Skip to content

Add IsPassive option #135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add IsPassive option #135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d843d3
Add IsPassive option
May 17, 2018
02c0d79
Add is_passive to the readme
May 17, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ An object that can contain the below options. All options are strings, unless s
- `audience` - (String or RegExp) — If set, at least one of the `<Audience>` values within the `<AudienceRestriction>` condition of a SAML authentication response must match. Defaults to `entity_id`.
- `notbefore_skew` - (Number) – To account for clock skew between IdP and SP, accept responses with a NotBefore condition ahead of the current time (according to our clock) by this number of seconds. Defaults to 1. Set it to 0 for optimum security but no tolerance for clock skew.
- `force_authn` - (Boolean) - If true, forces re-authentication of users even if the user has a SSO session with the [IdP](#IdentityProvider). This can also be configured on the [IdP](#IdentityProvider) or on a per-method basis.
- `is_passive` - (Boolean) - If true, a compliant [IdP](#IdentityProvider) will not prompt the user for input and will return an http error if doing so would be required.
- `auth_context` - Specifies `AuthnContextClassRef`. This can also be configured on a per-method basis.
- `nameid_format` - Format for Name ID. This can also be configured on a per-method basis.
- `sign_get_request` - (Boolean) - If true, signs the request. This can also be configured on the [IdP](#IdentityProvider) or on a per-method basis.
Expand Down
9 changes: 5 additions & 4 deletions lib/saml2.coffee
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ class SAMLError extends Error

# Creates an AuthnRequest and returns it as a string of xml along with the randomly generated ID for the created
# request.
create_authn_request = (issuer, assert_endpoint, destination, force_authn, context, nameid_format) ->
create_authn_request = (issuer, assert_endpoint, destination, force_authn, context, nameid_format, is_passive) ->
if context?
context_element = _(context.class_refs).map (class_ref) -> 'saml:AuthnContextClassRef': class_ref
context_element.push '@Comparison': context.comparison
Expand All @@ -43,6 +43,7 @@ create_authn_request = (issuer, assert_endpoint, destination, force_authn, conte
'@AssertionConsumerServiceURL': assert_endpoint
'@ProtocolBinding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
'@ForceAuthn': force_authn
'@IsPassive': is_passive
'saml:Issuer': issuer
NameIDPolicy:
'@Format': nameid_format or 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
Expand Down Expand Up @@ -507,7 +508,7 @@ module.exports.ServiceProvider =
@alt_certs = [].concat(@alt_certs or [])

@shared_options = _(options).pick(
"force_authn", "auth_context", "nameid_format", "sign_get_request", "allow_unencrypted_assertion", "audience", "notbefore_skew")
"force_authn", "auth_context", "nameid_format", "sign_get_request", "allow_unencrypted_assertion", "audience", "notbefore_skew", "is_passive")

# Returns:
# Redirect URL at which a user can login
Expand All @@ -519,7 +520,7 @@ module.exports.ServiceProvider =
create_login_request_url: (identity_provider, options, cb) ->
options = set_option_defaults options, identity_provider.shared_options, @shared_options

{ id, xml } = create_authn_request @entity_id, @assert_endpoint, identity_provider.sso_login_url, options.force_authn, options.auth_context, options.nameid_format
{ id, xml } = create_authn_request @entity_id, @assert_endpoint, identity_provider.sso_login_url, options.force_authn, options.auth_context, options.nameid_format, options.is_passive
zlib.deflateRaw xml, (err, deflated) =>
return cb err if err?
try
Expand All @@ -542,7 +543,7 @@ module.exports.ServiceProvider =
create_authn_request_xml: (identity_provider, options) ->
options = set_option_defaults options, identity_provider.shared_options, @shared_options

{ id, xml } = create_authn_request @entity_id, @assert_endpoint, identity_provider.sso_login_url, options.force_authn, options.auth_context, options.nameid_format
{ id, xml } = create_authn_request @entity_id, @assert_endpoint, identity_provider.sso_login_url, options.force_authn, options.auth_context, options.nameid_format, options.is_passive
return sign_authn_request(xml, @private_key, options)

# Returns:
Expand Down