Passport

还是一个菜鸟！

我正在构建一个Node应用程序，我已经设置了各种必需的端点。我的项目的一个要求是使用SAML机制进行身份验证。我在我的应用程序中使用passport-SAML进行身份验证。

到目前为止，我已经能够设置和使用SAML策略，我的应用程序能够调用idp入口点，并从Idp接收响应。

我无法理解我们如何访问idp返回的用户信息，以便我可以使用SAML返回的用户信息来创建和维护会话。

const saml = require('passport-saml');

module.exports = function (passport, config) {

  passport.serializeUser(function (user, done) {
    done(null, user);
  });

  passport.deserializeUser(function (user, done) {
    done(null, user);
  });

  var samlStrategyOptions = new saml.Strategy(
    {
      // URL that goes from the Identity Provider -> Service Provider
      callbackUrl: config.passport.saml.callback_url,
      // path: config.passport.saml.path,
      // URL that goes from the Service Provider -> Identity Provider
      entryPoint: config.passport.saml.entryPoint,
      issuer: config.passport.saml.issuer,
      identifierFormat: null,
      // Service Provider private key
      decryptionPvk: config.passport.saml.decryptionPvk,
      // Service Provider Certificate
      privateCert: config.passport.saml.privateCert,
      // Identity Provider's public key
      cert: config.passport.saml.cert,
      validateInResponseTo: false,
      disableRequestedAuthnContext: true
    },
    function (profile, done) {
      return done(null,
        {
          id: profile.uid,
          email: profile.email,
          displayName: profile,
          firstName: profile.givenName,
          lastName: profile.sn
        });
    })


  // module.exports.samlStrategyOptions = samlStrategyOptions  ;
  passport.use(samlStrategyOptions);

};

以下是我的快递路线控制器

router.route('/login')

.get(
    passport.authenticate(config.passport.strategy,
      {
        successRedirect: '/',
        failureRedirect: '/login'
      })
);

router.route('/login/callback/')

.post(
    passport.authenticate(config.passport.strategy,
      {
        failureRedirect: '/',
        failureFlash: true
      }),
    function (req, res) {

      res.redirect('/');
    }
);

这是我在Idp回复时收到的SAML片段。

<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">Shubham123</saml:NameID>

我也是这样。所以我使用了body-parser作为中间件

 // middleware to parse HTTP POST's JSON, buffer, string,zipped or raw and URL encoded data and exposes it on req.body
app.use(bodyParser.json());
// use querystring library to parse x-www-form-urlencoded data for flat data structure (not nested data)
app.use(bodyParser.urlencoded({ extended: false }));

然后你会得到像这样的个人资料

{ issuer: '',
   sessionIndex: '_x0P5ZeWx-ACSQAulKgVTxSquNsVdac_H',
   nameID: 'auth0|5a266569083226773d5d43a9',
   nameIDFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
   nameQualifier: undefined,
   spNameQualifier: undefined,
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/nameidentifier': 'auth0|s9ds',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/emailaddress': '[email protected]',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/name': '[email protected]',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/upn': '[email protected]',
   'http://schemas.auth0/identities/default/provider': 'auth0',
   'http://schemas.auth0/identities/default/connection': 'Username-Password-Authentication',
   'http://schemas.auth0/identities/default/isSocial': 'false',
   'http://schemas.auth0/email_verified': 'false',
   'http://schemas.auth0/clientID': 'bZVOM5KQmhyir5xEYhLHGRAQglks2AIp',
   'http://schemas.auth0/picture': 'https://s.gravatar/avatar/e85e57405a82225ff36b5af793ed287c?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0%2Favatars%2Fsu.png',
   'http://schemas.auth0/nickname': 'myuser',
   'http://schemas.auth0/identities': '[object Object]',
   'http://schemas.auth0/updated_at': 'Mon Dec 18 2017 12:14:28 GMT+0000 (UTC)',
   'http://schemas.auth0/created_at': 'Tue Dec 05 2017 09:22:49 GMT+0000 (UTC)',
   getAssertionXml: [Function] }

