scimgateway 6.2.5 → 6.2.7

package/lib/saml/saml11.js

@@ -0,0 +1,197 @@
+var utils = require('./utils');
+var Parser = require('@xmldom/xmldom').DOMParser;
+var xmlenc = require('xml-encryption');
+var moment = require('moment');
+var async = require('async');
+var crypto = require('crypto');
+
+var EncryptXml = require('./xml/encrypt');
+var SignXml = require('./xml/sign');
+
+var saml11Template = '<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" MajorVersion="1" MinorVersion="1" AssertionID="" IssueInstant="">' +
+  '<saml:Conditions>' +
+  '<saml:AudienceRestrictionCondition />' +
+  '</saml:Conditions>' +
+  '<saml:AttributeStatement>' +
+  '<saml:Subject>' +
+  '<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />' +
+  '<saml:SubjectConfirmation>' +
+  '<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '</saml:AttributeStatement>' +
+  '<saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">' +
+  '<saml:Subject>' +
+  '<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">' +
+  '</saml:NameIdentifier>' +
+  '<saml:SubjectConfirmation>' +
+  '<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '</saml:AuthenticationStatement>' +
+  '</saml:Assertion>';
+
+var newSaml11Document = utils.factoryForNode(saml11Template);
+
+var NAMESPACE = 'urn:oasis:names:tc:SAML:1.0:assertion';
+
+function extractSaml11Options(opts) {
+  return {
+    uid: opts.uid,
+    issuer: opts.issuer,
+    lifetimeInSeconds: opts.lifetimeInSeconds,
+    audiences: opts.audiences,
+    attributes: opts.attributes,
+    nameIdentifier: opts.nameIdentifier,
+    nameIdentifierFormat: opts.nameIdentifierFormat,
+    subjectConfirmationMethod: opts.subjectConfirmationMethod,
+    holderOfKeyProofSecret: opts.holderOfKeyProofSecret,
+  };
+}
+
+/**
+ * Creates a signed SAML 1.1 assertion from the given options.
+ */
+exports.create = function(options, callback) {
+  return createAssertion(extractSaml11Options(options), {
+    signXml: SignXml.fromSignXmlOptions(Object.assign({
+      xpathToNodeBeforeSignature: "//*[local-name(.)='AuthenticationStatement']",
+      signatureIdAttribute: 'AssertionID'
+    }, options)),
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+}
+
+/**
+ * Creates an unsigned SAML 1.1 assertion from the given options.
+ */
+exports.createUnsignedAssertion = function(options, callback) {
+  return createAssertion(extractSaml11Options(options), {
+    signXml: SignXml.unsigned,
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+}
+
+function createAssertion(options, strategies, callback) {
+  var doc;
+  try {
+    doc = newSaml11Document();
+  } catch(err){
+    return utils.reportError(err, callback);
+  }
+
+  doc.documentElement.setAttribute('AssertionID', '_' + (options.uid || utils.uid(32)));
+  if (options.issuer)
+    doc.documentElement.setAttribute('Issuer', options.issuer);
+
+  var now = moment.utc();
+  doc.documentElement.setAttribute('IssueInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  var conditions = doc.documentElement.getElementsByTagName('saml:Conditions');
+
+  if (options.lifetimeInSeconds) {
+    conditions[0].setAttribute('NotBefore', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+    conditions[0].setAttribute('NotOnOrAfter', moment(now).add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  }
+
+  if (options.audiences) {
+    var audiences = options.audiences instanceof Array ? options.audiences : [options.audiences];
+    audiences.forEach(function (audience) {
+      var element = doc.createElementNS(NAMESPACE, 'saml:Audience');
+      element.textContent = audience;
+      var audienceCondition = conditions[0].getElementsByTagNameNS(NAMESPACE, 'AudienceRestrictionCondition')[0];
