MultiSamlStrategy on NestJS

[dovepa]

Hello everyone,
As stated in the title, my implementation of MultiSamlStrategy on NestJS is not working.

Here's a code example:

export class AzureStrategy extends PassportStrategy(MultiSamlStrategy, 'multi-saml') {
    constructor() {
        super({
                passReqToCallback: true, // makes req available in callback
                getSamlOptions: function (request, done) {
                    findProvider(request, function (err, provider) {
                        if (err) {
                            return done(err);
                        }
                        return done(null, provider.configuration);
                    });
                }
            },
            function (req, profile, done) {
                findByEmail(profile.email, function (err, user) {
                    if (err) {
                        return done(err);
                    }
                    return done(null, user);
                });
            })
    }
}

I don't understand why, but I never enter the callback function.
Additionally, I noticed that the certificates are not loaded into the strategy, even though I have properly added them to the configuration.
I also do not enter the certsToCheck function of the library.

Do you know what could be causing the problem?

Version 3.2.4

[cjbarth]

It appears you are using a deprecated version of passport-saml. Please upgrade to the latest version. This the note on this page.

[dovepa]

Hello @cjbarth ,

Thank you for your answer, but I have exactly the same behavior with "@node-saml/passport-saml": "^4.0.4",

[cjbarth]

The ctor takes 3 arguments in v4. See https://github.com/node-saml/passport-saml/blob/master/src/multiSamlStrategy.ts#L27

Are you saying that this code never gets called? I suggest you put a breakpoint somewhere and figure out why.

[dovepa]

Understood. I have conducted tests with three arguments inside the constructor, and the authentication is functioning correctly.
However, I am facing an issue where the certificates specified inside the configuration are not being utilized.

To explain further, there appears to be no distinction between two test cases using different certificates:
cert: '-----BEGIN CERTIFICATE----- BOB-----END CERTIFICATE-----'
cert: '-----BEGIN CERTIFICATE----- LILI-----END CERTIFICATE-----' ( certificate is invalid)
Despite using different certificate values, there is no discernible difference in behavior.

Additionally, I am not entering the callback functions (signonVerify, logoutVerify)...

[cjbarth]

Have a look at this test. Note that it fails if you change the cert. When you look at the test suite you'll note that there are many things you can test without ever using the cert. I don't know how you're testing, but it may be that you're just not doing anything that requires checking the cert.

[srd90]

I don't know how you're testing, but it may be that you're just not doing anything that requires checking the cert.

Which would mean that there is something shady about implementation of this endpoint at @dovepa's codebase:

https://xxxxxxxxx/bop/api/login/callback

quoted value was taken from this comment: #873 (reply in thread)

getSamlOptions is called at multiple locations/phases and one of those locations is the one that triggers autentication (and moves control to IdP) another is when UE comes back from IdP to SP via front channel (to callback endpoint which should handle autentication request i.e. aforementioned endpoint) after IdP has autenticated end user. So you might be reporting that getSamlOptions is called during login initiator phase. More interesting thing is what happens after IdP has autenticated user.

So… could you @dovepa show how you have implemented this https://github.com/node-saml/passport-saml/tree/v4.0.4#provide-the-authentication-callback for your /bop/api/login/callback (and does IdP instruct UE to move to that endpoint at all?)

[dovepa]

Thank you very much for your guidance. Indeed, the callback request had no: @UseGuards(AuthGuard('multi-saml')).

If someone ever has the same problem, here's the corrected callback:

@Post('login/callback')
@UseGuards(AuthGuard('multi-saml'))
async azurelogincallback(@Req() _request: Request, @Res() _res: any, @Body() _body) {.........}