{"_id":"@alesmenzel/passport-saml","name":"@alesmenzel/passport-saml","dist-tags":{"latest":"4.0.0"},"versions":{"4.0.0":{"name":"@alesmenzel/passport-saml","version":"4.0.0","description":"SAML 2.0 authentication strategy for Passport","keywords":["saml","adfs","sso","shibboleth"],"repository":{"type":"git","url":"git+https://github.com/node-saml/passport-saml.git"},"license":"MIT","author":{"name":"Henri Bergius","email":"henri.bergius@iki.fi","url":"http://bergie.iki.fi"},"contributors":[{"name":"Michael Bosworth"},{"name":"Herbert Vojčík"},{"name":"Peter Loer"},{"name":"Mark Stosberg"},{"name":"Chris Barth"},{"name":"Andrii Kostenko"}],"main":"./lib","scripts":{"build":"tsc","changelog":"gren changelog --override --generate","lint":"eslint --ext .ts \"**/*.ts\" --cache","lint-watch":"onchange -k -p 100 \"**/*.ts\" -- eslint {{file}}","lint:fix":"eslint --ext .ts --fix src","prepare":"tsc","prettier-check":"prettier --config .prettierrc.json --check .","prettier-format":"prettier --config .prettierrc.json --write .","prettier-watch":"onchange -k -p 100 \".\" -- prettier --config .prettierrc.json --write {{file}}","release":"release-it","test":"npm run prettier-check && npm run lint && npm run tsc && nyc mocha","test-watch":"mocha --watch","tsc":"tsc","tsc-watch":"tsc --watch","watch":"concurrently --kill-others \"npm:*-watch\""},"dependencies":{"@node-saml/node-saml":"^4.0.0-beta.3","@types/express":"^4.17.13","@types/passport":"^1.0.9","@types/passport-strategy":"^0.2.35","passport":"^0.6.0","passport-strategy":"^1.0.0"},"devDependencies":{"@cjbarth/github-release-notes":"^1.0.1","@istanbuljs/nyc-config-typescript":"^1.0.2","@types/chai":"^4.3.1","@types/mocha":"^9.1.1","@types/node":"^14.18.22","@types/sinon":"^10.0.13","@typescript-eslint/eslint-plugin":"^5.30.7","@typescript-eslint/parser":"^5.30.7","chai":"^4.3.6","choma":"^1.2.1","concurrently":"^7.2.2","eslint":"^8.20.0","eslint-config-prettier":"^8.5.0","eslint-plugin-prettier":"^4.2.1","mocha":"^10.0.0","nyc":"^15.1.0","onchange":"^7.1.0","prettier":"^2.7.1","prettier-plugin-packagejson":"^2.2.18","release-it":"^14.14.3","sinon":"^14.0.0","ts-node":"^10.9.1","typescript":"^4.7.3"},"engines":{"node":">= 14"},"publishConfig":{"access":"public"},"gitHead":"1fd54376c9fe4bfd9bc1d1180d0436f23a233a31","bugs":{"url":"https://github.com/node-saml/passport-saml/issues"},"homepage":"https://github.com/node-saml/passport-saml#readme","_id":"@alesmenzel/passport-saml@4.0.0","_nodeVersion":"16.15.1","_npmVersion":"8.11.0","dist":{"integrity":"sha512-rkvuyEKTBYGMc3q+uhsmY5ElVHa/s2xraYSDsuL/x1mSb5fyoYh+KjVXXS6ZFGqo3/WbOnl+7/1pH4AfIHlr8A==","shasum":"247a0dd1fb13c5d768a783b90efaecfdba6132b9","tarball":"https://registry.npmjs.org/@alesmenzel/passport-saml/-/passport-saml-4.0.0.tgz","fileCount":15,"unpackedSize":71547,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBkyjfCsKExiir43YNEuPbt3MPqAedj6xoR5Tqovevl/AiB9YvJf6Cqiu7SL7+7geNqj5WqC9U7scxEISjnB3kfxCw=="}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJi86fUACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmqzYw//dmOCOFsdFEM7oajemqs1/2IfFZiCsvV1Ke7ICfkijtGemJJt\r\n77Yt8ZOQqI9lxbdSO6pTfbjO1OPnAjWXAX0ucYxYu3KrgYLWY+gXBxC7Gk73\r\nQSu59iL7jFSJe7oaj1iiTvDS7ktQSQgi6ZVd2TQQGeCHfzug6SOtT6uVlOIW\r\ncKE4syYOw3ohpJdEs+tooCGy5wO3DeUMveqNAwsgpcqb3IXLKD7TEgtzik4q\r\n9xvQokkQQ5jXMMXsfpbUQG8RCjaAq51mz8oZTaWSvJ6opAAqnADe90Lwjsmy\r\nsGLbTlcQ3/jpOqzYbZxWQBkpQQbex0MUXC+8YMQtAlwcFuKXBCjryTisrhck\r\ndao7atm0FhE0MYXVxaDFsv/B1lFph/XElW7B5CAgnDCEc8SdNC08C+SK5IHo\r\net5h87y5q5V/hJFGu+SHxORIt6rwTfgKSUPhe+pAOO1KQFVb52du7B6N//g/\r\npuiTgWz29g+E6RbOAGucEaSn4SlGKLY5Y+oHhtdKDDtE+9NStFNILcsFXEsl\r\ncAAt/E3BovqC5nttJrYL2ImE8CfJdKeC/0qkujAtUqhNfx2NP99xT8ISNHrm\r\n8/YaCG1fo5CZz3z70nZcAmG5sofoQbxFtMH5Q7gPKH9wlVPp/EWpVojhrpdD\r\nwJ6LT6zLddyAXlR0ngWNZn2VJLYMUE2imaE=\r\n=XgcN\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"alesmenzel","email":"alesmenzel@gmail.com"},"directories":{},"maintainers":[{"name":"alesmenzel","email":"alesmenzel@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/passport-saml_4.0.0_1660135380186_0.901530065493285"},"_hasShrinkwrap":false}},"time":{"created":"2022-08-10T12:43:00.116Z","4.0.0":"2022-08-10T12:43:00.461Z","modified":"2022-08-10T12:43:00.611Z"},"maintainers":[{"name":"alesmenzel","email":"alesmenzel@gmail.com"}],"description":"SAML 