search

tngan / samlify

Node.js library for SAML SSO
https://samlify.js.org
MIT License
601 stars 214 forks source link

octet string builder #509

Open mastermatt opened 1 year ago

mastermatt commented 1 year ago

Adds octetStringBuilder to libsaml to DRY up the signature alg code.

The octet string is needed in four places: creating and verifying the signature for the Redirect and SimpleSign bindings. Previously, both creations were done adhoc while both verifications where not done by the samlify at all and instead left to user code. #308 #360 The new util is now used during verification if the request object does not include a octetString key.

~~A note on the tests: a lot of the tests on master don't pass. Before making my changes, I started by getting the tests green by skipping 13 tests and tweaking a further 4. I then made my changes and was content knowing that my changes hadn't broken any of the tests that passed previously. The broken tests seem to focus on encryption due to an upgrade of xml-crypto and logout flows due to https://github.com/tngan/samlify/pull/501. So I'm not overly concerned, but it is worth noting that someone can't pull this repo and run the tests currently.~~ The tests were fixed before the latest rebase.

@tngan

fixes #308 fixes #360

mastermatt commented 5 months ago

@tngan I've rebased onto latest, could you take another look?