIAL_WRAPPING_ATTACK');
             }
-            // 获取各种元素
+            // Locate relevant XML elements.
             const messageSignatureNode = toNodeArray(select(messageSignatureXpath, doc));
             const assertionSignatureNode = toNodeArray(select(assertionSignatureXpath, doc));
             const encryptedAssertions = toNodeArray(select(encryptedAssertionsXPath, doc));
-            // 初始化验证状态
+            // Initialize verification state.
             let isMessageSigned = messageSignatureNode.length > 0;
             let isAssertionSigned = assertionSignatureNode.length > 0;
             let encrypted = encryptedAssertions.length > 0;
@@ -475,7 +516,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             let status = false;
             let samlContent = xml;
             let assertionContent = null;
-            // 检测SAML消息类型
+            // Detect SAML message type.
             const rootElementName = doc.documentElement.localName;
             let type = 'Unknown';
             switch (rootElementName) {
@@ -510,7 +551,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             }
             let hasUnsafeSignatureAlgorithm = false;
             let unsafeSignatureAlgorithm = '';
-            // 特殊情况：带未签名断言的未签名SAML响应，应该拒绝
+            // Reject unsigned SAML responses that carry unsigned assertions.
             if (!isMessageSigned && !isAssertionSigned && !encrypted) {
                 return {
                     isMessageSigned,
@@ -527,7 +568,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     unsafeSignatureAlgorithm
                 };
             }
-            // ✅ 优化2: 修复签名算法路径（关键安全修复）
+            // Resolve the signature algorithm from the signature node.
             const getSignatureAlgorithm = (signatureNode) => {
                 const signatureAlgorithm = xpath.select1(".//*[local-name() = 'SignedInfo']/*[local-name() = 'SignatureMethod']/@Algorithm", signatureNode);
                 if (!signatureAlgorithm || !signatureAlgorithm.value) {
@@ -535,7 +576,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 }
                 return signatureAlgorithm.value;
             };
-            // 处理最外层有签名且断言加密的情况
+            // Handle outer message signature with encrypted assertion.
             if (isMessageSigned && encrypted) {
                 try {
                     const result = await this.decryptAssertionAsync(self, xml, opts);
@@ -550,7 +591,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     isAssertionSigned = result?.[2]?.isAssertionSigned || false;
                     const decryptedDoc = dom.parseFromString(samlContent, 'application/xml');
                     const signatureNode = messageSignatureNode[0];
-                    // ✅ 修复：使用精确路径获取签名算法
+                    // Resolve the signature algorithm with an exact path.
                     const signatureAlgorithm = getSignatureAlgorithm(signatureNode);
                     const checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm);
                     hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
@@ -558,41 +599,21 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     if (checkResult.hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts, self)) {
                         throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                     }
-                    const sig = new SignedXml();
+                    let publicKeys = [];
                     if (!opts.keyFile && !opts.metadata) {
                         throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                     }
                     if (opts.keyFile) {
-                        sig.publicCert = fs.readFileSync(opts.keyFile);
+                        publicKeys = [fs.readFileSync(opts.keyFile)];
                     }
                     else if (opts.metadata) {
-                        const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
-                        let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                        metadataCert = normalizeCertificates(metadataCert);
-                        if (certificateNode.length === 0 && metadataCert.length === 0) {
-                            throw new Error('NO_SELECTED_CERTIFICATE');
-                        }
-                        if (certificateNode.length !== 0) {
-                            const x509CertificateData = certificateNode[0].firstChild.data;
-                            const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                            if (metadataCert.length >= 1 && !metadataCert.find((cert) => cert.trim() === x509Certificate.trim())) {
-                                throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                            }
-                            sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                        }
-                        else {
-                            sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                        }
+                        publicKeys = resolveSignaturePublicKeys(signatureNode, opts.metadata);
                     }
-                    sig.signatureAlgorithm = opts.signatureAlgorithm;
-                    sig.loadSignature(signatureNode);
-                    // 验证最外层消息签名
-                    MessageSignatureStatus = sig.checkSignature(decryptedDoc.toString());
+                    // Verify the outer message signature.
+                    const verifyResult = verifyXmlSignatureWithPublicKeys(signatureNode, [decryptedDoc.toString(), xml], publicKeys, opts.signatureAlgorithm);
+                    MessageSignatureStatus = verifyResult.verified;
                     if (!MessageSignatureStatus) {
-                        MessageSignatureStatus = sig.checkSignature(xml);
-                        if (!MessageSignatureStatus) {
-                            throw new Error('ERR_FAILED_TO_VERIFY_MESSAGE_SIGNATURE_AFTER_DECRYPTION');
-                        }
+                        throw new Error('ERR_FAILED_TO_VERIFY_MESSAGE_SIGNATURE_AFTER_DECRYPTION');
                     }
                     if (isAssertionSigned && !AssertionSignatureStatus) {
                         throw new Error('ERR_FAILED_TO_VERIFY_ASSERTION_SIGNATURE_AFTER_DECRYPTION');
@@ -602,92 +623,56 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     throw err;
                 }
             }
-            // 处理最外层有签名但断言未加密的情况
+            // Handle outer message signature without encrypted assertion.
