scimgateway 6.2.6 → 6.2.7

package/lib/plugin-entra-id.ts

@@ -76,7 +76,7 @@
 import path from 'node:path'
 
 // start - mandatory plugin initialization
-import { ScimGateway, HelperRest } from 'scimgateway'
+import { ScimGateway, HelperRest, LicenseData } from 'scimgateway'
 const scimgateway = new ScimGateway()
 const helper = new HelperRest(scimgateway)
 const config = scimgateway.getConfig()
@@ -93,18 +93,14 @@ const permission: Record<string, any> = {}
 
 // load Azure license mapping JSON-file having skuPartNumber and corresponding user-friendly name
 let fs: typeof import('fs')
-let licenseMapping: Record<string, any> = {}
+let licenseMapping: Record<string, any> = LicenseData
 async function loadLicenseMapping() {
   try {
     if (!fs) fs = (await import('fs'))
+    // runtime override: if file exists in pluginDir, use it instead of the embedded default
     let mappingPath = path.join(scimgateway.pluginDir, 'azure-license-mapping.json')
     if (fs.existsSync(mappingPath)) {
       licenseMapping = JSON.parse(fs.readFileSync(mappingPath, 'utf8'))
-    } else {
-      mappingPath = path.join(scimgateway.gwDir, 'azure-license-mapping.json')
-      if (fs.existsSync(mappingPath)) {
-        licenseMapping = JSON.parse(fs.readFileSync(mappingPath, 'utf8'))
-      }
     }
   } catch (err) {
     scimgateway.logDebug('plugin-entra-id', `Error loading license mapping: ${err}`)
@@ -251,7 +247,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     }
   } else selectAttributes = userSelectAttributes
 
-  if (!permission[baseEntity]?.signInActivity) { // remove signInActivity
+  if (permission[baseEntity]?.signInActivity === false) { // remove signInActivity
     const index = selectAttributes.indexOf('signInActivity')
     if (index > -1) {
       selectAttributes.splice(index, 1)

package/lib/saml/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+ 
+Copyright (c) 2015 Auth0, Inc. <support@auth0.com> (http://auth0.com)
+ 
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+ 
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+ 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/saml/README.md

@@ -0,0 +1,66 @@
+# Local `saml` Package
+
+This folder contains a local copy of the [node-saml](https://github.com/auth0/node-saml) package (v4.0.0), originally authored by Auth0.  
+Licensed under the MIT License — see [LICENSE](./LICENSE).
+
+## Why This Exists
+
+When compiling scimgateway plugins to standalone binaries using `bun build --compile`, the original `saml` npm package fails at runtime on any machine other than the build machine.
+
+**Root cause:** The original `saml` package uses `fs.readFileSync` with `__dirname`-resolved paths to load XML template files (`saml11.template` and `saml20.template`) at module initialization:
+
+```js
+// Original saml/lib/saml11.js
+var newSaml11Document = utils.factoryForNode(path.join(__dirname, 'saml11.template'));
+```
+
+```js
+// Original saml/lib/utils.js
+exports.factoryForNode = function factoryForNode(pathToTemplate) {
+  const template = fs.readFileSync(pathToTemplate);  // fails in compiled binary
+  ...
+};
+```
+
+When Bun compiles the binary, `__dirname` gets baked in as the **absolute path from the build machine** (e.g. `/Users/xxx/.../node_modules/saml/lib/`). The `.template` files are not embedded in the binary, so the `readFileSync` call fails with `ENOENT` when the binary runs elsewhere.
+
+## What Was Changed
+
+Only one functional change was made — **templates are inlined as string constants** instead of being read from disk at runtime.
+
+### `utils.js`
+- Removed `const fs = require('fs')` — no longer needed
+- Changed `factoryForNode(pathToTemplate)` to `factoryForNode(templateString)` — accepts an XML string directly instead of a file path
+
+### `saml11.js` and `saml20.js`
+- Removed `path.join(__dirname, '*.template')` file references
+- Template XML is inlined as a string constant passed to `factoryForNode()`
+- Removed `var path = require('path')` (no longer needed)
+
+### `xml/encrypt.js` and `xml/sign.js`
+- Copied unchanged from the original package
+
+### `index.js`
+- Copied unchanged from the original package
+
+## Import Change
+
+In `lib/samlAssertion.ts`:
+```diff
+-import { Saml20 as saml } from 'saml'
++import { Saml20 as saml } from './saml/index.js'
+```
+
+## Dependencies
+
+The sub-dependencies used by this code remain as npm packages (not copied):
+- `@xmldom/xmldom`
+- `moment`
+- `xml-crypto`
+- `xml-encryption`
+- `valid-url`
+- `xml-name-validator`
+- `async`
+- `xpath`
+
+The `saml` entry in `package.json` must be kept — it provides the sub-dependencies (@xmldom/xmldom, moment, xml-crypto, etc.) that this local copy requires.