并通过提取数据来创建用户

{ id: profile["nameID"], userName: profile["http://schemas.auth0/nickname"] }

Passport

还是一个菜鸟！

我正在构建一个Node应用程序，我已经设置了各种必需的端点。我的项目的一个要求是使用SAML机制进行身份验证。我在我的应用程序中使用passport-SAML进行身份验证。

到目前为止，我已经能够设置和使用SAML策略，我的应用程序能够调用idp入口点，并从Idp接收响应。

我无法理解我们如何访问idp返回的用户信息，以便我可以使用SAML返回的用户信息来创建和维护会话。

const saml = require('passport-saml');

module.exports = function (passport, config) {

  passport.serializeUser(function (user, done) {
    done(null, user);
  });

  passport.deserializeUser(function (user, done) {
    done(null, user);
  });

  var samlStrategyOptions = new saml.Strategy(
    {
      // URL that goes from the Identity Provider -> Service Provider
      callbackUrl: config.passport.saml.callback_url,
      // path: config.passport.saml.path,
      // URL that goes from the Service Provider -> Identity Provider
      entryPoint: config.passport.saml.entryPoint,
      issuer: config.passport.saml.issuer,
      identifierFormat: null,
      // Service Provider private key
      decryptionPvk: config.passport.saml.decryptionPvk,
      // Service Provider Certificate
      privateCert: config.passport.saml.privateCert,
      // Identity Provider's public key
      cert: config.passport.saml.cert,
      validateInResponseTo: false,
      disableRequestedAuthnContext: true
    },
    function (profile, done) {
      return done(null,
        {
          id: profile.uid,
          email: profile.email,
          displayName: profile,
          firstName: profile.givenName,
          lastName: profile.sn
        });
    })


  // module.exports.samlStrategyOptions = samlStrategyOptions  ;
  passport.use(samlStrategyOptions);

};

以下是我的快递路线控制器

router.route('/login')

.get(
    passport.authenticate(config.passport.strategy,
      {
        successRedirect: '/',
        failureRedirect: '/login'
      })
);

router.route('/login/callback/')

.post(
    passport.authenticate(config.passport.strategy,
      {
        failureRedirect: '/',
        failureFlash: true
      }),
    function (req, res) {

      res.redirect('/');
    }
);

这是我在Idp回复时收到的SAML片段。

<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">Shubham123</saml:NameID>

我也是这样。所以我使用了body-parser作为中间件

 // middleware to parse HTTP POST's JSON, buffer, string,zipped or raw and URL encoded data and exposes it on req.body
app.use(bodyParser.json());
// use querystring library to parse x-www-form-urlencoded data for flat data structure (not nested data)
app.use(bodyParser.urlencoded({ extended: false }));

然后你会得到像这样的个人资料

{ issuer: '',
   sessionIndex: '_x0P5ZeWx-ACSQAulKgVTxSquNsVdac_H',
   nameID: 'auth0|5a266569083226773d5d43a9',
   nameIDFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
   nameQualifier: undefined,
   spNameQualifier: undefined,
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/nameidentifier': 'auth0|s9ds',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/emailaddress': '[email protected]',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/name': '[email protected]',
   'http://schemas.xmlsoap/ws/2005/05/identity/claims/upn': '[email protected]',
   'http://schemas.auth0/identities/default/provider': 'auth0',
   'http://schemas.auth0/identities/default/connection': 'Username-Password-Authentication',
   'http://schemas.auth0/identities/default/isSocial': 'false',
   'http://schemas.auth0/email_verified': 'false',
   'http://schemas.auth0/clientID': 'bZVOM5KQmhyir5xEYhLHGRAQglks2AIp',
   'http://schemas.auth0/picture': 'https://s.gravatar/avatar/e85e57405a82225ff36b5af793ed287c?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0%2Favatars%2Fsu.png',
   'http://schemas.auth0/nickname': 'myuser',
   'http://schemas.auth0/identities': '[object Object]',
   'http://schemas.auth0/updated_at': 'Mon Dec 18 2017 12:14:28 GMT+0000 (UTC)',
   'http://schemas.auth0/created_at': 'Tue Dec 05 2017 09:22:49 GMT+0000 (UTC)',
   getAssertionXml: [Function] }

并通过提取数据来创建用户

{ id: profile["nameID"], userName: profile["http://schemas.auth0/nickname"] }