+      audienceCondition.appendChild(element);
+    });
+  }
+
+  if (options.attributes) {
+    var statement = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'AttributeStatement')[0];
+    Object.keys(options.attributes).forEach(function(prop) {
+      if(typeof options.attributes[prop] === 'undefined') return;
+
+      var name = prop.indexOf('/') > -1 ? prop.substring(prop.lastIndexOf('/') + 1) : prop;
+      var namespace = prop.indexOf('/') > -1 ? prop.substring(0, prop.lastIndexOf('/')) : '';
+      var attributeElement = doc.createElementNS(NAMESPACE, 'saml:Attribute');
+      attributeElement.setAttribute('AttributeNamespace', namespace);
+      attributeElement.setAttribute('AttributeName', name);
+      var values = options.attributes[prop] instanceof Array ? options.attributes[prop] : [options.attributes[prop]];
+      values.forEach(function (value) {
+        var valueElement = doc.createElementNS(NAMESPACE, 'saml:AttributeValue');
+        valueElement.textContent = value;
+        attributeElement.appendChild(valueElement);
+      });
+
+      if (values && values.length > 0) {
+        statement.appendChild(attributeElement);
+      }
+    });
+  }
+
+  doc.getElementsByTagName('saml:AuthenticationStatement')[0]
+    .setAttribute('AuthenticationInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+
+  var nameID = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameIdentifier')[0];
+
+  if (options.nameIdentifier) {
+    nameID.textContent = options.nameIdentifier;
+
+    doc.getElementsByTagName('saml:AuthenticationStatement')[0]
+      .getElementsByTagName('saml:NameIdentifier')[0]
+      .textContent = options.nameIdentifier;
+  }
+
+  if (options.nameIdentifierFormat) {
+    var nameIDs = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameIdentifier');
+    nameIDs[0].setAttribute('Format', options.nameIdentifierFormat);
+    nameIDs[1].setAttribute('Format', options.nameIdentifierFormat);
+  }
+
+  if (strategies.encryptXml === EncryptXml.unencrypted) {
+    var signed = strategies.signXml(doc);
+    return strategies.encryptXml(signed, callback);
+  }
+
+  // encryption is turned on,
+  var proofSecret;
+  async.waterfall([
+    function (cb) {
+      if (!options.subjectConfirmationMethod && options.subjectConfirmationMethod !== 'holder-of-key')
+        return cb();
+
+      crypto.randomBytes(32, function(err, randomBytes) {
+        proofSecret = randomBytes;
+        addSubjectConfirmation(strategies.encryptXml.encryptOptions, doc, options.holderOfKeyProofSecret || randomBytes, cb);
+      });
+    },
+    function(cb) {
+      strategies.signXml(doc, cb);
+    },
+    function(signed, cb) {
+      strategies.encryptXml(signed, cb);
+    }
+  ], function (err, result) {
+    if (err) return callback(err);
+    callback(null, result, proofSecret);
+  });
+}
+
+function addSubjectConfirmation(encryptOptions, doc, randomBytes, callback) {
+  xmlenc.encryptKeyInfo(randomBytes, encryptOptions, function(err, keyinfo) {
+    if (err) return callback(err);
+    var subjectConfirmationNodes = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'SubjectConfirmation');
+
+    for (var i=0; i<subjectConfirmationNodes.length; i++) {
+      var keyinfoDom;
+      try {
+        keyinfoDom = new Parser().parseFromString(keyinfo);
+      } catch(error){
+        return utils.reportError(error, callback);
+      }
+
+      var method = subjectConfirmationNodes[i].getElementsByTagNameNS(NAMESPACE, 'ConfirmationMethod')[0];
+      method.textContent = 'urn:oasis:names:tc:SAML:1.0:cm:holder-of-key';
+      subjectConfirmationNodes[i].appendChild(keyinfoDom.documentElement);
+    }
+
+    callback();
+  });
+}

