Get ServiceNotSpecified using Shibboleth

[deadpickle]

I get the error "ServiceNotSpecified" when I try to use SSO login. here is my edited strategy:

passport.use('shibboleth', new samlStrategy({
      entryPoint: '**************idp/profile/cas/login',
      issuer: my_app_url,
      cert: '************M=',
      identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
      authnContext: ['urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'],
      authnRequestBinding: 'HTTP-REDIRECT',
      protocol: 'https://',
      signatureAlgorithm: 'sha256',
      acceptedClockSkewMs: -1
    },
    function(profile, done) {
      accessctrl.loginStrategy(req, email, password, done)
    })
  );

[srd90]

@deadpickle you didn't provide too much information about ServiceNotSpecified error (based on googling it can be related to multiple things), BUT your configuration has

      entryPoint: '**************idp/profile/cas/login',

and you are trying to use passport-saml. I.e. AuthnRequests are sent to Shibboleth IdP's CAS protocol login endpoint. Based on your authn request binding protocol

      authnRequestBinding: 'HTTP-REDIRECT',

more appropriate entryPoint would be **************idp/profile/SAML2/Redirect/SSO which is SAML 2.0 Browser SSO profile's redirect binding authn request entrypoint. See: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631857/ProtocolsAndInterfaces

Sidenote: your configuration is very unsecure. It enables reusing / replaying LoginResponse forever without ever having to use IdP login again. I.e. if user loses his access (account is e.g. disabled at IdP side) but he/she has stored SAML 2.0 login response he/she can gain access to your service by replaying old LoginResponse. Furhermore your configuration makes it possible to reuse SAML login response which was targeted to some other service which shares same IdP by replaying that login response to your service. Reasons are that you have disabled NotOnOrAfter validation (due acceptedClockSkewMs: -1) and that you haven't enable audience validation.

If you copy-pasted configuration from #520 (comment) I urge you to read also this comment #520 (comment) (which describes effects of acceptedClockSkewMs: -1) and - in case you copy-pasted first configuration without checking what it actually does - #520 (comment)

About audience checking check: #137 (comment) and node-saml/node-saml#25 (that PR has not landed yet so at the moment audience validation is disabled by default).