             else if (isMessageSigned && !encrypted) {
                 const signatureNode = messageSignatureNode[0];
-                const signatureAlgorithm = getSignatureAlgorithm(signatureNode); // ✅ 修复
+                const signatureAlgorithm = getSignatureAlgorithm(signatureNode);
                 const checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm);
                 hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
                 unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                 if (checkResult.hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts, self)) {
                     throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                 }
-                const sig = new SignedXml();
+                let publicKeys = [];
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                 }
                 if (opts.keyFile) {
-                    sig.publicCert = fs.readFileSync(opts.keyFile);
+                    publicKeys = [fs.readFileSync(opts.keyFile)];
                 }
                 else if (opts.metadata) {
-                    const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
-                    let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    metadataCert = normalizeCertificates(metadataCert);
-                    if (certificateNode.length === 0 && metadataCert.length === 0) {
-                        throw new Error('NO_SELECTED_CERTIFICATE');
-                    }
-                    if (certificateNode.length !== 0) {
-                        const x509CertificateData = certificateNode[0].firstChild.data;
-                        const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        if (metadataCert.length >= 1 && !metadataCert.find((cert) => cert.trim() === x509Certificate.trim())) {
-                            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                        }
-                        sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                    }
-                    else {
-                        sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                    }
+                    publicKeys = resolveSignaturePublicKeys(signatureNode, opts.metadata);
                 }
-                sig.signatureAlgorithm = signatureAlgorithm;
-                sig.loadSignature(signatureNode);
-                MessageSignatureStatus = sig.checkSignature(doc.toString());
+                MessageSignatureStatus = verifyXmlSignatureWithPublicKeys(signatureNode, [doc.toString()], publicKeys, signatureAlgorithm).verified;
                 if (!MessageSignatureStatus) {
                     throw new Error('ERR_FAILED_TO_VERIFY_MESSAGE_SIGNATURE');
                 }
             }
-            // ✅ 优化3: 修复断言签名算法路径
+            // Verify assertion signatures with exact algorithm resolution.
             if (isAssertionSigned && !encrypted) {
                 const signatureNode = assertionSignatureNode[0];
-                const signatureAlgorithm = getSignatureAlgorithm(signatureNode); // ✅ 修复
+                const signatureAlgorithm = getSignatureAlgorithm(signatureNode);
                 const checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm);
                 hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
                 unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                 if (checkResult.hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts, self)) {
                     throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                 }
-                const sig = new SignedXml();
+                let publicKeys = [];
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                 }
                 if (opts.keyFile) {
-                    sig.publicCert = fs.readFileSync(opts.keyFile);
+                    publicKeys = [fs.readFileSync(opts.keyFile)];
                 }
                 else if (opts.metadata) {
-                    const certificateNode = select(".//*[local-name() = 'X509Certificate']", signatureNode);
-                    let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    metadataCert = normalizeCertificates(metadataCert);
-                    if (certificateNode.length === 0 && metadataCert.length === 0) {
-                        throw new Error('NO_SELECTED_CERTIFICATE');
-                    }
-                    if (certificateNode.length !== 0) {
-                        const x509CertificateData = certificateNode[0].firstChild.data;
-                        const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        if (metadataCert.length >= 1 && !metadataCert.find((cert) => cert.trim() === x509Certificate.trim())) {
-                            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                        }
-                        sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                    }
-                    else {
-                        sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                    }
+                    publicKeys = resolveSignaturePublicKeys(signatureNode, opts.metadata);
                 }
-                sig.signatureAlgorithm = signatureAlgorithm;
-                sig.loadSignature(signatureNode);
-                // ✅ 优化4: 修复断言节点获取路径（精确匹配）
+                // Locate the assertion node with exact matching.
                 const assertionNode = select("/*[local-name() = 'Response' or local-name() = 'AuthnRequest']/*[local-name() = 'Assertion']", doc)[0];
                 if (assertionNode) {
                     const assertionDoc = dom.parseFromString(assertionNode.toString(), 'application/xml');
-                    AssertionSignatureStatus = sig.checkSignature(assertionDoc.toString());
+                    AssertionSignatureStatus = verifyXmlSignatureWithPublicKeys(signatureNode, [assertionDoc.toString()], publicKeys, signatureAlgorithm).verified;
                 }
                 else {
                     AssertionSignatureStatus = false;
@@ -696,7 +681,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     throw new Error('ERR_FAILED_TO_VERIFY_ASSERTION_SIGNATURE');
                 }
             }
-            // 处理仅加密断言的情况
+            // Handle encrypted assertion without an outer message signature.
             if (encrypted && !isMessageSigned) {
                 if (!encryptedAssertions || encryptedAssertions.length === 0) {
                     throw new Error('ERR_UNDEFINED_ENCRYPTED_ASSERTION');
@@ -720,7 +705,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     throw new Error('ERR_EXCEPTION_OF_ASSERTION_DECRYPTION');
                 }
             }
-            // ✅ 优化5: 修复断言内容获取路径（精确匹配）
+            // Extract assertion content with exact matching.
             else if (!encrypted && (isMessageSigned || isAssertionSigned)) {
                 const assertions = toNodeArray(select("/*[local-name() = 'Response' or local-name() = 'AuthnRequest']/*[local-name() = 'Assertion']", doc));
                 if (assertions?.length > 0) {
@@ -728,7 +713,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     assertionContent = assertions[0].toString();
                 }
             }
-            // 检查整体状态
+            // Check aggregate verification status.
             status = (!isMessageSigned || MessageSignatureStatus) &&
                 (!isAssertionSigned || AssertionSignatureStatus) &&
                 (!encrypted || decrypted);
@@ -751,15 +736,15 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             const { dom } = getContext();
             const doc = dom.parseFromString(xml, 'application/xml');
             const docParser = new DOMParser();
-            // 为 SOAP 消息定义 XPath
+            // Define XPath expressions for SOAP messages.
             const artifactResolveXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
             const artifactResponseXpath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResponse']";
-            // 检测 ArtifactResolve 或 ArtifactResponse 的存在
+            // Detect ArtifactResolve or ArtifactResponse.