package/lib/saml/saml20.js

@@ -0,0 +1,205 @@
+var async = require('async');
+var moment = require('moment');
+var xmlNameValidator = require('xml-name-validator');
+var is_uri = require('valid-url').is_uri;
+
+var EncryptXml = require('./xml/encrypt');
+var SignXml = require('./xml/sign');
+var utils = require('./utils');
+
+var saml20Template = '<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="" IssueInstant="">' +
+  '<saml:Issuer></saml:Issuer>' +
+  '<saml:Subject>' +
+  '<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />' +
+  '<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">' +
+  '<saml:SubjectConfirmationData />' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '<saml:Conditions />' +
+  '<saml:AuthnStatement AuthnInstant="">' +
+  '<saml:AuthnContext>' +
+  '<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>' +
+  '</saml:AuthnContext>' +
+  '</saml:AuthnStatement>' +
+  '</saml:Assertion>';
+
+var newSaml20Document = utils.factoryForNode(saml20Template);
+
+var NAMESPACE = 'urn:oasis:names:tc:SAML:2.0:assertion';
+
+function getAttributeType(value){
+  switch(typeof value) {
+    case "string":
+      return 'xs:string';
+    case "boolean":
+      return 'xs:boolean';
+    case "number":
+      return 'xs:double';
+    default:
+      return 'xs:anyType';
+  }
+}
+
+function getNameFormat(name){
+  if (is_uri(name)){
+    return 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+  }
+
+  if (xmlNameValidator.name(name).success){
+    return 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic';
+  }
+
+  return 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified';
+}
+
+function extractSaml20Options(opts) {
+  return {
+    uid: opts.uid,
+    issuer: opts.issuer,
+    lifetimeInSeconds: opts.lifetimeInSeconds,
+    audiences: opts.audiences,
+    recipient: opts.recipient,
+    inResponseTo: opts.inResponseTo,
+    attributes: opts.attributes,
+    includeAttributeNameFormat: (typeof opts.includeAttributeNameFormat !== 'undefined') ? opts.includeAttributeNameFormat : true,
+    typedAttributes: (typeof opts.typedAttributes !== 'undefined') ? opts.typedAttributes : true,
+    sessionIndex: opts.sessionIndex,
+    nameIdentifier: opts.nameIdentifier,
+    nameIdentifierFormat: opts.nameIdentifierFormat,
+    authnContextClassRef: opts.authnContextClassRef
+  };
+}
+
+/**
+ * Creates a signed SAML 2.0 assertion from the given options.
+ */
+exports.create = function createSignedAssertion(options, callback) {
+  return createAssertion(extractSaml20Options(options), {
+    signXml: SignXml.fromSignXmlOptions(Object.assign({
+      xpathToNodeBeforeSignature: "//*[local-name(.)='Issuer']",
+      signatureIdAttribute: 'ID'
+    }, options)),
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+};
+
+/**
+ * Creates an unsigned SAML 2.0 assertion from the given options.
+ */
+exports.createUnsignedAssertion = function createUnsignedAssertion(options, callback) {
+  return createAssertion(extractSaml20Options(options), {
+    signXml: SignXml.unsigned,
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+};
+
+function createAssertion(options, strategies, callback) {
+  var doc = newSaml20Document();
+
+  doc.documentElement.setAttribute('ID', '_' + (options.uid || utils.uid(32)));
+  if (options.issuer) {
+    var issuer = doc.documentElement.getElementsByTagName('saml:Issuer');
+    issuer[0].textContent = options.issuer;
+  }
+
+  var now = moment.utc();
+  doc.documentElement.setAttribute('IssueInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  var conditions = doc.documentElement.getElementsByTagName('saml:Conditions');
+  var confirmationData = doc.documentElement.getElementsByTagName('saml:SubjectConfirmationData');
