Passport-wsfed-saml2

This is a ws-federation protocol + SAML2 tokens authentication provider for Passport.

The code was originally based on Henri Bergius's passport-saml library.

Passport-wsfed-saml2 has been tested to work with both Windows Azure Active Directory / Access Control Service and with Microsoft Active Directory Federation Services.

Installation

$ npm install passport-wsfed-saml2

Usage

Configure strategy

This example utilizes a development namespace (auth10-dev) on Windows Azure Access Control Service and is using Google as the only identity provider configured for the sample application.

1passport.use(new wsfedsaml2(
2  {
3    path: '/login/callback',
4    realm: 'urn:node:app',
5    homeRealm: '', // optionally specify an identity provider to avoid showing the idp selector
6    identityProviderUrl: 'https://auth10-dev.accesscontrol.windows.net/v2/wsfederation',
7    cert: 'MIIDFjCCAf6gAwIBAgIQDRRprj9lv5RBvaQdlFltDzANBgkqhkiG9w0BAQUFADAvMS0wKwYDVQQDEyRhdXRoMTAtZGV2LmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwHhcNMTEwOTIxMDMzMjMyWhcNMTIwOTIwMDkzMjMyWjAvMS0wKwYDVQQDEyRhdXRoMTAtZGV2LmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCEIAEB/KKT3ehNMy2MQEyJIQ14CnZ8DC2FZgL5Gw3UBSdRb9JinK/gw7yOQtwKfJUqeoZaUSAAdcdbgqwVxOnMBfWiYX7DGlEznSfqYVnjOWjqqjpoe0h6RaOkdWovDtoidmqVV1tWRJFjkj895clPxkLpnqqcycfXtSdZen0SroGyirD2mhMc9ccLbJ3zRnBNjlvpo5zow1zYows09tNC2EhGROL/OS4JNRQnJRICZC+WkA7Igf3xb4btJOzIPYhFiqCGrd/81CHmAyEuNzyc60I5yomDQfZ91Eb5Uk3F7mlfAlYB2aZwDwldLSOlVE8G1E5xFexF/5KyPC4ShNodAgMBAAGjLjAsMAsGA1UdDwQEAwIE8DAdBgNVHQ4EFgQUyYfx/r0czsPgTzitqey+fGMQpkcwDQYJKoZIhvcNAQEFBQADggEBAB5dgQlM3tKS+/cjlvMCPjZH0Iqo/Wxecri3YWi2iVziZ/TQ3dSV+J/iTyduN7rJmFQzTsNERcsgyAwblwnEKXXvlWo8G/+VDIMh3zVPNQFKns5WPkfkhoSVlnZPTQ8zdXAcWgDXbCgvdqIPozdgL+4l0W0XVL1ugA4/hmMXh4TyNd9Qj7MWvlmwVjevpSqN4wG735jAZFHb/L/vvc91uKqP+JvLNj8tPFVxatzi56X1V8jBM61Hx1Z9D0RCDjtmcQVysVEylW9O6mNy6ZrhLm0q5yecWudfBbTKDqRoCHQRjrMU2c5q/ZFDtgjLim7FaNxFbgTyjeRCPclEhfemYVg='
8  },
9  function(profile, done) {
10    findByEmail(profile.email, function(err, user) {
11      if (err) {
12        return done(err);
13      }
14      return done(null, user);
15    });
16  })
17));

Provide the authentication callback

You need to provide a route corresponding to the path configuration parameter given to the strategy:

1app.post('/login/callback',
2  passport.authenticate('wsfed-saml2', { failureRedirect: '/', failureFlash: true }),
3  function(req, res) {
4    res.redirect('/');
5  }
6);