             // @ts-expect-error
             const artifactResolveNodes = toNodeArray(select(artifactResolveXpath, doc));
             // @ts-expect-error
             const artifactResponseNodes = toNodeArray(select(artifactResponseXpath, doc));
-            // 根据消息类型选择合适的 XPath
+            // Select the base XPath from the SOAP message type.
             let basePath = "";
             if (artifactResolveNodes.length > 0) {
                 basePath = "/*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='ArtifactResolve']";
@@ -770,12 +755,12 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             else {
                 throw new Error('ERR_UNSUPPORTED_SOAP_MESSAGE_TYPE');
             }
-            // 基于 SOAP 结构重新定义 XPath
+            // Build XPath expressions from the SOAP structure.
             const messageSignatureXpath = `${basePath}/*[local-name(.)='Signature']`;
             const assertionSignatureXpath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Signature']`;
             const wrappingElementsXPath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Subject']/*[local-name(.)='SubjectConfirmation']/*[local-name(.)='SubjectConfirmationData']//*[local-name(.)='Assertion' or local-name(.)='Signature']`;
             const encryptedAssertionsXpath = `${basePath}/*[local-name(.)='Response']/*[local-name(.)='EncryptedAssertion']`;
-            // 包装攻击检测
+            // Detect wrapping attacks.
             // @ts-expect-error
             const wrappingElementNode = toNodeArray(select(wrappingElementsXPath, doc));
             if (wrappingElementNode.length !== 0) {
@@ -794,7 +779,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             if (assertionSignatureNode.length > 0) {
                 selection = selection.concat(assertionSignatureNode);
             }
-            // 处理加密断言的情况
+            // Handle encrypted assertions.
             if (selection.length === 0) {
                 if (encryptedAssertions.length > 0) {
                     if (encryptedAssertions.length > 1) {
@@ -806,54 +791,35 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             if (selection.length === 0) {
                 throw new Error('ERR_ZERO_SIGNATURE');
             }
-            // 尝试所有签名节点
+            // Try each signature node.
             for (const signatureNode of selection) {
-                const sig = new SignedXml();
-                let verified = false;
-                // 检测不安全的签名算法
+                let publicKeys = [];
+                // Detect unsafe signature algorithms.
                 const { hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm } = checkUnsafeSignatureAlgorithm(opts.signatureAlgorithm || '');
                 if (hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts)) {
                     throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                 }
-                sig.signatureAlgorithm = opts.signatureAlgorithm;
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                 }
                 if (opts.keyFile) {
-                    sig.publicCert = fs.readFileSync(opts.keyFile);
+                    publicKeys = [fs.readFileSync(opts.keyFile)];
                 }
                 if (opts.metadata) {
-                    const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
-                    // 证书处理逻辑
-                    let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    metadataCert = normalizeCertificates(metadataCert);
-                    // 没有证书的情况
-                    if (certificateNode.length === 0 && metadataCert.length === 0) {
-                        throw new Error('NO_SELECTED_CERTIFICATE');
-                    }
-                    if (certificateNode.length !== 0) {
-                        const x509CertificateData = certificateNode[0].firstChild.data;
-                        const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        if (metadataCert.length >= 1 && !metadataCert.includes(x509Certificate)) {
-                            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                        }
-                        sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                    }
-                    else {
-                        sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                    }
+                    publicKeys = resolveSignaturePublicKeys(signatureNode, opts.metadata);
                 }
-                sig.loadSignature(signatureNode);
-                verified = sig.checkSignature(xml); // 使用原始XML验证
+                const verifyResult = verifyXmlSignatureWithPublicKeys(signatureNode, [xml], publicKeys, opts.signatureAlgorithm);
+                const verified = verifyResult.verified;
+                const sig = verifyResult.sig;
                 if (!verified) {
                     throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
                 }
-                if (sig.getSignedReferences().length < 1) {
+                if (!sig || sig.getSignedReferences().length < 1) {
                     throw new Error('NO_SIGNATURE_REFERENCES');
                 }
                 const signedVerifiedXML = sig.getSignedReferences()[0];
                 const rootNode = docParser.parseFromString(signedVerifiedXML, 'application/xml').documentElement;
-                // 处理签名的内容
+                // Handle signed content.
                 switch (rootNode?.localName) {
                     case 'Response':
                         // @ts-expect-error
@@ -866,17 +832,17 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         if (assertions.length === 1) {
                             return [true, assertions[0].toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                         }
-                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // 签名验证成功但未找到断言
+                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // Signature verified, but no assertion was found.
                     case 'Assertion':
                         return [true, rootNode.toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     case 'EncryptedAssertion':
                         return [true, rootNode.toString(), true, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     case 'ArtifactResolve':
                     case 'ArtifactResponse':
-                        // 提取SOAP消息内部的实际内容
+                        // Extract the actual message inside the SOAP envelope.