+
+  if (options.lifetimeInSeconds) {
+    conditions[0].setAttribute('NotBefore', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+    conditions[0].setAttribute('NotOnOrAfter', now.clone().add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  
+    confirmationData[0].setAttribute('NotOnOrAfter', now.clone().add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  }
+  
+  if (options.audiences) {
+    var audienceRestriction = doc.createElementNS(NAMESPACE, 'saml:AudienceRestriction');
+    var audiences = options.audiences instanceof Array ? options.audiences : [options.audiences];
+    audiences.forEach(function (audience) {
+      var element = doc.createElementNS(NAMESPACE, 'saml:Audience');
+      element.textContent = audience;
+      audienceRestriction.appendChild(element);
+    });
+
+    conditions[0].appendChild(audienceRestriction); 
+  }
+
+  if (options.recipient)
+    confirmationData[0].setAttribute('Recipient', options.recipient);
+
+  if (options.inResponseTo)
+    confirmationData[0].setAttribute('InResponseTo', options.inResponseTo);
+
+  if (options.attributes) {
+    var statement = doc.createElementNS(NAMESPACE, 'saml:AttributeStatement');
+    statement.setAttribute('xmlns:xs', 'http://www.w3.org/2001/XMLSchema');
+    statement.setAttribute('xmlns:xsi', 'http://www.w3.org/2001/XMLSchema-instance');
+    doc.documentElement.appendChild(statement);
+    Object.keys(options.attributes).forEach(function(prop) {
+      if(typeof options.attributes[prop] === 'undefined') return;
+
+      var attributeElement = doc.createElementNS(NAMESPACE, 'saml:Attribute');
+      attributeElement.setAttribute('Name', prop);
+
+      if (options.includeAttributeNameFormat){
+        attributeElement.setAttribute('NameFormat', getNameFormat(prop));        
+      }
+
+      var values = options.attributes[prop] instanceof Array ? options.attributes[prop] : [options.attributes[prop]];
+      values.forEach(function (value) {
+        if (typeof value !== 'undefined') {
+          var valueElement = doc.createElementNS(NAMESPACE, 'saml:AttributeValue');
+          valueElement.setAttribute('xsi:type', options.typedAttributes ? getAttributeType(value) : 'xs:anyType');
+          valueElement.textContent = value;
+          attributeElement.appendChild(valueElement);
+        }
+      });
+
+      if (values && values.filter(function(i){ return typeof i !== 'undefined'; }).length > 0) {
+        statement.appendChild(attributeElement);
+      }
+    });
+  }
+
+  doc.getElementsByTagName('saml:AuthnStatement')[0]
+    .setAttribute('AuthnInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+
+  if (options.sessionIndex) {
+    doc.getElementsByTagName('saml:AuthnStatement')[0]
+      .setAttribute('SessionIndex', options.sessionIndex);
+  }
+
+  var nameID = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameID')[0];
+  
+  if (options.nameIdentifier) {
+    nameID.textContent = options.nameIdentifier;
+  }
+
+  if (options.nameIdentifierFormat) {
+    nameID.setAttribute('Format', options.nameIdentifierFormat);
+  }
+  
+  if( options.authnContextClassRef ) {
+    doc.getElementsByTagName('saml:AuthnContextClassRef')[0]
+      .textContent = options.authnContextClassRef;
+  }
+
+  if (strategies.encryptXml === EncryptXml.unencrypted) {
+    var signed = strategies.signXml(doc);
+    return strategies.encryptXml(signed, callback);
+  }
+
+  async.waterfall([
+    function(cb) {
+      strategies.signXml(doc, cb);
+    },
+    function(signed, cb) {
+      strategies.encryptXml(signed, cb);
+    }
+  ], function (err, result) {
+    if (err) return callback(err);
+    callback(null, result);
+  });
+}

