Avoid calling getSamlOptions after authentication on IdP

[NickTaylor98]

Try to setup Passport-SAML on my project. Here is an code example

export const samlFederationAuthentication = () => {
  const multiSamlStrategy: MultiSamlStrategy = new MultiSamlStrategy(
    {
      passReqToCallback: true,
      getSamlOptions: async (req: Express.Request, done: SamlOptionsCallback) => {
        const entityID: string = decodeURIComponent((req.query.entityID as string) || '');

        if (!entityID) {
          return done(
            CustomError(
              'Not supported',
              'SAML AUTH',
              `EntityID is undefined`
            )
          );
        }

        const config = await samlFederation.getConfig(); // getting entrypoint and certificate

        if (!config[entityID]) {
          return done(
            CustomError(
              'Not supported',
              'SAML AUTH',
              `EntityID is not supported by IDp`
            )
          );
        }

        return done(null, {
          ...config[entityID],
          callbackUrl: envConfig.samlFederation.callbackURL,
          issuer: envConfig.samlFederation.issuer,
        });
      },
    },
    async (req: Express.Request, profile, done) => {
      try {
        const profileUsername: string = samlFederation.getProfileUsername(profile || {});

        if (!profileUsername) {
          return done(
            CustomError(
              'Username and email are undefined',
              'SAML AUTH',
              `Username or email should be defined in SAML profile`
            )
          );
        }

        const dbUser = await userService.getUserByUsername(profileUsername);

        if (!!dbUser) {
          return done(null, dbUser);
        }


        const createdUser: IUser = await userService.createUser(profile || {});

        return done(null, createdUser as Record<string, any>);
      } catch (err) {
        return done(err);
      }
    }
  );

  Passport.use('multi-saml', multiSamlStrategy);
};

and routes:

export const addSamlFederationRoutes = (app: Express.Application) => {
  app.get('/auth/saml', Passport.authenticate('multi-saml'));
  app.post(
    '/auth/saml/callback',
    Passport.authorize('multi-saml', { failureRedirect: '/', failureFlash: true }),
    userHandler // some handler with user data
  );
};

So now I describe my problem.

1. Users go to federation form and choose some special IdP they wanted to authenticate
2. Federation form sends a request to our server GET /auth/saml with EntityID in query of external IdP.
3. Our server looks in database required config params and redirect user to IdP form.

When users go to IdP and enter their credentials then they redirected to our server with url auth/saml/callback. It's great but we call middleware passport.authorize that lead to calling function getSamlOptions in MultiSamlStrategy. But IdP doesn't send me entityID in params and my function always send error Entity ID is undefined. So, my question is how to avoid calling getSamlOptions after authenticating on IdP.

[cjbarth]

The multiSamlStrategy needs the config that it should use, so it has to call that function to get its options. Having said that, it seems that you are not returning the correct data from your getSamlOptions function. If you look at the types in the source code, you'll be able to see what you should be returning.

[NickTaylor98]

@cjbarth thanks for your answer.
Maybe I described not in a correct way my problem. Just try to describe deeper.
So, we have a special form provided by Discovery Service of one federation. Those form contains a lot of different IdPs.
I create webapp and want to use those form for getting user data about preferable variant for authentication.
Those form uses request GET /auth/saml ( you can see in my code ⬆️) with param called entityID. entityID is identifier of external IdP. So, here it looks all OK. On this stage getSamlOptions works greatly because we get some identifier and can set samlOptions depending on it. It's cool!
We set callbackUrl property as /auth/saml/callback (you can see in my code ⬆️ ). But those IdP doesn't send me any info about their entityID. And if you see my code getSamlOptions begins with trying to get entityID query param. So my problem is that I want to miss getSamlOptions after authenticating on external IdP because I don't have param entityID but I have a SAMLResponse that can be parsed into profile. Why should I need to use getSamlOptions after getting SAMLResponse ?

[cjbarth]

Why should I need to use getSamlOptions after getting SAMLResponse ?

You'll want to know which SAML config should process the SAMLResponse.

Also, you didn't comment on my observation that your return value appears to be wrong. If possible, I would spend some time with the TypeScript types to make sure everything is right. I might even suggest adding TypeScript to your project since it also works just fine with JavaScript.