2.0 authentication strategy for Passport","homepage":"https://github.com/node-saml/passport-saml#readme","keywords":["saml","adfs","sso","shibboleth"],"repository":{"type":"git","url":"git+https://github.com/node-saml/passport-saml.git"},"contributors":[{"name":"Michael Bosworth"},{"name":"Herbert Vojčík"},{"name":"Peter Loer"},{"name":"Mark Stosberg"},{"name":"Chris Barth"},{"name":"Andrii Kostenko"}],"author":{"name":"Henri Bergius","email":"henri.bergius@iki.fi","url":"http://bergie.iki.fi"},"bugs":{"url":"https://github.com/node-saml/passport-saml/issues"},"license":"MIT","readme":"# Passport-SAML\n\n[![Build Status](https://github.com/node-saml/passport-saml/workflows/Build%20Status/badge.svg)](https://github.com/node-saml/passport-saml/actions?query=workflow%3ABuild%Status)\n[![npm version](https://badge.fury.io/js/@node-saml%2Fpassport-saml.svg)](https://badge.fury.io/js/@node-saml%2Fpassport-saml)\n[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)\n[![codecov](https://codecov.io/gh/node-saml/passport-saml/branch/master/graph/badge.svg?token=2JJrPZN29A)](https://codecov.io/gh/node-saml/passport-saml)\n[![DeepScan grade](https://deepscan.io/api/teams/17569/projects/20921/branches/586237/badge/grade.svg)](https://deepscan.io/dashboard#view=project&tid=17569&pid=20921&bid=586237)\n\n[![NPM](https://nodei.co/npm/@node-saml/passport-saml.png?downloads=true&downloadRank=true&stars=true)](https://nodei.co/npm/@node-saml/passport-saml)\n\nThis is a [SAML 2.0](http://en.wikipedia.org/wiki/SAML_2.0) authentication provider for [Passport](http://passportjs.org/), the Node.js authentication library.\n\nPassport-SAML has been tested to work with Onelogin, Okta, Shibboleth, [SimpleSAMLphp](http://simplesamlphp.org/) based Identity Providers, and with [Active Directory Federation Services](http://en.wikipedia.org/wiki/Active_Directory_Federation_Services).\n\n## Installation\n\n```shell\nnpm install passport-saml\n```\n\n## Usage\n\nThe examples utilize the [Feide OpenIdp identity provider](https://openidp.feide.no/). You need an account there to log in with this. You also need to [register your site](https://openidp.feide.no/simplesaml/module.php/metaedit/index.php) as a service provider.\n\n### Configure strategy\n\nThe SAML identity provider will redirect you to the URL provided by the `path` configuration.\n\n```javascript\nconst SamlStrategy = require('passport-saml').Strategy;\n[...]\n\npassport.use(\n  new SamlStrategy(\n    {\n      path: \"/login/callback\",\n      entryPoint:\n        \"https://openidp.feide.no/simplesaml/saml2/idp/SSOService.php\",\n      issuer: \"passport-saml\",\n      cert: \"fake cert\", // cert must be provided\n    },\n    function (profile, done) {\n      // for signon\n      findByEmail(profile.email, function (err, user) {\n        if (err) {\n          return done(err);\n        }\n        return done(null, user);\n      });\n    },\n    function (profile, done) {\n      // for logout\n      findByNameID(profile.nameID, function (err, user) {\n        if (err) {\n          return done(err);\n        }\n        return done(null, user);\n      });\n    }\n  )\n);\n```\n\n### Configure strategy for multiple providers\n\nYou can pass a `getSamlOptions` parameter to `MultiSamlStrategy` which will be called before the SAML flows. Passport-SAML will pass in the request object so you can decide which configuation is appropriate.\n\n```javascript\nconst { MultiSamlStrategy } = require('passport-saml');\n[...]\n\npassport.use(\n  new MultiSamlStrategy(\n    {\n      passReqToCallback: true, // makes req available in callback\n      getSamlOptions: function (request, done) {\n        findProvider(request, function (err, provider) {\n          if (err) {\n            return done(err);\n          }\n          return done(null, provider.configuration);\n        });\n      },\n    },\n    function (req, profile, done) {\n      // for signon\n      findByEmail(profile.email, function (err, user) {\n        if (err) {\n          return done(err);\n        }\n        return done(null, user);\n      });\n    },\n    function (req, profile, done) {\n      // for logout\n      findByNameID(profile.nameID, function (err, user) {\n        if (err) {\n          return done(err);\n        }\n        return done(null, user);\n      });\n    }\n  )\n);\n```\n\nThe options passed when the `MultiSamlStrategy` is initialized are also passed as default values to each provider.