Jwt

Although this started as wsfed&saml we added support for wsfed&jwt. Usage is

1passport.use(new wsfedsaml2(
2  {
3    jwt: {
4      //same options than node-jsonwebtoken
5      algorithm: 'RS256'
6    },
7    cert: 'MIIDFjCCAf6gAwIBAgIQDRRprj9lv5RBvaQdlFltDzANBgkqhkiG9w0BAQUFADAvMS0wKwYDVQQDEyRhdXRoMTAtZGV2LmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwHhcNMTEwOTIxMDMzMjMyWhcNMTIwOTIwMDkzMjMyWjAvMS0wKwYDVQQDEyRhdXRoMTAtZGV2LmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCEIAEB/KKT3ehNMy2MQEyJIQ14CnZ8DC2FZgL5Gw3UBSdRb9JinK/gw7yOQtwKfJUqeoZaUSAAdcdbgqwVxOnMBfWiYX7DGlEznSfqYVnjOWjqqjpoe0h6RaOkdWovDtoidmqVV1tWRJFjkj895clPxkLpnqqcycfXtSdZen0SroGyirD2mhMc9ccLbJ3zRnBNjlvpo5zow1zYows09tNC2EhGROL/OS4JNRQnJRICZC+WkA7Igf3xb4btJOzIPYhFiqCGrd/81CHmAyEuNzyc60I5yomDQfZ91Eb5Uk3F7mlfAlYB2aZwDwldLSOlVE8G1E5xFexF/5KyPC4ShNodAgMBAAGjLjAsMAsGA1UdDwQEAwIE8DAdBgNVHQ4EFgQUyYfx/r0czsPgTzitqey+fGMQpkcwDQYJKoZIhvcNAQEFBQADggEBAB5dgQlM3tKS+/cjlvMCPjZH0Iqo/Wxecri3YWi2iVziZ/TQ3dSV+J/iTyduN7rJmFQzTsNERcsgyAwblwnEKXXvlWo8G/+VDIMh3zVPNQFKns5WPkfkhoSVlnZPTQ8zdXAcWgDXbCgvdqIPozdgL+4l0W0XVL1ugA4/hmMXh4TyNd9Qj7MWvlmwVjevpSqN4wG735jAZFHb/L/vvc91uKqP+JvLNj8tPFVxatzi56X1V8jBM61Hx1Z9D0RCDjtmcQVysVEylW9O6mNy6ZrhLm0q5yecWudfBbTKDqRoCHQRjrMU2c5q/ZFDtgjLim7FaNxFbgTyjeRCPclEhfemYVg='
8  },
9  function(profile, done) {
10    findByEmail(profile.email, function(err, user) {
11      if (err) {
12        return done(err);
13      }
14      return done(null, user);
15    });
16  })
17));

Configure strategy for ADFS (WS-Fed)

This example utilizes a strategy with ADFS using WS-Fed.

1passport.use('wsfed-saml2', new wsfedsaml2({
2	// ADFS RP identifier
3	realm: 'urn:node:wsfedapp',
4	identityProviderUrl: 'https://my-adfs/adfs/ls',
5	// ADFS token signing certificate
6	thumbprint: '5D27....D27E'
7	// or cert: fs.readFileSync("adfs_signing_key.cer")
8}, function (profile, done) {
9 // ...
10}));
11

Configure strategy for ADFS (SAMLp)

This example utilizes a strategy using SAMLp and RP token encryption.

1passport.use('wsfed-saml2', new wsfedsaml2({
2	// ADFS RP identifier
3	realm: 'urn:node:samlapp',
4	identityProviderUrl: 'https://my-adfs/adfs/ls',
5    // ADFS token signing certificate
6    thumbprint: '5D27...D27E',
7	// or cert: fs.readFileSync("adfs_signing_key.cer")
8    protocol: "samlp",
9	// This is the private key (use case where ADFS
10	// is configured for RP token encryption)
11    decryptionKey: fs.readFileSync("server.key")
12}, function (profile, done) {
13 // ...
14}));

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Security Notice

The Security Notice lists the version that is vulnerable and the actions that are required to upgrade to the latest version.

Author

Auth0

License

This project is licensed under the MIT license. See the LICENSE file for more info.