Skip to content

Commit a3210ea

Browse files
drc-bsveedrc-bsvee
committed
Merge master (upstream v8.0.0): add encryption algorithm options
- Bring in upstream v8.0.0 (feat: add encryption algorithm options auth0#157) - Keep DRC customizations: absoluteUrls metadata feature, Node>=22, nyc coverage, mocha 11.3.0, @auth0/xmldom 0.1.23, security overrides - Keep ci.yml with Node 22.x + actions v4 (reject upstream regression to v1) - Retain v7.2.0 changelog entry alongside upstream v8.0.0 entry - Error regex updated to OpenSSL 3 / Node 22 specific pattern
2 parents 844a4db + a7a5b53 commit a3210ea

5 files changed

Lines changed: 118 additions & 9 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
1-
# Changelog
1+
# [8.0.0](https://github.com/auth0/node-samlp/compare/v7.1.1...v8.0.0) (2026-03-31)
22

3-
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
3+
4+
### Features
5+
6+
* add encryption algorithm options ([#157](https://github.com/auth0/node-samlp/issues/157)) ([1444aad](https://github.com/auth0/node-samlp/commit/1444aad42039578d0a659576141318c91e8e5afe))
7+
8+
9+
### BREAKING CHANGES
10+
11+
* adding encryption algorithm in options(if not set, defaults to http://www.w3.org/2009/xmlenc11#aes256-gcm), adding disallowEncryptionWithInsecureAlgorithm to enforce secure encryption algorithms
412

513
## [7.2.0](https://github.com/DataRecognitionCorporation/node-samlp/compare/v7.1.1...v7.2.0) (2026-04-02)
614

@@ -25,7 +33,6 @@ All notable changes to this project will be documented in this file. See [standa
2533
* replace istanbul with nyc@15 for coverage
2634
* update CI workflow to Node.js 22.x; upgrade actions/checkout and actions/setup-node to v4
2735

28-
2936
### [7.1.1](https://github.com/auth0/node-samlp/compare/v7.1.0...v7.1.1) (2023-11-20)
3037

3138

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,11 @@ Options
4040
| RelayState | state of the auth process | ```req.query.RelayState || req.body.RelayState``` |
4141
| sessionIndex | the index of a particular session between the principal identified by the subject and the authenticating authority | _SessionIndex is not included_ |
4242
| responseHandler | custom response handler for SAML response f(SAMLResponse, options, req, res, next) | HTML response that POSTS to postUrl |
43-
43+
| encryptionPublicKey | Public key used to encrypt the SAML assertion |
44+
| encryptionCert | Certificate used to encrypt SAML assertion |
45+
| encryptionAlgorithm | The encryption algorithm to encrypt saml assertion | http://www.w3.org/2009/xmlenc11#aes256-gcm ([node-xml-encryption](https://github.com/auth0/node-xml-encryption/blob/master/README.md) details the available encryption algorithms and configuration options.) |
46+
| disallowEncryptionWithInsecureAlgorithm | If true, disallows encryption with algorithms considered insecure by [node-xml-encryption](https://github.com/auth0/node-xml-encryption/blob/master/README.md) | true |
47+
| warnOnInsecureEncryptionAlgorithm | If true, logs a warning when using an insecure encryption algorithm (using disallowEncryptionWithInsecureAlgorithm as false) | true |
4448

4549
Add the middleware as follows:
4650

‎lib/samlp.js‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,10 @@ function getSamlResponse(samlConfig, user, callback) {
106106
sessionIndex: options.sessionIndex,
107107
typedAttributes: options.typedAttributes,
108108
includeAttributeNameFormat: options.includeAttributeNameFormat,
109-
signatureNamespacePrefix: options.signatureNamespacePrefix
109+
signatureNamespacePrefix: options.signatureNamespacePrefix,
110+
encryptionAlgorithm: options.encryptionAlgorithm,
111+
disallowEncryptionWithInsecureAlgorithm: options.disallowEncryptionWithInsecureAlgorithm,
112+
warnOnInsecureEncryptionAlgorithm: options.warnOnInsecureEncryptionAlgorithm
110113
}, function (err, samlAssertion) {
111114
if (err) return callback(err);
112115

‎package.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
{
22
"name": "samlp",
3-
"version": "7.2.0",
3+
"version": "8.0.0",
44
"engines": {
55
"node": ">=22"
66
},
77
"description": "SAML Protocol server middleware",
88
"main": "lib/index.js",
9+
"files": [
10+
"lib",
11+
"templates"
12+
],
913
"scripts": {
1014
"test": "./node_modules/.bin/_mocha -R spec --colors",
1115
"cover": "nyc ./node_modules/.bin/_mocha -R spec --colors",
@@ -24,13 +28,13 @@
2428
"license": "mit",
2529
"dependencies": {
2630
"@auth0/thumbprint": "0.0.6",
31+
"@auth0/xmldom": "0.1.23",
2732
"auth0-id-generator": "^0.2.0",
2833
"ejs": "^3.1.10",
2934
"flowstate": "^0.4.0",
3035
"querystring": "^0.2.0",
3136
"saml": "^4.0.0",
3237
"xml-crypto": "^2.0.0",
33-
"@auth0/xmldom": "0.1.23",
3438
"xpath": "0.0.5",
3539
"xtend": "^1.0.3"
3640
},