\ne.g. If you provide an `issuer` on `MultiSamlStrategy`, this will be also a default value for every provider.\nYou can override these defaults by passing a new value through the `getSamlOptions` function.\n\nUsing multiple providers supports `validateInResponseTo`, but all the `InResponse` values are stored on the same Cache. This means, if you're using the default `InMemoryCache`, that all providers have access to it and a provider might get its response validated against another's request. [Issue Report](!https://github.com/node-saml/passport-saml/issues/334). To amend this you should provide a different cache provider per SAML provider, through the `getSamlOptions` function.\n\n> :warning: **There's a race condition [bug](https://github.com/node-saml/passport-saml/issues/425) in versions < 1.3.3 which makes it vulnerable to DOS attacks**: Please use > 1.3.3 if you want to use this issue\n\n#### The profile object:\n\nThe profile object referenced above contains the following:\n\n```typescript\nexport interface Profile {\n  issuer: string;\n  sessionIndex?: string;\n  nameID: string;\n  nameIDFormat: string;\n  nameQualifier?: string;\n  spNameQualifier?: string;\n  ID?: string;\n  mail?: string; // InCommon Attribute urn:oid:0.9.2342.19200300.100.1.3\n  email?: string; // `mail` if not present in the assertion\n  [\"urn:oid:0.9.2342.19200300.100.1.3\"]?: string;\n  getAssertionXml?(): string; // get the raw assertion XML\n  getAssertion?(): Record<string, unknown>; // get the assertion XML parsed as a JavaScript object\n  getSamlResponseXml?(): string; // get the raw SAML response XML\n  [attributeName: string]: unknown; // arbitrary `AttributeValue`s\n}\n```\n\n#### Config parameter details:\n\n**Core**\n\n- `callbackUrl`: full callbackUrl (overrides path/protocol if supplied)\n- `path`: path to callback; will be combined with protocol and server host information to construct callback url if `callbackUrl` is not specified (default: `/saml/consume`)\n- `protocol`: protocol for callback; will be combined with path and server host information to construct callback url if `callbackUrl` is not specified (default: `http://`)\n- `host`: host for callback; will be combined with path and protocol to construct callback url if `callbackUrl` is not specified (default: `localhost`)\n- `entryPoint`: identity provider entrypoint (is required to be spec-compliant when the request is signed)\n- `issuer`: issuer string to supply to identity provider\n- `audience`: expected saml response Audience (if not provided, Audience won't be verified)\n- `cert`: the IDP's public signing certificate used to validate the signatures of the incoming SAML Responses, see [Security and signatures](#security-and-signatures)\n- `privateKey`: see [Security and signatures](#security-and-signatures).\n- `decryptionPvk`: optional private key that will be used to attempt to decrypt any encrypted assertions that are received\n- `signatureAlgorithm`: optionally set the signature algorithm for signing requests, valid values are 'sha1' (default), 'sha256', or 'sha512'\n- `digestAlgorithm`: optionally set the digest algorithm used to provide a digest for the signed data object, valid values are 'sha1' (default), 'sha256', or 'sha512'\n- `xmlSignatureTransforms`: optionally set an array of signature transforms to be used in HTTP-POST signatures. By default this is `[ 'http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#' ]`\n\n**Additional SAML behaviors**\n\n- `additionalParams`: dictionary of additional query params to add to all requests; if an object with this key is passed to `authenticate`, the dictionary of additional query params will be appended to those present on the returned URL, overriding any specified by initialization options' additional parameters (`additionalParams`, `additionalAuthorizeParams`, and `additionalLogoutParams`)\n- `additionalAuthorizeParams`: dictionary of additional query params to add to 'authorize' requests\n- `identifierFormat`: optional name identifier format to request from identity provider (default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`)\n- `wantAssertionsSigned`: if truthy, add `WantAssertionsSigned=\"true\"` to the metadata, to specify that the IdP should always sign the assertions.