SLO Request Failed In Azure

[ehabAbdelMawla]

I have a MultiSamlStrategy implementation with saml factory

	GetSamlConfiguration(config, accountKey, clientRedirectUrl) {
		return {
			entryPoint: config.SamlEntryPointUrl,
			signatureAlgorithm: 'sha256' as SignatureAlgorithm,
			issuer: config.SamlIssuer,
			idpCert: config.SamlCertificate,
			callbackUrl: this.GetCallBackUrl(accountKey, clientRedirectUrl),
			wantAssertionsSigned: true,
			wantAuthnResponseSigned: false
		};
	}
	onModuleInit() {
		passport.use(
			new MultiSamlStrategy(
				{
					passReqToCallback: true,
					getSamlOptions: async (req: any, Done) => {
						try {
							const { accountKey, clientRedirectUrl } = req.query;
							console.log('getSamlOptions', { accountKey, clientRedirectUrl });
							const config = await this.GenericRepository.GetAccountSsoConfigByKey(accountKey);
							if (!(config && config.SsoType == SsoTypes.SAML)) {
								throw new SsoException(ErrorCodesEnum.SSO_CONFIGURATION_NOT_FOUND);
							}
							return Done(null, this.GetSamlConfiguration(config, accountKey, clientRedirectUrl));
						} catch (error) {
							return Done(new SsoException(ErrorCodesEnum.SSO_CONFIGURATION_NOT_FOUND), null);
						}
					}
				},
				function (Req, Profile, Done) {
					return Done(null, {
						email: Profile.nameID
					});
				},
				null
			)
		);
	}

	logout(req: any, res: any) {
		(passport as any)._strategy('saml').logout(req, function (err, logoutUrl) {
			if (err) {
				console.log({ err });
				return res.status(500).send('Error during logout');
			}

			console.log({ logoutUrl });
			return res.redirect(logoutUrl);
		});
	}

but i get following error in Microsoft
AADSTS7500525: There was an XML error in the SAML message at line 1, position 445. Verify that the XML content of the SAML messages conforms to the SAML protocol specifications.

[ehabAbdelMawla]

[markstos]

If you believe that node-saml / passport-saml is generating invalid XML add logging that captures the XML and review it and describe what's happening around line 1, position 445 that looks like a bug in passport-saml.

[srd90]

Best thing is that reporter already logs logout request payload. Quote from bug report example code:

console.log({ logoutUrl });
return res.redirect(logoutUrl);

All information that is needed to resolve this issue is already logged.

If I would have to guess two things: 1) what is the version of passport-saml that reporter used (not mentioned at bug report) 2) what might be the problem without seeing logout request content

I would guess that reporter used 5.0.0 which implicates @node-saml/node-saml 5.0.0 which implicates this logout request generating function:
https://github.com/node-saml/node-saml/blob/72a39dcf46a93a8679123db78b22ff82d6dd4096/src/saml.ts#L348-L402

If we keep guessing problem might be missing or incorrectly named value at NameID element's format attribute:
https://github.com/node-saml/node-saml/blob/72a39dcf46a93a8679123db78b22ff82d6dd4096/src/saml.ts#L366
or missing/empty/... nameid value
https://github.com/node-saml/node-saml/blob/72a39dcf46a93a8679123db78b22ff82d6dd4096/src/saml.ts#L367

Bug report example code shows that it does not store value of nameIDFormat or nameID to profile (with those names) so those are not available during logoutrequest generation phase. Quote from bug report code:

function (Req, Profile, Done) {
   return Done(null, {
                email: Profile.nameID
             });
},

I guess (without trying to calculate/estimate whether namidformat would be 445's character) that problem is related to value of nameidformat or nameid.

FWIW, logouturl's payload is deflated and base64 encoded:
https://github.com/node-saml/node-saml/blob/72a39dcf46a93a8679123db78b22ff82d6dd4096/src/saml.ts#L442-L493
so you would have to undo such things to see payload xml.

Easiest way to see payload xml is to use some saml tracer browser plugin.

Note: logoutrequest payload might contain sensutive information. Do not send encoded payload as-is because extracting original (unmasked/desensified) payload is easy task.