package/lib/saml/index.js

@@ -0,0 +1,2 @@
+exports.Saml11 = require('./saml11');
+exports.Saml20 = require('./saml20');

package/lib/saml/saml11.js

@@ -0,0 +1,197 @@
+var utils = require('./utils');
+var Parser = require('@xmldom/xmldom').DOMParser;
+var xmlenc = require('xml-encryption');
+var moment = require('moment');
+var async = require('async');
+var crypto = require('crypto');
+
+var EncryptXml = require('./xml/encrypt');
+var SignXml = require('./xml/sign');
+
+var saml11Template = '<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" MajorVersion="1" MinorVersion="1" AssertionID="" IssueInstant="">' +
+  '<saml:Conditions>' +
+  '<saml:AudienceRestrictionCondition />' +
+  '</saml:Conditions>' +
+  '<saml:AttributeStatement>' +
+  '<saml:Subject>' +
+  '<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />' +
+  '<saml:SubjectConfirmation>' +
+  '<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '</saml:AttributeStatement>' +
+  '<saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">' +
+  '<saml:Subject>' +
+  '<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">' +
+  '</saml:NameIdentifier>' +
+  '<saml:SubjectConfirmation>' +
+  '<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '</saml:AuthenticationStatement>' +
+  '</saml:Assertion>';
+
+var newSaml11Document = utils.factoryForNode(saml11Template);
+
+var NAMESPACE = 'urn:oasis:names:tc:SAML:1.0:assertion';
+
+function extractSaml11Options(opts) {
+  return {
+    uid: opts.uid,
+    issuer: opts.issuer,
+    lifetimeInSeconds: opts.lifetimeInSeconds,
+    audiences: opts.audiences,
+    attributes: opts.attributes,
+    nameIdentifier: opts.nameIdentifier,
+    nameIdentifierFormat: opts.nameIdentifierFormat,
+    subjectConfirmationMethod: opts.subjectConfirmationMethod,
+    holderOfKeyProofSecret: opts.holderOfKeyProofSecret,
+  };
+}
+
+/**
+ * Creates a signed SAML 1.1 assertion from the given options.
+ */
+exports.create = function(options, callback) {
+  return createAssertion(extractSaml11Options(options), {
+    signXml: SignXml.fromSignXmlOptions(Object.assign({
+      xpathToNodeBeforeSignature: "//*[local-name(.)='AuthenticationStatement']",
+      signatureIdAttribute: 'AssertionID'
+    }, options)),
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+}
+
+/**
+ * Creates an unsigned SAML 1.1 assertion from the given options.
+ */
+exports.createUnsignedAssertion = function(options, callback) {
+  return createAssertion(extractSaml11Options(options), {
+    signXml: SignXml.unsigned,
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+}
+
+function createAssertion(options, strategies, callback) {
+  var doc;
+  try {
+    doc = newSaml11Document();
+  } catch(err){
+    return utils.reportError(err, callback);
+  }
+
+  doc.documentElement.setAttribute('AssertionID', '_' + (options.uid || utils.uid(32)));
+  if (options.issuer)
+    doc.documentElement.setAttribute('Issuer', options.issuer);
+
+  var now = moment.utc();
+  doc.documentElement.setAttribute('IssueInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  var conditions = doc.documentElement.getElementsByTagName('saml:Conditions');
+
+  if (options.lifetimeInSeconds) {
+    conditions[0].setAttribute('NotBefore', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+    conditions[0].setAttribute('NotOnOrAfter', moment(now).add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  }
+
+  if (options.audiences) {
+    var audiences = options.audiences instanceof Array ? options.audiences : [options.audiences];
+    audiences.forEach(function (audience) {
+      var element = doc.createElementNS(NAMESPACE, 'saml:Audience');
+      element.textContent = audience;
+      var audienceCondition = conditions[0].getElementsByTagNameNS(NAMESPACE, 'AudienceRestrictionCondition')[0];