\n- `acceptedClockSkewMs`: Time in milliseconds of skew that is acceptable between client and server when checking `NotBefore` and `NotOnOrAfter` assertion condition validity timestamps. Setting to `-1` will disable checking these conditions entirely. Default is `0`.\n- `maxAssertionAgeMs`: Amount of time after which the framework should consider an assertion expired. If the limit imposed by this variable is stricter than the limit imposed by `NotOnOrAfter`, this limit will be used when determining if an assertion is expired.\n- `attributeConsumingServiceIndex`: optional `AttributeConsumingServiceIndex` attribute to add to AuthnRequest to instruct the IDP which attribute set to attach to the response ([link](http://blog.aniljohn.com/2014/01/data-minimization-front-channel-saml-attribute-requests.html))\n- `disableRequestedAuthnContext`: if truthy, do not request a specific authentication context. This is [known to help when authenticating against Active Directory](https://github.com/node-saml/passport-saml/issues/226) (AD FS) servers.\n- `authnContext`: if truthy, name identifier format to request auth context (default: `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`); array of values is also supported\n- `racComparison`: Requested Authentication Context comparison type. Possible values are 'exact','minimum','maximum','better'. Default is 'exact'.\n\n- `forceAuthn`: if set to true, the initial SAML request from the service provider specifies that the IdP should force re-authentication of the user, even if they possess a valid session.\n- `passive`: if set to true, the initial SAML request from the service provider specifies that the IdP should prevent visible user interaction. This is useful for validating a user session without prompting for a login when there is no active session. The IdP recognizes the parameter and returns to the SP.\n  - An error if the IdP must interact with the user but cannot because of this parameter.\n  - A Federation Assertion that indicates whether the user has a valid session.\n- `providerName`: optional human-readable name of the requester for use by the presenter's user agent or the identity provider\n- `skipRequestCompression`: if set to true, the SAML request from the service provider won't be compressed.\n- `authnRequestBinding`: if set to `HTTP-POST`, will request authentication from IDP via HTTP POST binding, otherwise defaults to HTTP Redirect\n- `disableRequestAcsUrl`: if truthy, SAML AuthnRequest from the service provider will not include the optional AssertionConsumerServiceURL. Default is falsy so it is automatically included.\n- `scoping`: An optional configuration which implements the functionality [explained in the SAML spec paragraph \"3.4.1.2 Element <Scoping>\"](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf). The config object is structured as following:\n\n```javascript\n{\n  idpList: [ // optional\n    {\n      entries: [ // required\n        {\n          providerId: \"yourProviderId\", // required for each entry\n          name: \"yourName\", // optional\n          loc: \"yourLoc\", // optional\n        },\n      ],\n      getComplete: \"URI to your complete IDP list\", // optional\n    },\n  ],\n  proxyCount: 2, // optional\n  requesterId: \"requesterId\", // optional\n};\n```\n\n**InResponseTo Validation**\n\n- `validateInResponseTo`: if truthy, then InResponseTo will be validated from incoming SAML responses\n- `requestIdExpirationPeriodMs`: Defines the expiration time when a Request ID generated for a SAML request will not be valid if seen in a SAML response in the `InResponseTo` field. Default is 8 hours.\n- `cacheProvider`: Defines the implementation for a cache provider used to store request Ids generated in SAML requests as part of `InResponseTo` validation. Default is a built-in in-memory cache provider. For details see the 'Cache Provider' section.