auth0/node-samlp

SAML Request ID is not used in AuthnResponse

yesvivek opened this issue · 9 comments

yesvivek commented

When sending SAML request to node-samlp IdP, for the first time, ID in the request is properly used in InResponseTo attribute of Response. But for the subsequent requests, this InResponseTo attribute is not taken from the respective requests, instead, the same ID from the first request is sent as InResponseTo for all requests. I could see this issue always.

mcastany commented

Hello @yesvivek

I was reviewing the implementation of the auth function and the ID used as InResponseTo in the SAMLResponse is taken from the SAMLRequest unless you explicit set it as an option

https://github.com/auth0/node-samlp/blob/master/lib/samlp.js#L174-L175

Can you check the following:

  • You are not explicitly setting the InResponseTo when calling samlp.auth(options)
  • Your SAMLRequest has different IDs
yesvivek commented

@mcastany , My SAMLRequest has different IDs for each request. Am setting destination and all REQUIRED options when calling samlp.auth.

https://github.com/auth0/node-samlp/blob/master/lib/samlp.js#L175
This seems to be causing this issue for me. Changing it to if (id) opts.inResponseTo = id; works for me.
What do you suggest?

siacomuzzi commented

Could you please check the value of opts.inResponseTo before line 175? https://github.com/auth0/node-samlp/blob/master/lib/samlp.js#L175

yesvivek commented

Have added the below line as recommended in above comment.
console.log( "Dom ID: " + id + " VS opts.inResponseTo: " + opts.inResponseTo);

Results after multiple SAMLRequests:

1. Dom ID: id175479885406247111143820862 VS opts.inResponseTo: undefined
2. Dom ID: id13229522944305032913039188 VS opts.inResponseTo: id175479885406247111143820862
3. Dom ID: id175429005758588441628725185 VS opts.inResponseTo: id175479885406247111143820862
4. Dom ID: id175496083313503221789498695 VS opts.inResponseTo: id175479885406247111143820862
siacomuzzi commented

I can reproduce the issue, we'll work on it. In the meantime, you can apply your workaround (if (id) opts.inResponseTo = id;)

  • 👍1
siacomuzzi commented

try with samlp@2.1.2

thanks for reporting!

yesvivek commented

Thanks for the quick patch! It works awesome now.

siacomuzzi commented

But this is incompatible with my Service Provider

do you know why? InResponseTo contains the ID of the initial SAMLRequest.

paulocheque commented

Don't know. But I close the issue since I saw what creates this id. Thanks.