11// useful tutorial
22// https://medium.com/disney-streaming/setup-a-single-sign-on-saml-test-environment-with-docker-and-nodejs-c53fc1a984c9
33
4+ import type { Request } from 'express'
45import { readFile , access , constants } from 'node:fs/promises'
5- import type { Saml2 } from '../../config/type/index.ts'
6+ import type { SAML2 } from '../../config/type/index.ts'
67import config from '#config'
78import _slug from 'slugify'
89import samlify from 'samlify'
@@ -11,14 +12,16 @@ import mongo from '#mongo'
1112import { decipher , cipher } from '../utils/cipher.ts'
1213import { exec } from 'node:child_process'
1314import { promisify } from 'node:util'
15+ import { getSiteBaseUrl , reqSite } from '#services'
16+ import { type Site } from '#types'
1417
1518const execAsync = promisify ( exec )
1619const debug = Debug ( 'saml' )
1720const slug = _slug . default
1821
1922type Certificates = { signing : { privateKey : string , cert : string } , encrypt : { privateKey : string , cert : string } }
2023
21- type PreparedSaml2Provider = Saml2 & { id : string , idp : samlify . IdentityProviderInstance }
24+ type PreparedSaml2Provider = SAML2 & { id : string , idp : samlify . IdentityProviderInstance }
2225
2326// const validator = require('@authenio/samlify-xsd-schema-validator')
2427// samlify.setSchemaValidator(validator)
@@ -29,6 +32,27 @@ samlify.setSchemaValidator({
2932 }
3033} )
3134
35+ export const getSamlProviderById = async ( req : Request , id : string ) : Promise < PreparedSaml2Provider | undefined > => {
36+ const site = await reqSite ( req )
37+ if ( ! site ) {
38+ return saml2GlobalProviders ( ) . find ( p => p . id === id )
39+ } else {
40+ const providerInfo = site . authProviders ?. find ( p => p . type === 'saml2' && getSamlConfigId ( p ) === id ) as SAML2
41+ const idp = samlify . IdentityProvider ( providerInfo )
42+ return {
43+ id,
44+ ...providerInfo ,
45+ idp
46+ }
47+ }
48+ }
49+
50+ export const getSamlConfigId = ( providerConfig : SAML2 ) => {
51+ const idp = samlify . IdentityProvider ( providerConfig )
52+ if ( ! idp . entityMeta . meta . entityID ) throw new Error ( 'missing entityID in saml IDP metadata' )
53+ return getSamlProviderId ( idp . entityMeta . meta . entityID )
54+ }
55+
3256export const getSamlProviderId = ( url : string ) => {
3357 return slug ( new URL ( url ) . host , { lower : true , strict : true } )
3458}
@@ -56,8 +80,16 @@ const readDeprecatedCertificates = async (): Promise<undefined | Certificates> =
5680 }
5781}
5882
59- const readCertificates = async ( ) : Promise < undefined | Certificates > => {
60- const secret = await mongo . secrets . findOne ( { _id : 'saml-certificates' } )
83+ const getSiteCertKey = ( site ?: Site ) => {
84+ if ( ! site ) return 'saml-certificates'
85+ let key = 'saml-certificates-' + slug ( site . host )
86+ if ( site . path ) key += `--${ slug ( site . path ) }
87+ return key
88+ }
89+
90+ const readCertificates = async ( site ?: Site ) : Promise < undefined | Certificates > => {
91+ const key = getSiteCertKey ( site )
92+ const secret = await mongo . secrets . findOne ( { _id : key } )
6193 if ( secret ) {
6294 const certificates = secret . data
6395 certificates . signing . privateKey = decipher ( certificates . signing . privateKey )
@@ -66,52 +98,47 @@ const readCertificates = async (): Promise<undefined | Certificates> => {
6698 }
6799}
68100
69- const writeCertificates = async ( certificates : Certificates ) => {
101+ const writeCertificates = async ( certificates : Certificates , site ?: Site ) => {
102+ const key = getSiteCertKey ( site )
70103 const storedCertificates = { signing : { ...certificates . signing } , encrypt : { ...certificates . encrypt } } as any
71104 storedCertificates . signing . privateKey = cipher ( certificates . signing . privateKey )
72105 storedCertificates . encrypt . privateKey = cipher ( certificates . encrypt . privateKey )