\n\n**Issuer Validation**\n\n- `idpIssuer`: if provided, then the IdP issuer will be validated for incoming Logout Requests/Responses. For ADFS this looks like `https://acme_tools.windows.net/deadbeef`\n\n**Passport**\n\n- `passReqToCallback`: if truthy, `req` will be passed as the first argument to the verify callback (default: `false`)\n- `name`: Optionally, provide a custom name. (default: `saml`). Useful If you want to instantiate the strategy multiple times with different configurations,\n  allowing users to authenticate against multiple different SAML targets from the same site. You'll need to use a unique set of URLs\n  for each target, and use this custom name when calling `passport.authenticate()` as well.\n\n**Logout**\n\n- `logoutUrl`: base address to call with logout requests (default: `entryPoint`)\n- `additionalLogoutParams`: dictionary of additional query params to add to 'logout' requests\n- `logoutCallbackUrl`: The value with which to populate the `Location` attribute in the `SingleLogoutService` elements in the generated service provider metadata.\n\n### Provide the authentication callback\n\nYou need to provide a route corresponding to the `path` configuration parameter given to the strategy:\n\nThe authentication callback must be invoked after the `body-parser` middlerware.\n\n```javascript\nconst bodyParser = require(\"body-parser\");\n\napp.post(\n  \"/login/callback\",\n  bodyParser.urlencoded({ extended: false }),\n  passport.authenticate(\"saml\", {\n    failureRedirect: \"/\",\n    failureFlash: true,\n  }),\n  function (req, res) {\n    res.redirect(\"/\");\n  }\n);\n```\n\n### Authenticate requests\n\nUse `passport.authenticate()`, specifying `saml` as the strategy:\n\n```javascript\napp.get(\n  \"/login\",\n  passport.authenticate(\"saml\", { failureRedirect: \"/\", failureFlash: true }),\n  function (req, res) {\n    res.redirect(\"/\");\n  }\n);\n```\n\n...or, if you wish to add or override query string parameters:\n\n```javascript\napp.get(\n  \"/login\",\n  passport.authenticate(\"saml\", {\n    additionalParams: { username: \"user@domain.com\" },\n  }),\n  function (req, res) {\n    res.redirect(\"/\");\n  }\n);\n```\n\n### generateServiceProviderMetadata( decryptionCert, signingCert )\n\nAs a convenience, the strategy object exposes a `generateServiceProviderMetadata` method which will generate a service provider metadata document suitable for supplying to an identity provider. This method will only work on strategies which are configured with a `callbackUrl` (since the relative path for the callback is not sufficient information to generate a complete metadata document).\n\nThe `decryptionCert` argument should be a public certificate matching the `decryptionPvk` and is required if the strategy is configured with a `decryptionPvk`.\n\nThe `signingCert` argument should be a public certificate matching the `privateKey` and is required if the strategy is configured with a `privateKey`. An array of certificates can be provided to support certificate rotation. When supplying an array of certificates, the first entry in the array should match the current `privateKey`. Additional entries in the array can be used to publish upcoming certificates to IdPs before changing the `privateKey`.\n\nThe `generateServiceProviderMetadata` method is also available on the `MultiSamlStrategy`, but needs an extra request and a callback argument (`generateServiceProviderMetadata( req, decryptionCert, signingCert, next )`), which are passed to the `getSamlOptions` to retrieve the correct configuration.\n\n## Security and signatures\n\nPassport-SAML uses the HTTP Redirect Binding for its `AuthnRequest`s (unless overridden with the `authnRequestBinding` parameter), and expects to receive the messages back via the HTTP POST binding.\n\nAuthentication requests sent by Passport-SAML can be signed using RSA signature with SHA1, SHA256 or SHA512 hashing algorithms.\n\nTo select hashing algorithm, use:\n\n```javascript\n...\n  signatureAlgorithm: \"sha1\" // (default, but not recommended anymore these days)\n  signatureAlgorithm: \"sha256\" // (preferred - your IDP should support it, otherwise think about upgrading it)\n  signatureAlgorithm: \"sha512\" // (most secure - check if your IDP supports it)\n...