Announcement of v2 release and roadmap of 2017

[tngan]

We are happy to announce v2 and encourage all of you migrating from express-saml2 to samlify, and v1 is now deprecated.

Credits

• @sebakerckhof (Another collaborator of samlify)
• @killalau (Lint setting and ts definition)
• @vbakke @ugolas @haoleman (Thanks for those feedbacks and reports)

Shortlist of the key enhancements in v2 release.

• Support Yarn package manager (development)
• Support and run tests in Node v6, v7 and v8
• Rewrite and refactor the module using TypeScript v2.0
• Revamp unit testing (ava)
• Test coverage (nyc) and coverall report
• Test suite including the actual flow of idp/sp initiated sso and slo
• Update xml-crypto to 0.10.1
• Remove the example folder from the repository
• Default signature algorithm to rsa-sha256 instead of rsa-sha1
• Missing base64 encode in unencrypted response 9a24665
• Fix unstable replacement of encrypt assertion 61c5bb8
• Security fix for ejs (one of the dependencies of xml-encryption) f3a968

• 13 Code revamping - modify api for entity constructor

• 35 Feature - order in xml parser

• 42 Code revamping - stringify file

• 43 Code revamping - callback style

• 45 Code revamping - general

• 50 Expose request ID and response ID for SPA (Another API break)

• 54 Document - time verification

• 55 Enhancement - recipient should use acl

• 56 Enhancement - attribute customization

• 63 Options in signature construction

• 64 Add trigger for signing entired message

• 66 Fix typo

• 67 Fix the NameIDFormat replacement in redirect binding

• 68 Handling extra query parameters in binding location

• 69 Generic replacement of tags

• 70 Migrate the documentation from Gitbook to docsify

• 84 Increase test coverage to 90%

[tngan]

Stable v2 was released a couple weeks ago. Now we are planning for v3 as well. Here is the discussion thread and for feature requests, some of them might be included in the v2 patch later on.

Included in v3 (march 2018)

N/A

v2 patches / examples / enhancements

• [x] #102 Fix of RelayState in login request
• [x] #100 Key matching scheme for multiple singing certificate are being used
• [x] #97 Typescript definition
• [x] #82 Proposal drafted for v3 (deeper association and flexibility) [#96]
• [x] 377bad8 Customize namespace for tags (e.g. EncryptedAssertion, Signature) Example

Pending list

• Rolling basis of multiple key usage in samlify IdP module
• Easier error handling in logout response sent from SP back to IdP (#112)
• Remove the allowance of entity construction without metadata
• Revamp the generic flow parser (More than 100 LOC !)
• Revamp the xml context parser (e.g. library to convert xml to json)
• Add back some essential checking (e.g. time)
• Better error handling (A separate class could be defined)
• Trace adapter for access statistics
• Remove outdated jsdoc in code (ts gives good interface declaration)
• Middleware function compatible with passport.js
• Common/Abstract interface for development in other languages
• Implementation of artifact binding for response
• Entity association (i.e. pair-up multiple IdPs with single SP, and vice versa, entity identier as key)
• Dockerize federation services
• Weekly/Bi-weekly patch

By the end of December

• [ ] Passify-CE (A open-source identity provider driven by samlify) [beta]

[Seikho]

It'd be great if the export syntax used es6 instead of commonjs. To maintain backwards compatibility with commonjs you can use named exports and a default export side-by-side.

[tngan]

@Seikho Thanks for your suggestion. Samlify still supports node v4 until it ends maintenance cycle, I will check if there are conflicts when we change to es6 export, in particular not only the export one.

[Seikho]

Thanks for replying, @tngan.

What I meant to say was converting your typescript exports to es6, which will down-level to CommonJS when compiled, but allow TS users to use es6 imports and vanilla JS users to continue using require().

I have a branch up on my fork with the changes. Feel free to have a play around. I'll open up a WIP pull request so you can see the diff.

[tngan]

@Seikho Cool, thanks for your clarification, that makes sense. I am happy to accept the pull request later on.

[vvo]

Het hi, this lib looks great. I have been looking at the ecosystem around SAML and it seems like the main module (passport-saml) is old an not well maintained.

I was wondering if there was any quick example on how to use Okta + express + samlify. As the current documentation requires good knowledge of SAML concepts I have not been able to wrap my mind around how to do it.

Thanks!

[tngan]

@vvo I have an old example that works in alpha version. https://github.com/tngan/samlify/blob/f2b6a2f8c36dc0ff887d0442c48cd0f2c0a4a778/examples/sp1/routes/sso.js#L28-L29.

The new one will be published around middle of August. Feel free to contact me via passify.io@gmail.com for support if something has to be private.

[tngan]

Roadmap and pending feature list will be updated in README.md later on.