WS Federation middleware for node.js.
npm install wsfed
This middleware is meant to generate a valid WSFederation endpoint that talks saml.
The idea is that you will use another mechanism to valida the user first.
The endpoint supports metadata as well in the url /FederationMetadata/2007-06/FederationMetadata.xml.
Options
| Name | Description | Default |
|---|---|---|
| cert | public key used by this identity provider | REQUIRED |
| key | private key used by this identity provider | REQUIRED |
| getPostURL | get the url to post the token f(wtrealm, wreply, req, callback) | REQUIRED |
| issuer | the name of the issuer of the token | REQUIRED |
| audience | the audience for the saml token | req.query.wtrealm |
| getUserFromRequest | how to extract the user information from request | function(req) { return req.user; } |
| profileMapper | mapper to map users to claims (see PassportProfileMapper) | PassportProfileMapper |
| signatureAlgorithm | signature algorithm, options: rsa-sha1, rsa-sha256 | 'rsa-sha256' |
| digestAlgorithm | digest algorithm, options: sha1, sha256 | 'sha256' |
| wctx | state of the auth process | req.query.wctx |
Add the middleware as follows:
app.get('/wsfed', wsfed.auth({
issuer: 'the-issuer',
cert: fs.readFileSync(path.join(__dirname, 'some-cert.pem')),
key: fs.readFileSync(path.join(__dirname, 'some-cert.key')),
getPostUrl: function (wtrealm, wreply, req, callback) {
return cb( null, 'http://someurl.com')
}
}));wsfed can generate the metadata document for wsfederation as well. Usage as follows:
app.get('/wsfed/FederationMetadata/2007-06/FederationMetadata.xml', wsfed.metadata({
issuer: 'the-issuer',
cert: fs.readFileSync(path.join(__dirname, 'some-cert.pem')),
}));It also accept two optionals parameters:
- profileMapper: a class implementing the profile mapper. This is used to render the claims type information (using the metadata property). See PassportProfileMapper for more information.
- endpointPath: this is the full path in your server to the auth route. By default the metadata handler uses the metadata request route without
/FederationMetadata/2007..blabla.
ADFS v1 uses another set of endpoints for the metadata and the thumbprint. If you have to connect an ADFS v1 client you have to do something like this:
app.get('/wsfed/adfs/fs/federationserverservice.asmx',
wsfed.federationServerService.wsdl);
app.post('/wsfed/adfs/fs/federationserverservice.asmx',
wsfed.federationServerService.thumbprint({
pkcs7: yourPkcs7,
cert: yourCert
}));notice that you need a pkcs7 with the full chain of all certificates. You can generate this with openssl as follows:
openssl crl2pkcs7 -nocrl \
-certfile your.crt \
-certfile another-cert-in-the-chain.crt \
-out contoso1.p7bBy default the signed assertion is a SAML token, you can use JWT tokens as follows:
app.get('/wsfed', wsfed.auth({
jwt: true,
issuer: 'the-issuer',
key: fs.readFileSync(path.join(__dirname, 'some-cert.key')),
getPostUrl: function (wtrealm, wreply, req, callback) {
return cb( null, 'http://someurl.com')
}
}));MIT - AUTH0 2013!