                         return [true, rootNode.toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     default:
-                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // 签名验证成功但未找到可识别的内容
+                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // Signature verified, but no recognized content was found.
                 }
             }
             return [false, null, encryptedAssertions.length > 0, false, false, null];
@@ -911,18 +877,18 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             };
         },
         /**
-         * SAML 消息签名 (符合 SAML V2.0 绑定规范)
-         * @param octetString - 要签名的原始数据 (OCTET STRING)
-         * @param key - PEM 格式私钥
-         * @param passphrase - 私钥密码 (如果有加密)
-         * @param isBase64 - 是否返回 base64 编码 (默认 true)
-         * @param signingAlgorithm - 签名算法 (默认 'rsa-sha256')
-         * @returns 消息签名
+         * Sign a SAML message according to the SAML V2.0 binding specification.
+         * @param octetString - Raw data to sign as an OCTET STRING.
+         * @param key - Private key in PEM format.
+         * @param passphrase - Private key passphrase, when encrypted.
+         * @param isBase64 - Whether to return base64 encoding. Defaults to true.
+         * @param signingAlgorithm - Signature algorithm. Defaults to rsa-sha256.
+         * @returns Message signature.
          */
         constructMessageSignature(octetString, key, passphrase, isBase64, signingAlgorithm, securityOptions) {
             try {
                 const algorithm = getSigningAlgorithm(signingAlgorithm ?? signatureAlgorithms.RSA_SHA256, securityOptions);
-                const privateKeyPem = utility.readPrivateKey(key, passphrase); // 假设utility对象存在
+                const privateKeyPem = utility.readPrivateKey(key, passphrase);
                 const signer = crypto.createSign(algorithm);
                 signer.update(octetString, 'utf8');
                 const signature = signer.sign({
@@ -945,16 +911,32 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          * @param  {string} verifyAlgorithm            algorithm used to verify
          * @return {boolean} verification result
          */
-        verifyMessageSignature(metadata, // 假设metadata对象有getX509Certificate方法
-        octetString, signature, verifyAlgorithm, securityOptions) {
+        verifyMessageSignature(metadata, octetString, signature, verifyAlgorithm, securityOptions) {
             try {
-                const signCert = metadata.getX509Certificate('signing'); // 假设certUse.signing是'signing'
+                const signCerts = normalizeCertificates(metadata.getX509Certificate('signing'));
                 const algorithm = getSigningAlgorithm(verifyAlgorithm, securityOptions);
-                const publicKeyPem = utility.getPublicKeyPemFromCertificate(signCert); // 假设utility对象存在
-                const verifier = crypto.createVerify(algorithm);
-                verifier.update(octetString, 'utf8');
+                if (signCerts.length === 0) {
+                    throw new Error('ERR_METADATA_MISSING_SIGNING_CERT');
+                }
                 const signatureBuffer = typeof signature === 'string' ? Buffer.from(signature, 'base64') : signature;
-                return verifier.verify(publicKeyPem, signatureBuffer);
+                let lastError = null;
+                for (const signCert of signCerts) {
+                    try {
+                        const publicKeyPem = utility.getPublicKeyPemFromCertificate(signCert);
+                        const verifier = crypto.createVerify(algorithm);
+                        verifier.update(octetString, 'utf8');
+                        if (verifier.verify(publicKeyPem, signatureBuffer)) {
+                            return true;
+                        }
+                    }
+                    catch (error) {
+                        lastError = error;
+                    }
+                }
+                if (lastError && signCerts.length === 1) {
+                    throw lastError;
+                }
+                return false;
             }
             catch (error) {
                 console.error('Signature verification failed:', error);
@@ -1005,7 +987,10 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 const rawAssertionNode = assertions[0];
                 // Perform encryption depends on the setting, default is false
                 if (sourceEntitySetting.isAssertionEncrypted) {
-                    let encryptPem = targetEntityMetadata.getX509Certificate(certUse.encrypt);
+                    let encryptPem = normalizeCertificates(targetEntityMetadata.getX509Certificate(certUse.encrypt))[0];
+                    if (!encryptPem) {
+                        throw new Error('ERR_METADATA_MISSING_ENCRYPTION_CERT');
+                    }
                     const publicKeyPem = utility.getPublicKeyPemFromCertificate(encryptPem);
                     xmlenc.encrypt(rawAssertionNode.toString(), {
                         // use xml-encryption module
@@ -1016,9 +1001,9 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         keyEncryptionDigest: sourceEntitySetting.keyEncryptionDigest,
                         keyEncryptionMgf1: sourceEntitySetting.keyEncryptionMgf1,
                         keyEncryptionOAEPParams: sourceEntitySetting.keyEncryptionOAEPParams,
-                        disallowEncryptionWithInsecureAlgorithm: sourceEntitySetting.disallowEncryptionWithInsecureAlgorithm, // 禁止使用rsa-1_5  tripledes-cbc
-                        disallowInsecureEncryption: sourceEntitySetting.disallowInsecureEncryption, //禁aes cbc系列加密算法
-                        disallowInsecureHash: sourceEntitySetting.disallowInsecureHash, //禁止使用不安全的签名hash算法，不包括mgf1
+                        disallowEncryptionWithInsecureAlgorithm: sourceEntitySetting.disallowEncryptionWithInsecureAlgorithm, // Disallow rsa-1_5 and tripledes-cbc.