+      audienceCondition.appendChild(element);
+    });
+  }
+
+  if (options.attributes) {
+    var statement = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'AttributeStatement')[0];
+    Object.keys(options.attributes).forEach(function(prop) {
+      if(typeof options.attributes[prop] === 'undefined') return;
+
+      var name = prop.indexOf('/') > -1 ? prop.substring(prop.lastIndexOf('/') + 1) : prop;
+      var namespace = prop.indexOf('/') > -1 ? prop.substring(0, prop.lastIndexOf('/')) : '';
+      var attributeElement = doc.createElementNS(NAMESPACE, 'saml:Attribute');
+      attributeElement.setAttribute('AttributeNamespace', namespace);
+      attributeElement.setAttribute('AttributeName', name);
+      var values = options.attributes[prop] instanceof Array ? options.attributes[prop] : [options.attributes[prop]];
+      values.forEach(function (value) {
+        var valueElement = doc.createElementNS(NAMESPACE, 'saml:AttributeValue');
+        valueElement.textContent = value;
+        attributeElement.appendChild(valueElement);
+      });
+
+      if (values && values.length > 0) {
+        statement.appendChild(attributeElement);
+      }
+    });
+  }
+
+  doc.getElementsByTagName('saml:AuthenticationStatement')[0]
+    .setAttribute('AuthenticationInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+
+  var nameID = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameIdentifier')[0];
+
+  if (options.nameIdentifier) {
+    nameID.textContent = options.nameIdentifier;
+
+    doc.getElementsByTagName('saml:AuthenticationStatement')[0]
+      .getElementsByTagName('saml:NameIdentifier')[0]
+      .textContent = options.nameIdentifier;
+  }
+
+  if (options.nameIdentifierFormat) {
+    var nameIDs = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameIdentifier');
+    nameIDs[0].setAttribute('Format', options.nameIdentifierFormat);
+    nameIDs[1].setAttribute('Format', options.nameIdentifierFormat);
+  }
+
+  if (strategies.encryptXml === EncryptXml.unencrypted) {
+    var signed = strategies.signXml(doc);
+    return strategies.encryptXml(signed, callback);
+  }
+
+  // encryption is turned on,
+  var proofSecret;
+  async.waterfall([
+    function (cb) {
+      if (!options.subjectConfirmationMethod && options.subjectConfirmationMethod !== 'holder-of-key')
+        return cb();
+
+      crypto.randomBytes(32, function(err, randomBytes) {
+        proofSecret = randomBytes;
+        addSubjectConfirmation(strategies.encryptXml.encryptOptions, doc, options.holderOfKeyProofSecret || randomBytes, cb);
+      });
+    },
+    function(cb) {
+      strategies.signXml(doc, cb);
+    },
+    function(signed, cb) {
+      strategies.encryptXml(signed, cb);
+    }
+  ], function (err, result) {
+    if (err) return callback(err);
+    callback(null, result, proofSecret);
+  });
+}
+
+function addSubjectConfirmation(encryptOptions, doc, randomBytes, callback) {
+  xmlenc.encryptKeyInfo(randomBytes, encryptOptions, function(err, keyinfo) {
+    if (err) return callback(err);
+    var subjectConfirmationNodes = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'SubjectConfirmation');
+
+    for (var i=0; i<subjectConfirmationNodes.length; i++) {
+      var keyinfoDom;
+      try {
+        keyinfoDom = new Parser().parseFromString(keyinfo);
+      } catch(error){
+        return utils.reportError(error, callback);
+      }
+
+      var method = subjectConfirmationNodes[i].getElementsByTagNameNS(NAMESPACE, 'ConfirmationMethod')[0];
+      method.textContent = 'urn:oasis:names:tc:SAML:1.0:cm:holder-of-key';
+      subjectConfirmationNodes[i].appendChild(keyinfoDom.documentElement);
+    }
+
+    callback();
+  });
+}