‎test/samlp.tests.js‎

Lines changed: 93 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ var querystring = require('querystring');
1010
var encoder = require('../lib/encoders');
1111
var fs = require('fs');
1212
var path = require('path');
13+
var getSamlResponse = require('../lib/samlp').getSamlResponse;
1314

1415
describe('samlp', function () {
1516

@@ -697,7 +698,7 @@ describe('samlp', function () {
697698
it('should return an error', function (done) {
698699
doRawSAMLRequest(function (response) {
699700
expect(response.statusCode).to.equal(400);
700-
expect(response.body).to.match(/(PEM routines|DECODER routines)/);
701+
expect(response.body).to.match(/error:[\w:]+:(PEM routines[\w:]*:no start line|DECODER routines[\w:]*:unsupported)/);
701702
done();
702703
});
703704
});
@@ -746,7 +747,7 @@ describe('samlp', function () {
746747
it('should return an error', function (done) {
747748
doRawSAMLRequest(function (response) {
748749
expect(response.statusCode).to.equal(400);
749-
expect(response.body).to.match(/(PEM routines|DECODER routines)/);
750+
expect(response.body).to.match(/error:[\w:]+:(PEM routines[\w:]*:no start line|DECODER routines[\w:]*:unsupported)/);
750751
done();
751752
});
752753
});
@@ -872,4 +873,94 @@ describe('samlp', function () {
872873
});
873874
});
874875
});
876+
877+
describe('when using encryption options', function () {
878+
879+
describe('when using insecure algorithm', function () {
880+
var body, $, response;
881+
882+
before(function (done) {
883+
server.options = {
884+
encryptionPublicKey: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
885+
encryptionCert: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
886+
encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
887+
disallowEncryptionWithInsecureAlgorithm: true,
888+
warnOnInsecureEncryptionAlgorithm: false
889+
};
890+
request.get({
891+
jar: request.jar(),
892+
uri: 'http://localhost:5050/samlp?SAMLRequest=' + urlEncodedSAMLRequest + '&RelayState=123'
893+
}, function (err, res, b) {
894+
if (err) return done(err);
895+
body = b;
896+
response = res;
897+
$ = cheerio.load(body);
898+
done();
899+
});
900+
});
901+
902+
it('should return an error with disallowEncryptionWithInsecureAlgorithm set to true', function () {
903+
expect(response.statusCode).to.equal(400);
904+
expect(body).to.equal('encryption algorithm http://www.w3.org/2001/04/xmlenc#aes256-cbc is not secure');
905+
});
906+
});
907+
908+
describe('when using insecure encryption algorithm with disallowEncryptionWithInsecureAlgorithm set to false', function () {
909+
var body, $, response;
910+
911+
before(function (done) {
912+
server.options = {
913+
encryptionPublicKey: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
914+
encryptionCert: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
915+
encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
916+
disallowEncryptionWithInsecureAlgorithm: false,
917+
warnOnInsecureEncryptionAlgorithm: false
918+
};
919+
request.get({
920+
jar: request.jar(),
921+
uri: 'http://localhost:5050/samlp?SAMLRequest=' + urlEncodedSAMLRequest + '&RelayState=123'
922+
}, function (err, res, b) {
923+
if (err) return done(err);
924+
body = b;
925+
response = res;
926+
$ = cheerio.load(body);
927+
done();
928+
});
929+
});
930+
931+
it('should return success with disallowEncryptionWithInsecureAlgorithm set to false', function (done) {
932+
expect(response.statusCode).to.equal(200);
933+
done();
934+
});
935+
});
936+
937+
describe('when using secure encryption algorithm', function () {
938+
var body, $, response;
939+
940+
before(function (done) {
941+
server.options = {
942+
encryptionPublicKey: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
943+
encryptionCert: fs.readFileSync(path.join(__dirname, 'fixture/sp1.pem')),
944+
encryptionAlgorithm: 'http://www.w3.org/2009/xmlenc11#aes256-gcm',
945+
disallowEncryptionWithInsecureAlgorithm: true,
946+
warnOnInsecureEncryptionAlgorithm: false
947+
};
948+
request.get({
949+
jar: request.jar(),
950+
uri: 'http://localhost:5050/samlp?SAMLRequest=' + urlEncodedSAMLRequest + '&RelayState=123'
951+
}, function (err, res, b) {
952+
if (err) return done(err);
953+
body = b;
954+
response = res;
955+
$ = cheerio.load(body);
956+
done();
957+
});
958+
});
959+
960+
it('should return success when using a secure algorithm', function (done) {
961+
expect(response.statusCode).to.equal(200);
962+
done();
963+
});
964+
});
965+
});
875966
});

0 commit comments

Comments
 (0)