Need for SAML to validate user groups (or an alternative)

[csemeria]

Hi, I'm facing the following issue: when I redirect the user to SAML I have in scope a local (mine) group the user is trying to log into, when I get the callback that info isn't in scope anymore, I can get what SAML user groups are allowed to access to my local group before doing the call, so I have (at least) this options:

1. If there is any way to tell SAML to only validate the user if it belong to at least one SAML group from a list I can provide, that would be the best way to fix my problem.
2. Otherwise, if I can at least add to the SAML request a parameter for it to include in the callback, I can locally store the info I need to validate local groups and recover it from that token later,
3. Any other way to track a call and associate it with a callback (relay state, etc)

My code for the call is quite simple:

    const options = {
        entryPoint: XXXX,
        issuer: XXXX,
        callbackUrl: XXXX,
        cert: XXXX,
        identifierFormat:XXXX,
        wantAuthnResponseSigned: XXXX,
        wantAssertionsSigned: XXXX    }

saml = new SAML(options);
saml.getAuthorizeUrlAsync().then(url => {
    res.redirect(url);
})

[cjbarth]

Have you tried the SAML-standard RelayState query parameter? That is supported by node-saml.

[csemeria]

I'm quite new on this, I tried to put it as an option value and some other things but I'm either failing the syntax or failing yo retreive it from the callback

[cjbarth]

Please show your updated configuration where you're putting it as an option.

[srd90]

@csemeria are you saying here

…I tried to put it as an option value and some other things but I'm either failing the syntax or failing yo retreive it from the callback

that

1. You are not sure whether RelayState is even added to request and/or
2. If it was added you are not sure whether you fail to retrieve it while processing response

Use e.g. SAML Tracer (https://chrome.google.com/webstore/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch) to quickly narrow your problem. If you see RelayState at request sent to IdP and you if you see same RelayState in response (HTTP POST back to SP) then problem is already narrowed down to how you process saml response.

Using step debugging also reveals often the problem and/or while doing that you gain valuable insight to node-saml codebase and you may be able to figure out problem that way.

Eitherway it is usually nice if you could share as much information as possible of your attempts instead of forcing readers to guess how you might have tried to configure things / access relaystate value.

Also please provide exact version number of @node-saml/node-saml. As a reader of this thread I'm finding myself wondering whether you are using some 4.x from npm repostory or whether you are using e.g. some version (like master branch) from github.