From ca66ec8f4d5ab0e427390b1f1874fb668bc53479 Mon Sep 17 00:00:00 2001 From: Michael Auerswald Date: Mon, 6 Mar 2023 09:44:25 +0100 Subject: [PATCH] feat(core): Add SAML XML validation (#5600) * consolidate SSO settings * update saml settings * fix type error * limit user changes when saml is enabled * add test * add toggle endpoint and fetch metadata * rename enabled param * add handling of POST saml login request * add config test endpoint * adds saml XML validation * add comment * protect test endpoint * improve ignoreSSL and some cleanup * fix wrong schema used * remove console.log --- packages/cli/package.json | 3 +- packages/cli/src/Server.ts | 12 +- .../routes/saml.controller.protected.ee.ts | 15 +- packages/cli/src/sso/saml/saml.service.ee.ts | 71 ++-- packages/cli/src/sso/saml/samlValidator.ts | 93 +++++ .../schema/saml-schema-assertion-2.0.xsd.ts | 283 +++++++++++++++ .../schema/saml-schema-metadata-2.0.xsd.ts | 336 ++++++++++++++++++ .../schema/saml-schema-protocol-2.0.xsd.ts | 302 ++++++++++++++++ .../src/sso/saml/schema/xenc-schema.xsd.ts | 145 ++++++++ packages/cli/src/sso/saml/schema/xml.xsd.ts | 117 ++++++ .../saml/schema/xmldsig-core-schema.xsd.ts | 318 +++++++++++++++++ .../cli/src/sso/saml/serviceProvider.ee.ts | 10 +- .../cli/src/sso/saml/types/samlPreferences.ts | 4 + packages/cli/src/sso/ssoHelpers.ts | 5 +- packages/cli/tsconfig.json | 2 +- pnpm-lock.yaml | 7 + 16 files changed, 1672 insertions(+), 51 deletions(-) create mode 100644 packages/cli/src/sso/saml/samlValidator.ts create mode 100644 packages/cli/src/sso/saml/schema/saml-schema-assertion-2.0.xsd.ts create mode 100644 packages/cli/src/sso/saml/schema/saml-schema-metadata-2.0.xsd.ts create mode 100644 packages/cli/src/sso/saml/schema/saml-schema-protocol-2.0.xsd.ts create mode 100644 packages/cli/src/sso/saml/schema/xenc-schema.xsd.ts create mode 100644 packages/cli/src/sso/saml/schema/xml.xsd.ts create mode 100644 packages/cli/src/sso/saml/schema/xmldsig-core-schema.xsd.ts diff --git a/packages/cli/package.json b/packages/cli/package.json index 8955bf528..3cb13ea7b 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -129,8 +129,8 @@ "bull": "^4.10.2", "callsites": "^3.1.0", "change-case": "^4.1.1", - "class-validator": "^0.14.0", "class-transformer": "^0.5.1", + "class-validator": "^0.14.0", "client-oauth2": "^4.2.5", "compression": "^1.7.4", "connect-history-api-fallback": "^1.6.0", @@ -205,6 +205,7 @@ "validator": "13.7.0", "winston": "^3.3.3", "ws": "^8.12.0", + "xmllint-wasm": "^3.0.1", "yamljs": "^0.3.0" } } diff --git a/packages/cli/src/Server.ts b/packages/cli/src/Server.ts index af3a5b5e5..4c73c7c35 100644 --- a/packages/cli/src/Server.ts +++ b/packages/cli/src/Server.ts @@ -515,10 +515,16 @@ class Server extends AbstractServer { // SAML // ---------------------------------------- - // initialize SamlService - await SamlService.getInstance().init(); + // initialize SamlService if it is licensed, even if not enabled, to + // set up the initial environment + if (isSamlLicensed()) { + try { + await SamlService.getInstance().init(); + } catch (error) { + LoggerProxy.error(`SAML initialization failed: ${error.message}`); + } + } - // public SAML endpoints this.app.use(`/${this.restEndpoint}/sso/saml`, samlControllerPublic); this.app.use(`/${this.restEndpoint}/sso/saml`, samlControllerProtected); diff --git a/packages/cli/src/sso/saml/routes/saml.controller.protected.ee.ts b/packages/cli/src/sso/saml/routes/saml.controller.protected.ee.ts index 9a98e6926..47e625817 100644 --- a/packages/cli/src/sso/saml/routes/saml.controller.protected.ee.ts +++ b/packages/cli/src/sso/saml/routes/saml.controller.protected.ee.ts @@ -57,12 +57,11 @@ samlControllerProtected.post( SamlUrls.configToggleEnabled, samlLicensedOwnerMiddleware, async (req: SamlConfiguration.Toggle, res: express.Response) => { - if (req.body.loginEnabled !