\n```\n\nTo sign them you need to provide a private key in the PEM format via the `privateKey` configuration key.\n\nFormats supported for `privateKey` field are,\n\n1. Well formatted PEM:\n\n```text\n-----BEGIN PRIVATE KEY-----\n<private key contents here delimited at 64 characters per row>\n-----END PRIVATE KEY-----\n\n```\n\n```text\n-----BEGIN RSA PRIVATE KEY-----\n<private key contents here delimited at 64 characters per row>\n-----END RSA PRIVATE KEY-----\n\n```\n\n(both versions work)\nSee example from tests of the first version of [well formatted private key](test/static/acme_tools_com.key).\n\n2. Alternativelly a single line private key without start/end lines where all rows are joined into single line:\n\nSee example from tests of [singleline private key](test/static/singleline_acme_tools_com.key).\n\nAdd it to strategy options like this:\n\n```javascript\nprivateKey: fs.readFileSync(\"./privateKey.pem\", \"utf-8\");\n```\n\nIt is a good idea to validate the signatures of the incoming SAML Responses. For this, you can provide the Identity Provider's public PEM-encoded X.509 signing certificate using the `cert` configuration key. The \"BEGIN CERTIFICATE\" and \"END CERTIFICATE\" lines should be stripped out and the certificate should be provided on a single line.\n\n```javascript\ncert: \"MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==\";\n```\n\nIf you have a certificate in the binary DER encoding, you can convert it to the necessary PEM encoding like this:\n\n```shell\nopenssl x509 -inform der -in my_certificate.cer -out my_certificate.pem\n```\n\nIf the Identity Provider has multiple signing certificates that are valid (such as during the rolling from an old key to a new key and responses signed with either key are valid) then the `cert` configuration key can be an array:\n\n```javascript\ncert: [\"MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==\", \"MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6M ... g=\"];\n```\n\nThe `cert` configuration key can also be a function that receives a callback as argument calls back a possible error and a certificate or array of certificates. This allows the Identity Provider to be polled for valid certificates and the new certificate can be used if it is changed:\n\n```javascript\ncert: function(callback) { callback(null,polledCertificates); }\n```\n\n## Usage with Active Directory Federation Services\n\nHere is a configuration that has been proven to work with ADFS:\n\n```javascript\n  {\n    entryPoint: 'https://ad.example.net/adfs/ls/',\n    issuer: 'https://your-app.example.net/login/callback',\n    callbackUrl: 'https://your-app.example.net/login/callback',\n    cert: 'MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==',\n    authnContext: ['http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows'],\n    identifierFormat: null\n  }\n```\n\nPlease note that ADFS needs to have a trust established to your service in order for this to work.\n\nFor more detailed instructions, see [ADFS documentation](docs/adfs/README.md).\n\n## SAML Response Validation - NotBefore and NotOnOrAfter\n\nIf the `NotBefore` or the `NotOnOrAfter` attributes are returned in the SAML response, Passport-SAML will validate them\nagainst the current time +/- a configurable clock skew value. The default for the skew is 0s. This is to account for\ndifferences between the clock time on the client (Node server with Passport-SAML) and the server (Identity provider).\n\n`NotBefore` and `NotOnOrAfter` can be part of either the `SubjectConfirmation` element, or within in the `Assertion/Conditions` element\nin the SAML response.\n\n## Subject confirmation validation\n\nWhen configured (turn `validateInResponseTo` to `true` in the Passport-SAML config), the `InResponseTo` attribute will be validated.\nValidation will succeed if Passport-SAML previously generated a SAML request with an id that matches the value of `InResponseTo`.\n\nAlso note that `InResponseTo` is validated as an attribute of the top level `Response` element in the SAML response, as well\nas part of the `SubjectConfirmation` element.