package/lib/saml/saml20.js

@@ -0,0 +1,205 @@
+var async = require('async');
+var moment = require('moment');
+var xmlNameValidator = require('xml-name-validator');
+var is_uri = require('valid-url').is_uri;
+
+var EncryptXml = require('./xml/encrypt');
+var SignXml = require('./xml/sign');
+var utils = require('./utils');
+
+var saml20Template = '<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="" IssueInstant="">' +
+  '<saml:Issuer></saml:Issuer>' +
+  '<saml:Subject>' +
+  '<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />' +
+  '<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">' +
+  '<saml:SubjectConfirmationData />' +
+  '</saml:SubjectConfirmation>' +
+  '</saml:Subject>' +
+  '<saml:Conditions />' +
+  '<saml:AuthnStatement AuthnInstant="">' +
+  '<saml:AuthnContext>' +
+  '<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>' +
+  '</saml:AuthnContext>' +
+  '</saml:AuthnStatement>' +
+  '</saml:Assertion>';
+
+var newSaml20Document = utils.factoryForNode(saml20Template);
+
+var NAMESPACE = 'urn:oasis:names:tc:SAML:2.0:assertion';
+
+function getAttributeType(value){
+  switch(typeof value) {
+    case "string":
+      return 'xs:string';
+    case "boolean":
+      return 'xs:boolean';
+    case "number":
+      return 'xs:double';
+    default:
+      return 'xs:anyType';
+  }
+}
+
+function getNameFormat(name){
+  if (is_uri(name)){
+    return 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+  }
+
+  if (xmlNameValidator.name(name).success){
+    return 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic';
+  }
+
+  return 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified';
+}
+
+function extractSaml20Options(opts) {
+  return {
+    uid: opts.uid,
+    issuer: opts.issuer,
+    lifetimeInSeconds: opts.lifetimeInSeconds,
+    audiences: opts.audiences,
+    recipient: opts.recipient,
+    inResponseTo: opts.inResponseTo,
+    attributes: opts.attributes,
+    includeAttributeNameFormat: (typeof opts.includeAttributeNameFormat !== 'undefined') ? opts.includeAttributeNameFormat : true,
+    typedAttributes: (typeof opts.typedAttributes !== 'undefined') ? opts.typedAttributes : true,
+    sessionIndex: opts.sessionIndex,
+    nameIdentifier: opts.nameIdentifier,
+    nameIdentifierFormat: opts.nameIdentifierFormat,
+    authnContextClassRef: opts.authnContextClassRef
+  };
+}
+
+/**
+ * Creates a signed SAML 2.0 assertion from the given options.
+ */
+exports.create = function createSignedAssertion(options, callback) {
+  return createAssertion(extractSaml20Options(options), {
+    signXml: SignXml.fromSignXmlOptions(Object.assign({
+      xpathToNodeBeforeSignature: "//*[local-name(.)='Issuer']",
+      signatureIdAttribute: 'ID'
+    }, options)),
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+};
+
+/**
+ * Creates an unsigned SAML 2.0 assertion from the given options.
+ */
+exports.createUnsignedAssertion = function createUnsignedAssertion(options, callback) {
+  return createAssertion(extractSaml20Options(options), {
+    signXml: SignXml.unsigned,
+    encryptXml: EncryptXml.fromEncryptXmlOptions(options)
+  }, callback);
+};
+
+function createAssertion(options, strategies, callback) {
+  var doc = newSaml20Document();
+
+  doc.documentElement.setAttribute('ID', '_' + (options.uid || utils.uid(32)));
+  if (options.issuer) {
+    var issuer = doc.documentElement.getElementsByTagName('saml:Issuer');
+    issuer[0].textContent = options.issuer;
+  }
+
+  var now = moment.utc();
+  doc.documentElement.setAttribute('IssueInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  var conditions = doc.documentElement.getElementsByTagName('saml:Conditions');
+  var confirmationData = doc.documentElement.getElementsByTagName('saml:SubjectConfirmationData');