+                        disallowInsecureEncryption: sourceEntitySetting.disallowInsecureEncryption, // Disallow AES-CBC encryption algorithms.
+                        disallowInsecureHash: sourceEntitySetting.disallowInsecureHash, // Disallow unsafe signature hash algorithms except MGF1.
                         warnInsecureAlgorithm: true
                     }, (err, res) => {
                         if (err) {
@@ -1039,10 +1024,10 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             });
         },
         /**
-         * 同步版本的断言解密函数
+         * Synchronous assertion decryption helper.
          */
         /**
-         * 同步版本的断言解密函数，支持解密后验证断言签名
+         * Synchronous assertion decryption helper with post-decryption signature validation.
          */
         async decryptAssertionAsync(here, entireXML, opts) {
             const hereSetting = here.entitySetting;
@@ -1056,16 +1041,16 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 throw new Error('ERR_MULTIPLE_ASSERTION');
             }
             const encAssertionNode = encryptedAssertions[0];
-            // 将 DOM 节点转换为 XML 字符串
+            // Convert the DOM node to an XML string.
             const encAssertionXml = encAssertionNode.toString();
-            // 使用 Promise 包装异步解密
+            // Wrap asynchronous decryption in a Promise.
             let decryptedResult;
             try {
                 const decryptResult = await xmlenc.decrypt(encAssertionXml, {
                     key: utility.readPrivateKey(hereSetting.encPrivateKey, hereSetting.encPrivateKeyPass),
                     warnInsecureAlgorithm: true,
                 });
-                // xmlenc.decrypt 返回 Buffer，需要转换为字符串
+                // xmlenc.decrypt may return Buffer, so convert it to string.
                 decryptedResult = typeof decryptResult === 'string' ? decryptResult : decryptResult.toString();
             }
             catch (err) {
@@ -1073,13 +1058,13 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             }
             let hasUnsafeSignatureAlgorithm = false;
             let unsafeSignatureAlgorithm = "";
-            // 解密完成后，检查解密后的断言是否还有签名需要验证
+            // After decryption, check whether the assertion still has a signature to verify.
             const decryptedAssertionDoc = dom.parseFromString(decryptedResult, 'application/xml');
             let AssertionSignatureStatus = false;
-            // 检查解密后的断言是否有签名
+            // Check whether the decrypted assertion has a signature.
             const assertionSignatureNode = toNodeArray(select("/*[local-name(.)='Assertion']/*[local-name(.)='Signature']", decryptedAssertionDoc));
             if (assertionSignatureNode.length > 0 && opts) {
-                // 解密后的断言有签名，需要验证
+                // Verify the signature on the decrypted assertion.
                 const signatureNode = assertionSignatureNode[0];
                 const signatureAlgorithm = xpath.select1(".//*[local-name(.)='SignatureMethod']/@Algorithm", signatureNode);
                 let checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm.value || '');
@@ -1088,50 +1073,32 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 if (checkResult.hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts, here)) {
                     throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                 }
-                const sig = new SignedXml();
+                let publicKeys = [];
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
                 }
                 if (opts.keyFile) {
-                    sig.publicCert = fs.readFileSync(opts.keyFile);
+                    publicKeys = [fs.readFileSync(opts.keyFile)];
                 }
                 else if (opts.metadata) {
-                    const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
-                    let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    metadataCert = normalizeCertificates(metadataCert);
-                    if (certificateNode.length === 0 && metadataCert.length === 0) {
-                        throw new Error('NO_SELECTED_CERTIFICATE');
-                    }
-                    if (certificateNode.length !== 0) {
-                        const x509CertificateData = certificateNode[0].firstChild.data;
-                        const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        if (metadataCert.length >= 1 && !metadataCert.find((cert) => cert.trim() === x509Certificate.trim())) {
-                            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                        }
-                        sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                    }
-                    else {
-                        sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                    }
+                    publicKeys = resolveSignaturePublicKeys(signatureNode, opts.metadata);
                 }
-                // 检测不安全的签名算法
+                // Detect unsafe signature algorithms.
                 let checkSafeResult = checkUnsafeSignatureAlgorithm(opts.signatureAlgorithm || '');
                 hasUnsafeSignatureAlgorithm = checkSafeResult.hasUnsafeSignatureAlgorithm;
                 unsafeSignatureAlgorithm = checkSafeResult.unsafeSignatureAlgorithm ?? "";
                 if (checkSafeResult.hasUnsafeSignatureAlgorithm && !resolveAllowLegacySha1(opts, here)) {
                     throw new Error('ERR_UNSAFE_SIGNATURE_ALGORITHM');
                 }
-                sig.signatureAlgorithm = opts.signatureAlgorithm;
-                sig.loadSignature(signatureNode);
-                // 验证解密后断言的签名
+                // Verify the decrypted assertion signature.
                 const assertionDocForVerification = dom.parseFromString(decryptedResult, 'application/xml');
-                const assertionValid = sig.checkSignature(assertionDocForVerification.toString());
+                const assertionValid = verifyXmlSignatureWithPublicKeys(signatureNode, [assertionDocForVerification.toString()], publicKeys, opts.signatureAlgorithm).verified;
                 AssertionSignatureStatus = assertionValid;
                 if (!assertionValid) {
                     throw new Error('ERR_FAILED_TO_VERIFY_DECRYPTED_ASSERTION_SIGNATURE');
                 }
             }
-            // 将解密后的断言替换原始文档中的加密断言
+            // Replace the encrypted assertion with the decrypted assertion.