package/lib/saml/utils.js

@@ -0,0 +1,94 @@
+const Parser = require('@xmldom/xmldom').DOMParser;
+
+exports.pemToCert = function(pem) {
+  const cert = /-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g.exec(pem.toString());
+  if (cert && cert.length > 0) {
+    return cert[1].replace(/[\n|\r\n]/g, '');
+  }
+
+  return null;
+};
+
+exports.reportError = function(err, callback){
+  if (callback){
+    setImmediate(function(){
+      callback(err);
+    });
+  }
+};
+
+/**
+ * Return a unique identifier with the given `len`.
+ *
+ *     utils.uid(10);
+ *     // => "FDaS435D2z"
+ *
+ * @param {Number} len
+ * @return {String}
+ * @api private
+ */
+exports.uid = function(len) {
+  const buf = []
+      , chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+      , charlen = chars.length;
+
+  for (let i = 0; i < len; ++i) {
+    buf.push(chars[getRandomInt(0, charlen - 1)]);
+  }
+
+  return buf.join('');
+};
+
+exports.removeWhitespace = function(xml) {
+  return xml
+      .replace(/\r\n/g, '')
+      .replace(/\n/g, '')
+      .replace(/>(\s*)</g, '><') //unindent
+      .trim();
+};
+
+/**
+ * Return a random int, used by `utils.uid()`
+ *
+ * @param {Number} min
+ * @param {Number} max
+ * @return {Number}
+ * @api private
+ */
+
+function getRandomInt(min, max) {
+  return Math.floor(Math.random() * (max - min + 1)) + min;
+}
+
+/**
+ * Returns a function that can be called to create a new Node from an inline template string.
+ *
+ * @param {string} templateString the XML template content
+ * @return {function(): Node}
+ */
+exports.factoryForNode = function factoryForNode(templateString) {
+  const prototypeDoc = new Parser().parseFromString(templateString);
+
+  return function () {
+    return prototypeDoc.cloneNode(true);
+  };
+};
+
+/**
+ * Standardizes PEM content to match the spec (best effort)
+ *
+ * @param pem {Buffer} The PEM content to standardize
+ * @returns {Buffer} The standardized PEM. Original will be returned unmodified if the content is not PEM.
+ */
+exports.fixPemFormatting = function (pem) {
+  let pemEntries = pem.toString().matchAll(/([-]{5}[^-\r\n]+[-]{5})([^-]*)([-]{5}[^-\r\n]+[-]{5})/g);
+  let fixedPem = ''
+  for (const pemParts of pemEntries) {
+    fixedPem = fixedPem.concat(`${pemParts[1]}\n${pemParts[2].replaceAll(/[\r\n]/g, '')}\n${pemParts[3]}\n`)
+  }
+  if (fixedPem.length === 0) {
+    return pem;
+  }
+
+  return Buffer.from(fixedPem)
+}

package/lib/saml/xml/encrypt.js

@@ -0,0 +1,56 @@
+const xmlenc = require('xml-encryption');
+
+const utils = require('../utils');
+
+exports.fromEncryptXmlOptions = function (options) {
+  if (!options.encryptionCert) {
+    return this.unencrypted;
+  } else {
+    const encryptOptions = {
+      rsa_pub: options.encryptionPublicKey,
+      pem: options.encryptionCert,
+      encryptionAlgorithm: options.encryptionAlgorithm || 'http://www.w3.org/2009/xmlenc11#aes256-gcm',
+      keyEncryptionAlgorithm: options.keyEncryptionAlgorithm || 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
+      disallowEncryptionWithInsecureAlgorithm: options?.disallowEncryptionWithInsecureAlgorithm !== false,
+      warnInsecureAlgorithm: options?.warnOnInsecureEncryptionAlgorithm !== false,
+    };
+
+    // expose the encryptOptions as these are needed when adding the SubjectConfirmation
+    return Object.assign(this.encrypted(encryptOptions), { encryptOptions: encryptOptions });
+  }
+};
+
+exports.unencrypted = function (xml, callback) {
+  if (callback) {
+    return setImmediate(callback, null, xml);
+  } else {
+    return xml;
+  }
+};
+
+exports.encrypted = function (encryptOptions) {
+  return function encrypt(xml, callback) {
+    xmlenc.encrypt(xml, encryptOptions, function (err, encrypted) {
+      if (err) {
+        // Attempt to fix errors and retry
+        xmlenc.encrypt(
+            xml,
+            {
+              ...encryptOptions,
+              rsa_pub: utils.fixPemFormatting(encryptOptions.rsa_pub),
+              pem: utils.fixPemFormatting(encryptOptions.pem),
+            },
+            function (retryErr, retryEncrypted) {
+              if (retryErr) {
+                return callback(retryErr);
+              }
+
+              callback(null, utils.removeWhitespace(retryEncrypted));
+            }
+        );
+      } else {
+        callback(null, utils.removeWhitespace(encrypted));
+      }
+    });
+  };
+};