+
+  if (options.lifetimeInSeconds) {
+    conditions[0].setAttribute('NotBefore', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+    conditions[0].setAttribute('NotOnOrAfter', now.clone().add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  
+    confirmationData[0].setAttribute('NotOnOrAfter', now.clone().add(options.lifetimeInSeconds, 'seconds').format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+  }
+  
+  if (options.audiences) {
+    var audienceRestriction = doc.createElementNS(NAMESPACE, 'saml:AudienceRestriction');
+    var audiences = options.audiences instanceof Array ? options.audiences : [options.audiences];
+    audiences.forEach(function (audience) {
+      var element = doc.createElementNS(NAMESPACE, 'saml:Audience');
+      element.textContent = audience;
+      audienceRestriction.appendChild(element);
+    });
+
+    conditions[0].appendChild(audienceRestriction); 
+  }
+
+  if (options.recipient)
+    confirmationData[0].setAttribute('Recipient', options.recipient);
+
+  if (options.inResponseTo)
+    confirmationData[0].setAttribute('InResponseTo', options.inResponseTo);
+
+  if (options.attributes) {
+    var statement = doc.createElementNS(NAMESPACE, 'saml:AttributeStatement');
+    statement.setAttribute('xmlns:xs', 'http://www.w3.org/2001/XMLSchema');
+    statement.setAttribute('xmlns:xsi', 'http://www.w3.org/2001/XMLSchema-instance');
+    doc.documentElement.appendChild(statement);
+    Object.keys(options.attributes).forEach(function(prop) {
+      if(typeof options.attributes[prop] === 'undefined') return;
+
+      var attributeElement = doc.createElementNS(NAMESPACE, 'saml:Attribute');
+      attributeElement.setAttribute('Name', prop);
+
+      if (options.includeAttributeNameFormat){
+        attributeElement.setAttribute('NameFormat', getNameFormat(prop));        
+      }
+
+      var values = options.attributes[prop] instanceof Array ? options.attributes[prop] : [options.attributes[prop]];
+      values.forEach(function (value) {
+        if (typeof value !== 'undefined') {
+          var valueElement = doc.createElementNS(NAMESPACE, 'saml:AttributeValue');
+          valueElement.setAttribute('xsi:type', options.typedAttributes ? getAttributeType(value) : 'xs:anyType');
+          valueElement.textContent = value;
+          attributeElement.appendChild(valueElement);
+        }
+      });
+
+      if (values && values.filter(function(i){ return typeof i !== 'undefined'; }).length > 0) {
+        statement.appendChild(attributeElement);
+      }
+    });
+  }
+
+  doc.getElementsByTagName('saml:AuthnStatement')[0]
+    .setAttribute('AuthnInstant', now.format('YYYY-MM-DDTHH:mm:ss.SSS[Z]'));
+
+  if (options.sessionIndex) {
+    doc.getElementsByTagName('saml:AuthnStatement')[0]
+      .setAttribute('SessionIndex', options.sessionIndex);
+  }
+
+  var nameID = doc.documentElement.getElementsByTagNameNS(NAMESPACE, 'NameID')[0];
+  
+  if (options.nameIdentifier) {
+    nameID.textContent = options.nameIdentifier;
+  }
+
+  if (options.nameIdentifierFormat) {
+    nameID.setAttribute('Format', options.nameIdentifierFormat);
+  }
+  
+  if( options.authnContextClassRef ) {
+    doc.getElementsByTagName('saml:AuthnContextClassRef')[0]
+      .textContent = options.authnContextClassRef;
+  }
+
+  if (strategies.encryptXml === EncryptXml.unencrypted) {
+    var signed = strategies.signXml(doc);
+    return strategies.encryptXml(signed, callback);
+  }
+
+  async.waterfall([
+    function(cb) {
+      strategies.signXml(doc, cb);
+    },
+    function(signed, cb) {
+      strategies.encryptXml(signed, cb);
+    }
+  ], function (err, result) {
+    if (err) return callback(err);
+    callback(null, result);
+  });
+}