             const rawAssertionDoc = dom.parseFromString(decryptedResult, 'application/xml');
             // @ts-ignore
             doc.documentElement.replaceChild(rawAssertionDoc.documentElement, encAssertionNode);
@@ -1143,19 +1110,19 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 }];
         },
         /**
-         * 解密 SOAP 响应中的加密断言
-         * @param self 当前实体（SP 或 IdP）
-         * @param entireXML 完整的 SOAP XML 响应
-         * @returns [解密后的完整 SOAP XML, 解密后的断言 XML]
+         * Decrypt an encrypted assertion in a SOAP response.
+         * @param self Current entity, SP or IdP.
+         * @param entireXML Complete SOAP XML response.
+         * @returns Decrypted full SOAP XML and decrypted assertion XML.
          */
         async decryptAssertionSoap(self, entireXML) {
             let hereSetting = self.entitySetting;
             const { dom } = getContext();
             try {
-                // 1. 解析 XML
+                // Parse XML.
                 // @ts-ignore
                 const doc = dom.parseFromString(entireXML, 'application/xml');
-                // 2. 定位加密断言
+                // Locate encrypted assertions.
                 const encryptedAssertions = select("/*[local-name()='Envelope']/*[local-name()='Body']" +
                     "/*[local-name()='ArtifactResponse']/*[local-name()='Response']" +
                     "/*[local-name()='EncryptedAssertion']", 
@@ -1165,17 +1132,17 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     throw new Error('ERR_ENCRYPTED_ASSERTION_NOT_FOUND');
                 }
                 if (encryptedAssertions.length > 1) {
-                    console.warn('发现多个加密断言，仅处理第一个');
+                    console.warn('Multiple encrypted assertions found; only the first one will be processed');
                 }
                 const encAssertionNode = encryptedAssertions[0];
-                // 3. 准备解密密钥
+                // Prepare the decryption key.
                 const privateKey = utility.readPrivateKey(self.entitySetting.encPrivateKey, self.entitySetting.encPrivateKeyPass);
-                // 4. 解密断言
+                // Decrypt the assertion.
                 const decryptedAssertion = await new Promise((resolve, reject) => {
                     xmlenc.decrypt(encAssertionNode.toString(), { key: privateKey,
-                        disallowInsecureEncryption: hereSetting.disallowInsecureEncryption, //开启会禁止解密使用aes cbc系列加密算法的xml
-                        disallowDecryptionWithInsecureAlgorithm: hereSetting.disallowDecryptionWithInsecureAlgorithm, //开启会禁止解密使用rsa-1_5 tripledes-cbc加密算法的xml
-                        disallowInsecureHash: hereSetting.disallowInsecureHash, //开启会禁止解密使用 hsa1系列 hash算法的xml
+                        disallowInsecureEncryption: hereSetting.disallowInsecureEncryption, // Disallow AES-CBC encrypted XML.
+                        disallowDecryptionWithInsecureAlgorithm: hereSetting.disallowDecryptionWithInsecureAlgorithm, // Disallow rsa-1_5 and tripledes-cbc encrypted XML.
+                        disallowInsecureHash: hereSetting.disallowInsecureHash, // Disallow SHA1-family hash algorithms.
                         warnInsecureAlgorithm: true,
                     }, (err, result) => {
                         if (err) {
@@ -1187,18 +1154,18 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         resolve(typeof result === 'string' ? result : result.toString());
                     });
                 });
-                // 5. 创建解密断言的 DOM
+                // Create a DOM from the decrypted assertion.
                 // @ts-ignore
                 const decryptedDoc = dom.parseFromString(decryptedAssertion, 'application/xml');
                 const decryptedAssertionNode = decryptedDoc.documentElement;
-                // 6. 替换加密断言为解密后的断言
+                // Replace the encrypted assertion with the decrypted assertion.
                 const parentNode = encAssertionNode.parentNode;
                 if (!parentNode) {
                     throw new Error('ERR_NO_PARENT_NODE_FOR_ENCRYPTED_ASSERTION');
                 }
                 // @ts-ignore
                 parentNode.replaceChild(decryptedAssertionNode, encAssertionNode);
-                // 7. 序列化更新后的文档
+                // Serialize the updated document.