package/lib/saml/xml/sign.js

@@ -0,0 +1,104 @@
+const utils = require('../utils');
+const SignedXml = require('xml-crypto').SignedXml;
+
+const algorithms = {
+  signature: {
+    'rsa-sha256': 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
+    'rsa-sha1': 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
+  },
+  digest: {
+    'sha256': 'http://www.w3.org/2001/04/xmlenc#sha256',
+    'sha1': 'http://www.w3.org/2000/09/xmldsig#sha1'
+  }
+};
+
+exports.fromSignXmlOptions = function (options) {
+  if (!options.key)
+    throw new Error('Expect a private key in pem format');
+
+  if (!options.cert)
+    throw new Error('Expect a public key cert in pem format');
+
+  if (!options.xpathToNodeBeforeSignature)
+    throw new Error('xpathToNodeBeforeSignature is required')
+
+  const key = options.key;
+  const pem = options.cert;
+  const signatureAlgorithm = options.signatureAlgorithm || 'rsa-sha256';
+  const digestAlgorithm = options.digestAlgorithm || 'sha256';
+  const signatureNamespacePrefix = (function (prefix) {
+    // 0.10.1 added prefix, but we want to name it signatureNamespacePrefix - This is just to keep supporting prefix
+    return typeof prefix === 'string' ? prefix : '';
+  })(options.signatureNamespacePrefix || options.prefix);
+  const xpathToNodeBeforeSignature = options.xpathToNodeBeforeSignature;
+  const idAttribute = options.signatureIdAttribute;
+
+  /**
+   * @param {Document} doc
+   * @param {Function} [callback]
+   * @return {string}
+   */
+  return function signXmlDocument(doc, callback) {
+    function sign(key) {
+      const unsigned = exports.unsigned(doc);
+      const cert = utils.pemToCert(pem);
+
+      const sig = new SignedXml(null, {
+        signatureAlgorithm: algorithms.signature[signatureAlgorithm],
+        idAttribute: idAttribute
+      });
+      sig.addReference("//*[local-name(.)='Assertion']",
+          ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", "http://www.w3.org/2001/10/xml-exc-c14n#"],
+          algorithms.digest[digestAlgorithm]);
+
+      sig.signingKey = key;
+
+      sig.keyInfoProvider = {
+        getKeyInfo: function (key, prefix) {
+          prefix = prefix ? prefix + ':' : prefix;
+          return "<" + prefix + "X509Data><" + prefix + "X509Certificate>" + cert + "</" + prefix + "X509Certificate></" + prefix + "X509Data>";
+        }
+      };
+
+      sig.computeSignature(unsigned, {
+        location: {reference: xpathToNodeBeforeSignature, action: 'after'},
+        prefix: signatureNamespacePrefix
+      });
+
+      return sig.getSignedXml();
+    }
+
+    let signed
+    try {
+      try {
+        signed = sign(key)
+      } catch (err) {
+        signed = sign(utils.fixPemFormatting(key))
+      }
+
+      if (callback) {
+        setImmediate(callback, null, signed);
+      } else {
+        return signed;
+      }
+    } catch (e) {
+      if (callback) {
+        setImmediate(callback, e)
+      }
+      throw e
+    }
+  };
+};
+/**
+ * @param {Document} doc
+ * @param {Function} [callback]
+ * @return {string}
+ */
+exports.unsigned = function (doc, callback) {
+  const xml = utils.removeWhitespace(doc.toString());
+  if (callback) {
+    setImmediate(callback, null, xml)
+  } else {
+    return xml;
+  }
+}

package/lib/samlAssertion.ts

@@ -26,8 +26,7 @@
 // SOFTWARE.
 //
 
-// @ts-expect-error type declaration file not found
-import { Saml20 as saml } from 'saml'
+import { Saml20 as saml } from './saml/index.js' // The `saml` entry in `package.json` must be kept — it provides the sub-dependencies (@xmldom/xmldom, moment, xml-crypto, etc.) that this local copy requires.
 import crypto from 'node:crypto'
 
 export const samlAssertionUtils = {

package/lib/scimgateway.ts

@@ -25,6 +25,8 @@ import * as utils from './utils.ts'
 import * as utilsScim from './utils-scim.ts'
 import * as stream from './scim-stream.js'
 export * from './helper-rest.ts'
+import LicenseData from './azure-license-mapping.json'
+export { LicenseData }
 // @ts-expect-error: cannot find declaration
 import hycoPkg from 'hyco-https'