package/lib/saml/utils.js

@@ -0,0 +1,94 @@
+const Parser = require('@xmldom/xmldom').DOMParser;
+
+exports.pemToCert = function(pem) {
+  const cert = /-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g.exec(pem.toString());
+  if (cert && cert.length > 0) {
+    return cert[1].replace(/[\n|\r\n]/g, '');
+  }
+
+  return null;
+};
+
+exports.reportError = function(err, callback){
+  if (callback){
+    setImmediate(function(){
+      callback(err);
+    });
+  }
+};
+
+/**
+ * Return a unique identifier with the given `len`.
+ *
+ *     utils.uid(10);
+ *     // => "FDaS435D2z"
+ *
+ * @param {Number} len
+ * @return {String}
+ * @api private
+ */
+exports.uid = function(len) {
+  const buf = []
+      , chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+      , charlen = chars.length;
+
+  for (let i = 0; i < len; ++i) {
+    buf.push(chars[getRandomInt(0, charlen - 1)]);
+  }
+
+  return buf.join('');
+};
+
+exports.removeWhitespace = function(xml) {
+  return xml
+      .replace(/\r\n/g, '')
+      .replace(/\n/g, '')
+      .replace(/>(\s*)</g, '><') //unindent
+      .trim();
+};
+
+/**
+ * Return a random int, used by `utils.uid()`
+ *
+ * @param {Number} min
+ * @param {Number} max
+ * @return {Number}
+ * @api private
+ */
+
+function getRandomInt(min, max) {
+  return Math.floor(Math.random() * (max - min + 1)) + min;
+}
+
+/**
+ * Returns a function that can be called to create a new Node from an inline template string.
+ *
+ * @param {string} templateString the XML template content
+ * @return {function(): Node}
+ */
+exports.factoryForNode = function factoryForNode(templateString) {
+  const prototypeDoc = new Parser().parseFromString(templateString);
+
+  return function () {
+    return prototypeDoc.cloneNode(true);
+  };
+};
+
+/**
+ * Standardizes PEM content to match the spec (best effort)
+ *
+ * @param pem {Buffer} The PEM content to standardize
+ * @returns {Buffer} The standardized PEM. Original will be returned unmodified if the content is not PEM.
+ */
+exports.fixPemFormatting = function (pem) {
+  let pemEntries = pem.toString().matchAll(/([-]{5}[^-\r\n]+[-]{5})([^-]*)([-]{5}[^-\r\n]+[-]{5})/g);
+  let fixedPem = ''
+  for (const pemParts of pemEntries) {
+    fixedPem = fixedPem.concat(`${pemParts[1]}\n${pemParts[2].replaceAll(/[\r\n]/g, '')}\n${pemParts[3]}\n`)
+  }
+  if (fixedPem.length === 0) {
+    return pem;
+  }
+
+  return Buffer.from(fixedPem)
+}

package/lib/saml/xml/encrypt.js

@@ -0,0 +1,56 @@
+const xmlenc = require('xml-encryption');
+
+const utils = require('../utils');
+
+exports.fromEncryptXmlOptions = function (options) {
+  if (!options.encryptionCert) {
+    return this.unencrypted;
+  } else {
+    const encryptOptions = {
+      rsa_pub: options.encryptionPublicKey,
+      pem: options.encryptionCert,
+      encryptionAlgorithm: options.encryptionAlgorithm || 'http://www.w3.org/2009/xmlenc11#aes256-gcm',
+      keyEncryptionAlgorithm: options.keyEncryptionAlgorithm || 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
+      disallowEncryptionWithInsecureAlgorithm: options?.disallowEncryptionWithInsecureAlgorithm !== false,
+      warnInsecureAlgorithm: options?.warnOnInsecureEncryptionAlgorithm !== false,
+    };
+
+    // expose the encryptOptions as these are needed when adding the SubjectConfirmation
+    return Object.assign(this.encrypted(encryptOptions), { encryptOptions: encryptOptions });
+  }
+};
+
+exports.unencrypted = function (xml, callback) {
+  if (callback) {
+    return setImmediate(callback, null, xml);
+  } else {
+    return xml;
+  }
+};
+
+exports.encrypted = function (encryptOptions) {
+  return function encrypt(xml, callback) {
+    xmlenc.encrypt(xml, encryptOptions, function (err, encrypted) {
+      if (err) {
+        // Attempt to fix errors and retry
+        xmlenc.encrypt(
+            xml,
+            {
+              ...encryptOptions,
+              rsa_pub: utils.fixPemFormatting(encryptOptions.rsa_pub),
+              pem: utils.fixPemFormatting(encryptOptions.pem),
+            },
+            function (retryErr, retryEncrypted) {
+              if (retryErr) {
+                return callback(retryErr);
+              }
+
+              callback(null, utils.removeWhitespace(retryEncrypted));
+            }
+        );
+      } else {
+        callback(null, utils.removeWhitespace(encrypted));
+      }
+    });
+  };
+};