Support for AttributeConsumingService

[brandon-leapyear]

Hi, is there a way to configure <md:AttributeConsumingService> with this library? Or do attribute requirements have to be communicated out-of-band to the IdP?

https://en.wikipedia.org/wiki/SAML_Metadata#Service_Provider_Metadata

[markstos]

When I use Github search to search the code for "AttributeConsumingService", I get back no results, so I'm guessing the answer is "not currently". If it makes the project more spec-compliant, a pull request is welcome. It should include updating the documentation, adding test coverage, references to the part of the spec being implemented and ideally some peer review.

[aeaton-overleaf]

It does seem strange that passport-saml has an attributeConsumingServiceIndex option, but nothing in the generateServiceProviderMetadata function that builds the metadata to add an AttributeConsumingService block.

passport-saml/src/node-saml/saml.ts

Lines 1314 to 1407 in 54a1e04

	generateServiceProviderMetadata(decryptionCert: string | null, signingCert?: string | null) {
	const metadata: ServiceMetadataXML = {
	EntityDescriptor: {
	"@xmlns": "urn:oasis:names:tc:SAML:2.0:metadata",
	"@xmlns:ds": "http://www.w3.org/2000/09/xmldsig#",
	"@entityID": this.options.issuer,
	"@ID": this.options.issuer.replace(/\W/g, "_"),
	SPSSODescriptor: {
	"@protocolSupportEnumeration": "urn:oasis:names:tc:SAML:2.0:protocol",
	},
	},
	};
	if (this.options.decryptionPvk != null) {
	if (!decryptionCert) {
	throw new Error(
	"Missing decryptionCert while generating metadata for decrypting service provider"
	);
	}
	}
	if (this.options.privateKey != null) {
	if (!signingCert) {
	throw new Error(
	"Missing signingCert while generating metadata for signing service provider messages"
	);
	}
	}
	if (this.options.decryptionPvk != null || this.options.privateKey != null) {
	metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor = [];
	if (this.options.privateKey != null) {
	signingCert = signingCert!.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, "");
	signingCert = signingCert.replace(/-+END CERTIFICATE-+\r?\n?/, "");
	signingCert = signingCert.replace(/\r\n/g, "\n");
	metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor.push({
	"@use": "signing",
	"ds:KeyInfo": {
	"ds:X509Data": {
	"ds:X509Certificate": {
	"#text": signingCert,
	},
	},
	},
	});
	}
	if (this.options.decryptionPvk != null) {
	decryptionCert = decryptionCert!.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, "");
	decryptionCert = decryptionCert.replace(/-+END CERTIFICATE-+\r?\n?/, "");
	decryptionCert = decryptionCert.replace(/\r\n/g, "\n");
	metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor.push({
	"@use": "encryption",
	"ds:KeyInfo": {
	"ds:X509Data": {
	"ds:X509Certificate": {
	"#text": decryptionCert,
	},
	},
	},
	EncryptionMethod: [
	// this should be the set that the xmlenc library supports
	{ "@Algorithm": "http://www.w3.org/2001/04/xmlenc#aes256-cbc" },
	{ "@Algorithm": "http://www.w3.org/2001/04/xmlenc#aes128-cbc" },
	{ "@Algorithm": "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" },
	],
	});
	}
	}
	if (this.options.logoutCallbackUrl != null) {
	metadata.EntityDescriptor.SPSSODescriptor.SingleLogoutService = {
	"@Binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
	"@Location": this.options.logoutCallbackUrl,
	};
	}
	if (this.options.identifierFormat != null) {
	metadata.EntityDescriptor.SPSSODescriptor.NameIDFormat = this.options.identifierFormat;
	}
	if (this.options.wantAssertionsSigned) {
	metadata.EntityDescriptor.SPSSODescriptor["@WantAssertionsSigned"] = true;
	}
	metadata.EntityDescriptor.SPSSODescriptor.AssertionConsumerService = {
	"@index": "1",
	"@isDefault": "true",
	"@Binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
	"@Location": this.getCallbackUrl(),
	};
	return buildXmlBuilderObject(metadata, true);
	}

[aeaton-overleaf]

Maybe something like this, at the end of generateServiceProviderMetadata?

if (this.options.attributeConsumingServices) {
    this.options.attributeConsumingServices.forEach((attributeConsumingService, index) => {
      metadata.EntityDescriptor.SPSSODescriptor.AttributeConsumingService = {
        '@index': index,
        '@isDefault': attributeConsumingService.isDefault,
        ServiceName: attributeConsumingService.name,
        ServiceDescription: attributeConsumingService.description,
        RequestedAttribute: attributeConsumingService.requestedAttributes.map(requestedAttribute => ({
          '@isRequired': requestedAttribute.isRequired,
          '@FriendlyName': requestedAttribute.friendlyName,
          '@Name': requestedAttribute.name,
          '@NameFormat': requestedAttribute.nameFormat
        }))
      };
    })
  }

https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP#MetadataForSP-DocumentingAttributes

[cjbarth]

@aeaton-overleaf , are you willing to put up a PR for this?

[aeaton-overleaf]

@cjbarth I'm not planning to work on this immediately, but a colleague may be able to write up a PR later this year (pending other priorities - let me know if there's a need for it sooner).

[cjbarth]

As this is a community-driven project, we look forward to, and depend upon, those that notice missing features putting up a PR to fill that need. The maintainers will be here to help the PR along.

[omidraha]

I think currently implemented by under lib:
node-saml/node-saml#337

[mirinio]

nope its not implemented yet :(

[srd90]

Sidenote: SP metadata is just a XML doc. Why not generate it by yourself and you get exactly what you wish instead of maintaining API along with all the typings and other extra work for such operation.

• How to add extra metadata? node-saml#385 (comment)
• about signing SP metadata: How to add extra metadata? node-saml#385 (reply in thread)

[markstos]

Here's an example of what this part of the XML looks like:

      <md:AttributeConsumingService index="0">
        <md:ServiceName xml:lang="en">Example.com Employee Portal</md:ServiceName>
        <md:RequestedAttribute isRequired="true"
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
          Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" FriendlyName="eduPersonUniqueId"/>
        <md:RequestedAttribute
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
          Name="urn:oid:0.9.2342.19200300.100.1.3" FriendlyName="mail"/>
      </md:AttributeConsumingService>

If we were to implement this in a maximally TypeScripty way, the interface would look like this:

export interface AttributeConsumingService {
  "@index": string;
  "@isDefault"?: boolean;
  ServiceName: {
    "@xml:lang": string;
    "#text": string;
  }[];
  ServiceDescription?: {
    "@xml:lang": string;
    "#text": string;
  }[];
  RequestedAttribute: {
    "@Name": string;
    "@NameFormat"?: string;
    "@FriendlyName"?: string;
    "@isRequired"?: boolean;
    AttributeValue?: {
      "#text": string;
    }[];
  }[];
}

At the point you are supplying all those details, why not finishing writing the XML yourself? Maybe the answer today is that defining the interface in TypeScript is going to help your IDE walk you through adding all the details.

[srd90]

Maybe the answer today is that defining the interface in TypeScript is going to help your IDE walk you through adding all the details.

...TS interface definition would be just an anoter flavour of XML Schema Definition of metadata(*). Usable IDEs understand XSD and help to scratch (SP MD) XML

(*) https://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd

https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

[jetze-meilink]

It would be great to have this.
Let me know if I can assist in anything.

[srd90]

@jetze-meilink in case you didn't notice there is already PR

• Add support for AttributeConsumingService in SAML metadata node-saml#396

maybe you could review / test it