73- await mongo . secrets . insertOne ( { _id : 'saml-certificates' , data : storedCertificates } )
106+ await mongo . secrets . insertOne ( { _id : key , data : storedCertificates } )
74107}
75108
76109const _globalProviders : PreparedSaml2Provider [ ] = [ ]
77110let _sp : samlify . ServiceProviderInstance | undefined
78- export const saml2ServiceProvider = ( ) => {
79- if ( ! _sp ) throw new Error ( 'Global Saml 2 providers ware not initialized' )
111+ export const saml2ServiceProvider = async ( site ?: Site ) => {
112+ if ( ! _sp ) throw new Error ( 'Global Saml 2 provider was not initialized' )
113+ if ( site ) return await initServiceProvider ( site )
80114 return _sp
81115}
82116export const saml2GlobalProviders = ( ) => {
83- if ( ! _sp ) throw new Error ( 'Global Saml 2 providers ware not initialized' )
117+ if ( ! _sp ) throw new Error ( 'Global Saml 2 provider was not initialized' )
84118 return _globalProviders
85119}
86120
87- export const init = async ( ) => {
88- let certificates = await readCertificates ( )
121+ const initCertificates = async ( site ?: Site ) => {
122+ let certificates = await readCertificates ( site )
89123 if ( ! certificates ) {
90124 console . log ( 'Initializing SAML certificates' )
91- certificates = await readDeprecatedCertificates ( )
92- if ( certificates ) {
93- console . log ( 'Migrating SAML certificates from filesystem to database' )
94- } else {
125+ if ( ! site ) {
126+ certificates = await readDeprecatedCertificates ( )
127+ if ( certificates ) {
128+ console . log ( 'Migrating SAML certificates from filesystem to database' )
129+ }
130+ }
131+ if ( ! certificates ) {
95132 console . log ( 'Generating new SAML certificates' )
96133 certificates = { signing : await createCert ( ) , encrypt : await createCert ( ) }
97134 }
98- await writeCertificates ( certificates )
135+ await writeCertificates ( certificates , site )
99136 }
137+ return certificates
138+ }
100139
101- const assertionConsumerService = [ {
102- Binding : samlify . Constants . namespace . binding . post ,
103- Location : `${ config . publicUrl }
104- } ]
105- debug ( 'config service provider' )
106- _sp = samlify . ServiceProvider ( {
107- entityID : `${ config . publicUrl } ,
108- assertionConsumerService,
109- signingCert : certificates . signing . cert ,
110- privateKey : certificates . signing . privateKey ,
111- encryptCert : certificates . encrypt . cert ,
112- encPrivateKey : certificates . encrypt . privateKey ,
113- ...config . saml2 . sp
114- } )
140+ export const init = async ( ) => {
141+ _sp = await initServiceProvider ( )
115142
116143 debug ( 'config identity providers' )
117144 for ( const providerConfig of config . saml2 . providers ) {
@@ -126,6 +153,27 @@ export const init = async () => {
126153 }
127154}
128155
156+ export const initServiceProvider = async ( site ?: Site ) => {
157+ const certificates = await initCertificates ( site )
158+ const url = site ? `${ getSiteBaseUrl ( site ) } : config . publicUrl
159+ const assertionConsumerService = [ {
160+ Binding : samlify . Constants . namespace . binding . post ,
161+ Location : `${ url }
162+ } ]
163+ debug ( 'config service provider' )
164+ return samlify . ServiceProvider ( {
165+ entityID : `${ url } ,
166+ assertionConsumerService,
167+ signingCert : certificates . signing . cert ,
168+ privateKey : certificates . signing . privateKey ,
169+ encryptCert : certificates . encrypt . cert ,
170+ encPrivateKey : certificates . encrypt . privateKey ,
171+ // @ts -ignore if we use a boolean the attribute is set as empty in the xml output, and some IDP don't like that
172+ allowCreate : 'false' ,
173+ ...config . saml2 . sp
174+ } )
175+ }
176+
129177const createCert = async ( ) => {
130178 const subject = `/C=FR/CN=${ new URL ( config . publicUrl ) . hostname }
131179 const privateKey = ( await execAsync ( 'openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048' ) ) . stdout
0 commit comments