                 const updatedSoapXml = doc.toString();
                 return [updatedSoapXml, decryptedAssertion];
             }

package/build/src/libsamlSoap.js

@@ -17,12 +17,12 @@ function toNodeArray(result) {
 }
 const certUse = wording.certUse;
 const docParser = new DOMParser();
-function resolvePublicCertificate(signatureNode, opts) {
+function resolvePublicCertificates(signatureNode, opts) {
     if (!opts.keyFile && !opts.metadata) {
         throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
     }
     if (opts.keyFile) {
-        return fs.readFileSync(opts.keyFile);
+        return [fs.readFileSync(opts.keyFile)];
     }
     const certificateNode = toNodeArray(select(".//*[local-name(.)='X509Certificate']", signatureNode));
     const metadataCerts = normalizeCertificates(opts.metadata.getX509Certificate(certUse.signing));
@@ -35,9 +35,9 @@ function resolvePublicCertificate(signatureNode, opts) {
         if (metadataCerts.length > 0 && !metadataCerts.includes(x509Certificate)) {
             throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
         }
-        return libsaml.getKeyInfo(x509Certificate).getKey();
+        return [libsaml.getKeyInfo(x509Certificate).getKey()];
     }
-    return libsaml.getKeyInfo(metadataCerts[0]).getKey();
+    return metadataCerts.map((cert) => libsaml.getKeyInfo(cert).getKey());
 }
 function extractResolvedMessage(rootNode) {
     const resolvedNodes = toNodeArray(select("./*[local-name()='Response' or local-name()='AuthnRequest' or local-name()='LogoutRequest' or local-name()='LogoutResponse']", rootNode));
@@ -48,14 +48,30 @@ function extractResolvedMessage(rootNode) {
 }
 function verifySignature(xml, signatureNodes, opts) {
     for (const signatureNode of signatureNodes) {
-        const sig = new SignedXml();
-        sig.publicCert = resolvePublicCertificate(signatureNode, opts);
-        sig.loadSignature(signatureNode);
-        const verified = sig.checkSignature(xml);
-        if (!verified) {
+        const publicKeys = resolvePublicCertificates(signatureNode, opts);
+        let verifiedSig = null;
+        let lastError = null;
+        for (const publicKey of publicKeys) {
+            try {
+                const sig = new SignedXml();
+                sig.publicCert = publicKey;
+                sig.loadSignature(signatureNode);
+                if (sig.checkSignature(xml)) {
+                    verifiedSig = sig;
+                    break;
+                }
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        if (!verifiedSig) {
+            if (lastError && publicKeys.length === 1) {
+                throw lastError;
+            }
             throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
         }
-        const signedReferences = sig.getSignedReferences();
+        const signedReferences = verifiedSig.getSignedReferences();
         if (signedReferences.length < 1) {
             throw new Error('NO_SIGNATURE_REFERENCES');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "samlesa",
-  "version": "4.7.1",
+  "version": "4.7.3",
   "description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
   "main": "build/index.js",
   "keywords": [

package/types/src/extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAMA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC;IAEnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AA4B/C,eAAO,MAAM,kBAAkB,EAAE,eAsFhC,CAAC;AAKF,eAAO,MAAM,qBAAqB,EAAE,eAsBnC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,eAsBpC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,eAGvC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,eAG/C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,eAGxC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAYrE,CAAC;AAqMF,eAAO,MAAM,mBAAmB,EAAE,eAMjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAIlC,CAAC;AAKF,eAAO,MAAM,iBAAiB,EAAE,eAiI/B,CAAC;AAOF,eAAO,MAAM,gBAAgB,EAAE,eAyL9B,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,OAiN/D;AASD,eAAO,MAAM,2BAA2B,EAAE,eAkZzC,CAAC;AAIF;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,OAkRrE;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,OAE5C;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,OAEzC;AAGD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,OAExC;AACD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,OAEjD;AACD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,OAE9C;AACD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,OAErD"}
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAMA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC;IAEnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AA4B/C,eAAO,MAAM,kBAAkB,EAAE,eAsFhC,CAAC;AAKF,eAAO,MAAM,qBAAqB,EAAE,eAsBnC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,eAsBpC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,eAGvC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,eAG/C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,eAGxC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAarE,CAAC;AAqMF,eAAO,MAAM,mBAAmB,EAAE,eAMjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAIlC,CAAC;AAKF,eAAO,MAAM,iBAAiB,EAAE,eAiI/B,CAAC;AAOF,eAAO,MAAM,gBAAgB,EAAE,eAyL9B,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,OAiN/D;AASD,eAAO,MAAM,2BAA2B,EAAE,eAkZzC,CAAC;AAIF;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,OAkRrE;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,OAE5C;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,OAEzC;AAGD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,OAExC;AACD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,OAEjD;AACD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,OAE9C;AACD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,OAErD"}

package/types/src/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAynBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA4rBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}

package/types/src/libsaml.d.ts

@@ -1,9 +1,9 @@
 import * as crypto from 'node:crypto';
 import type { MetadataInterface } from './metadata.js';
 /**
- * 生成 SAML Attribute 元素（不带 XML 声明头）
- * @param {Array} attributeData - 属性配置数据
- * @returns {string} SAML Attribute XML 字符串
+ * Generate SAML Attribute elements without an XML declaration.
+ * @param {Array} attributeData - Attribute configuration data.
+ * @returns {string} SAML Attribute XML string.
  */
 export interface SignatureConstructor {
     rawSamlMessage: string;
@@ -199,11 +199,11 @@ declare const _default: {
         publicKey?: undefined;
     };
     /**
-     * 改进的SAML签名验证函数，支持多种签名和加密组合场景
-     * @param xml SAML XML内容
-     * @param opts 验证选项
+     * Verify SAML signatures across message, assertion, and encryption combinations.
+     * @param xml SAML XML content.
+     * @param opts Verification options.
      * @param self
-     * @returns 验证结果对象
+     * @returns Verification result object.