\n\nPrevious request id's generated for SAML requests will eventually expire. This is controlled with the `requestIdExpirationPeriodMs` option\npassed into the Passport-SAML config. The default is 28,800,000 ms (8 hours). Once expired, a subsequent SAML response\nreceived with an `InResponseTo` equal to the expired id will not validate and an error will be returned.\n\n## Cache Provider\n\nWhen `InResponseTo` validation is turned on, Passport-SAML will store generated request ids used in SAML requests to the IdP. The implementation\nof how things are stored, checked to see if they exist, and eventually removed is from the Cache Provider used by Passport-SAML.\n\nThe default implementation is a simple in-memory cache provider. For multiple server/process scenarios, this will not be sufficient as\nthe server/process that generated the request id and stored in memory could be different than the server/process handling the\nSAML response. The `InResponseTo` could fail in this case erroneously.\n\nTo support this scenario you can provide an implementation for a cache provider by providing an object with following functions:\n\n```javascript\n{\n  saveAsync: async function (key, value) {\n    // saves the key with the optional value, returns the saved value\n  },\n  getAsync: async function (key) {\n    // returns the value if found, null otherwise\n  },\n  removeAsync: async function (key) {\n    // removes the key from the cache, returns the\n    // key removed, null if no key is removed\n  },\n};\n```\n\nProvide an instance of an object which has these functions passed to the `cacheProvider` config option when using Passport-SAML.\n\n## SLO (single logout)\n\nPassport-SAML has built in support for SLO including\n\n- Signature validation\n- IdP initiated and SP initiated logouts\n- Decryption of encrypted name identifiers in IdP initiated logout\n- `Redirect` and `POST` SAML Protocol Bindings\n\n## ChangeLog\n\nSee [Releases](https://github.com/node-saml/passport-saml/releases) to find the changes that go into each release.\n\n## FAQ\n\n### Is there an example I can look at?\n\nGerard Braad has provided an example app at https://github.com/gbraad/passport-saml-example/\n\n## Node Support Policy\n\nWe only support [Long-Term Support](https://github.com/nodejs/Release) versions of Node.\n\nWe specifically limit our support to LTS versions of Node, not because this package won't work on other versions, but because we have a limited amount of time, and supporting LTS offers the greatest return on that investment.\n\nIt's possible this package will work correctly on newer versions of Node. It may even be possible to use this package on older versions of Node, though that's more unlikely as we'll make every effort to take advantage of features available in the oldest LTS version we support.\n\nAs each Node LTS version reaches its end-of-life we will remove that version from the `node` `engines` property of our package's `package.json` file. Removing a Node version is considered a breaking change and will entail the publishing of a new major version of this package. We will not accept any requests to support an end-of-life version of Node. Any merge requests or issues supporting an end-of-life version of Node will be closed.\n\nWe will accept code that allows this package to run on newer, non-LTS, versions of Node.\n\n## Project History\n\nThe project was started by @bergie in 2012 based on Michael Bosworth's [express-saml](https://github.com/bozzltron/express-saml) library. From 2014 - 2016, @ploer served as primary maintainer.\n@markstos served the primary maintainer from 2017 till 2020 when he created the node-saml organization. With a goal to create a team of maintainers, invitations were sent to major contributors and fork authors to work together to maintain all the improvements in one place.\n\nSince 2020, @cjbath emerged as the primary maintainer, with major contributions from @gugu and @zoellner. Major updates from the team included rewriting the project in TypeScript and splitting off a `node-saml` module which can be used without Passport. Almost 100 other developers have contributed improvements to the project.\n\nThe project continues to be maintained by volunteers. Contributions small and large are welcome.\n","readmeFilename":"README.md"}