      */
     verifySignature(xml: string, opts: SignatureVerifierOptions, self: any): Promise<any>;
     verifySignatureSoap(xml: string, opts: SignatureVerifierOptions): (string | boolean | null)[];
@@ -215,13 +215,13 @@ declare const _default: {
      */
     createKeySection(use: KeyUse, certString: string | Buffer): KeyComponent;
     /**
-     * SAML 消息签名 (符合 SAML V2.0 绑定规范)
-     * @param octetString - 要签名的原始数据 (OCTET STRING)
-     * @param key - PEM 格式私钥
-     * @param passphrase - 私钥密码 (如果有加密)
-     * @param isBase64 - 是否返回 base64 编码 (默认 true)
-     * @param signingAlgorithm - 签名算法 (默认 'rsa-sha256')
-     * @returns 消息签名
+     * Sign a SAML message according to the SAML V2.0 binding specification.
+     * @param octetString - Raw data to sign as an OCTET STRING.
+     * @param key - Private key in PEM format.
+     * @param passphrase - Private key passphrase, when encrypted.
+     * @param isBase64 - Whether to return base64 encoding. Defaults to true.
+     * @param signingAlgorithm - Signature algorithm. Defaults to rsa-sha256.
+     * @returns Message signature.
      */
     constructMessageSignature(octetString: string, key: string, passphrase?: string, isBase64?: boolean, signingAlgorithm?: string, securityOptions?: SignatureSecurityOptions): string | Buffer;
     /**
@@ -251,10 +251,10 @@ declare const _default: {
      */
     encryptAssertion(sourceEntity: any, targetEntity: any, xml?: string): Promise<string>;
     /**
-     * 同步版本的断言解密函数
+     * Synchronous assertion decryption helper.
      */
     /**
-     * 同步版本的断言解密函数，支持解密后验证断言签名
+     * Synchronous assertion decryption helper with post-decryption signature validation.
      */
     decryptAssertionAsync(here: any, entireXML: string, opts?: SignatureVerifierOptions): Promise<(string | {
         isAssertionSigned: boolean;
@@ -263,10 +263,10 @@ declare const _default: {
         unsafeSignatureAlgorithm: string;
     })[]>;
     /**
-     * 解密 SOAP 响应中的加密断言
-     * @param self 当前实体（SP 或 IdP）
-     * @param entireXML 完整的 SOAP XML 响应
-     * @returns [解密后的完整 SOAP XML, 解密后的断言 XML]
+     * Decrypt an encrypted assertion in a SOAP response.
+     * @param self Current entity, SP or IdP.
+     * @param entireXML Complete SOAP XML response.
+     * @returns Decrypted full SOAP XML and decrypted assertion XML.
      */
     decryptAssertionSoap(self: any, entireXML: string): Promise<[string, string]>;
     /**

package/types/src/libsaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAQA,OAAQ,KAAK,MAAM,MAAM,aAAa,CAAA;AAItC,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAoBrD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CACxD;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,wBAAwB,KAAK,MAAM,CAAC;IAExL,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACrK,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACvD;;6CA6Q4C,OAAO,KAAG,MAAM;gCAhQxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAgBkB,MAAM;;;;IA6R/D;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;OAGG;iCAC0B;QAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,GAAG,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC;QACpB,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KACrF,GAAG,MAAM;2CA0D6B,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAmCtE;;;;;;OAMG;yBAEwB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;6BAoWlE,MAAM,QAAQ,wBAAwB;IAqK/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAGY,MAAM,OAChB,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM,oBACP,wBAAwB,GAC3C,MAAM,GAAG,MAAM;IAyBd;;;;;;;OAOG;qCAES,GAAG,eACF,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM,oBACN,wBAAwB;IAoB5C;;;;SAIK;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IA4DzD;;OAEG;IACH;;OAEG;gDAC0C,MAAM,SAAS,wBAAwB;;;;;;IAiHpF;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA8EnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BjD,wBAAyB"}
+{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAQA,OAAQ,KAAK,MAAM,MAAM,aAAa,CAAA;AAItC,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AA8ErD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CACxD;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,wBAAwB,KAAK,MAAM,CAAC;IAExL,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACrK,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACvD;;6CA6Q4C,OAAO,KAAG,MAAM;gCAhQxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAgBkB,MAAM;;;;IA6R/D;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;OAGG;iCAC0B;QAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,GAAG,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC;QACpB,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KACrF,GAAG,MAAM;2CA0D6B,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAmCtE;;;;;;OAMG;yBAEwB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;6BAgTlE,MAAM,QAAQ,wBAAwB;IAmJ/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAGY,MAAM,OAChB,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM,oBACP,wBAAwB,GAC3C,MAAM,GAAG,MAAM;IAyBd;;;;;;;OAOG;qCAES,GAAG,eACF,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM,oBACN,wBAAwB;IAmC5C;;;;SAIK;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IA+DzD;;OAEG;IACH;;OAEG;gDAC0C,MAAM,SAAS,wBAAwB;;;;;;IAgGpF;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA8EnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BjD,wBAAyB"}

package/types/src/libsamlSoap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"libsamlSoap.d.ts","sourceRoot":"","sources":["../../src/libsamlSoap.ts"],"names":[],"mappings":"AAKA,OAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAiBjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAyGD,iBAAe,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoCpH;;;;AAED,wBAEE"}
+{"version":3,"file":"libsamlSoap.d.ts","sourceRoot":"","sources":["../../src/libsamlSoap.ts"],"names":[],"mappings":"AAKA,OAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAiBjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA4HD,iBAAe,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoCpH;;;;AAED,wBAEE"}