== undefined) { - await SamlService.getInstance().setSamlPreferences({ loginEnabled: req.body.loginEnabled }); - res.sendStatus(200); - } else { + if (req.body.loginEnabled === undefined) { throw new BadRequestError('Body should contain a boolean "loginEnabled" property'); } + await SamlService.getInstance().setSamlPreferences({ loginEnabled: req.body.loginEnabled }); + res.sendStatus(200); }, ); @@ -122,8 +121,9 @@ samlControllerProtected.get( async (req: express.Request, res: express.Response) => { const result = SamlService.getInstance().getLoginRequestUrl(); if (result?.binding === 'redirect') { - // forced client side redirect + // forced client side redirect through the use of a javascript redirect return res.send(getInitSSOPostView(result.context)); + // TODO:SAML: If we want the frontend to handle the redirect, we will send the redirect URL instead: // return res.status(301).send(result.context.context); } else if (result?.binding === 'post') { return res.send(getInitSSOFormView(result.context as PostBindingContext)); @@ -133,8 +133,13 @@ samlControllerProtected.get( }, ); +/** + * GET /sso/saml/config/test + * Test SAML config + */ samlControllerProtected.get( SamlUrls.configTest, + samlLicensedOwnerMiddleware, async (req: express.Request, res: express.Response) => { const testResult = await SamlService.getInstance().testSamlConnection(); return res.send(testResult); diff --git a/packages/cli/src/sso/saml/saml.service.ee.ts b/packages/cli/src/sso/saml/saml.service.ee.ts index d4fd3b40b..b204c1686 100644 --- a/packages/cli/src/sso/saml/saml.service.ee.ts +++ b/packages/cli/src/sso/saml/saml.service.ee.ts @@ -10,7 +10,7 @@ import { isSsoJustInTimeProvisioningEnabled } from '../ssoHelpers'; import type { SamlPreferences } from './types/samlPreferences'; import { SAML_PREFERENCES_DB_KEY } from './constants'; import type { IdentityProviderInstance } from 'samlify'; -import { IdentityProvider } from 'samlify'; +import { IdentityProvider, setSchemaValidator } from 'samlify'; import { createUserFromSamlAttributes, getMappedSamlAttributesFromFlowResult, @@ -22,8 +22,10 @@ import { } from './samlHelpers'; import type { Settings } from '../../databases/entities/Settings'; import axios from 'axios'; +import https from 'https'; import type { SamlLoginBinding } from './types'; import type { BindingContext, PostBindingContext } from 'samlify/types/src/entity'; +import { validateMetadata, validateResponse } from './samlValidator'; export class SamlService { private static instance: SamlService; @@ -46,30 +48,14 @@ export class SamlService { this._attributeMapping = mapping; } - private _metadata = ''; + private metadata = ''; private metadataUrl = ''; + private ignoreSSL = false; + private loginBinding: SamlLoginBinding = 'post'; - public get metadata(): string { - return this._metadata; - } - - public set metadata(metadata: string) { - this._metadata = metadata; - } - - constructor() { - this.loadFromDbAndApplySamlPreferences() - .then(() => { - LoggerProxy.debug('Initializing SAML service'); - }) - .catch(() => { - LoggerProxy.error('Error initializing SAML service'); - }); - } - static getInstance(): SamlService { if (!SamlService.instance) { SamlService.instance = new SamlService(); @@ -79,6 +65,15 @@ export class SamlService { async init(): Promise { await this.loadFromDbAndApplySamlPreferences(); + setSchemaValidator({ + validate: async (response: string) => { + const valid = await validateResponse(response); + if (!valid) { + return Promise.reject(new Error('Invalid SAML response')); + } + return Promise.resolve(); + }, + }); } getIdentityProviderInstance(forceRecreate = false): IdentityProviderInstance { @@ -125,7 +120,6 @@ export class SamlService { 'post', ) as PostBindingContext; //TODO:SAML: debug logging - LoggerProxy.debug(loginRequest.context); return loginRequest; } @@ -188,6 +182,7 @@ export class SamlService { mapping: this.attributeMapping, metadata: this.metadata, metadataUrl: this.metadataUrl, + ignoreSSL: this.ignoreSSL, loginBinding: this.loginBinding, loginEnabled: isSamlLoginEnabled(), loginLabel: getSamlLoginLabel(), @@ -198,12 +193,19 @@ export class SamlService { this.loginBinding = prefs.loginBinding ?? this.loginBinding; this.metadata = prefs.metadata ?? this.metadata; this.attributeMapping = prefs.mapping ?? this.attributeMapping; + this.ignoreSSL = prefs.ignoreSSL ?? this.ignoreSSL; if (prefs.metadataUrl) { this.metadataUrl = prefs.metadataUrl; const fetchedMetadata = await this.fetchMetadataFromUrl(); if (fetchedMetadata) { this.metadata = fetchedMetadata; } + } else if (prefs.metadata) { + const validationResult = await validateMetadata(prefs.metadata); + if (!validationResult) { + throw new Error('Invalid SAML metadata'); + } + this.metadata = prefs.metadata; } setSamlLoginEnabled(prefs.loginEnabled ?? isSamlLoginEnabled()); setSamlLoginLabel(prefs.loginLabel ?? getSamlLoginLabel()); @@ -248,18 +250,24 @@ export class SamlService { async fetchMetadataFromUrl(): Promise { try { - const prevRejectStatus = process.env.NODE_TLS_REJECT_UNAUTHORIZED; - process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; - const response = await axios.get(this.metadataUrl); - process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevRejectStatus; + // TODO:SAML: this will not work once axios is upgraded to > 1.2.0 (see checkServerIdentity) + const agent = new https.Agent({ + rejectUnauthorized: !this.ignoreSSL, + }); + const response = await axios.get(this.metadataUrl, { httpsAgent: agent }); if (response.status === 200 && response.data) { const xml = (await response.data) as string; - // TODO: SAML: validate XML - // throw new BadRequestError('Received XML is not valid SAML metadata.'); + const validationResult = await validateMetadata(xml); + if (!validationResult) { + throw new BadRequestError( + `Data received from ${this.metadataUrl} is not valid SAML metadata.`, + ); + } return xml; } } catch (error) { - throw new BadRequestError('SAML Metadata URL is invalid or response is .'); + // eslint-disable-next-line @typescript-eslint/restrict-template-expressions + throw new BadRequestError(`Error fetching SAML Metadata from ${this.metadataUrl}: ${error}`); } return; } @@ -298,10 +306,14 @@ export class SamlService { async testSamlConnection(): Promise { try { + // TODO:SAML: this will not work once axios is upgraded to > 1.2.0 (see checkServerIdentity) + const agent = new https.Agent({ + rejectUnauthorized: !this.ignoreSSL, + }); const requestContext = this.getLoginRequestUrl(); if (!requestContext) return false; if (requestContext.binding === 'redirect') { - const fetchResult = await axios.get(requestContext.context.context); + const fetchResult = await axios.get(requestContext.context.context, { httpsAgent: agent }); if (fetchResult.status !== 200) { LoggerProxy.debug('SAML: Error while testing SAML connection.'); return false; @@ -319,6 +331,7 @@ export class SamlService { // eslint-disable-next-line @typescript-eslint/naming-convention 'Content-type': 'application/x-www-form-urlencoded', }, + httpsAgent: agent, }); if (fetchResult.status !== 200) { LoggerProxy.debug('SAML: Error while testing SAML connection.'); diff --git a/packages/cli/src/sso/saml/samlValidator.ts b/packages/cli/src/sso/saml/samlValidator.ts new file mode 100644 index 000000000..2eaa3505a --- /dev/null +++ b/packages/cli/src/sso/saml/samlValidator.ts @@ -0,0 +1,93 @@ +import { LoggerProxy } from 'n8n-workflow'; +import type { XMLFileInfo } from 'xmllint-wasm'; +import { validateXML } from 'xmllint-wasm'; +import { xsdSamlSchemaAssertion20 } from './schema/saml-schema-assertion-2.0.xsd'; +import { xsdSamlSchemaMetadata20 } from './schema/saml-schema-metadata-2.0.xsd'; +import { xsdSamlSchemaProtocol20 } from './schema/saml-schema-protocol-2.0.xsd'; +import { xsdXenc } from './schema/xenc-schema.xsd'; +import { xsdXml } from './schema/xml.xsd'; +import { xsdXmldsigCore } from './schema/xmldsig-core-schema.xsd'; + +const xml: XMLFileInfo = { + fileName: 'xml.xsd', + contents: xsdXml, +}; + +const xmldsigCore: XMLFileInfo = { + fileName: 'xmldsig-core-schema.xsd', + contents: xsdXmldsigCore, +}; + +const xmlXenc: XMLFileInfo = { + fileName: 'xenc-schema.xsd', + contents: xsdXenc, +}; + +const xmlMetadata: XMLFileInfo = { + fileName: 'saml-schema-metadata-2.0.xsd', + contents: xsdSamlSchemaMetadata20, +}; + +const xmlAssertion: XMLFileInfo = { + fileName: 'saml-schema-assertion-2.0.xsd', + contents: xsdSamlSchemaAssertion20, +}; + +const xmlProtocol: XMLFileInfo = { + fileName: 'saml-schema-protocol-2.0.xsd', + contents: xsdSamlSchemaProtocol20, +}; + +export async function validateMetadata(metadata: string): Promise { + try { + const validationResult = await validateXML({ + xml: [ + { + fileName: 'metadata.xml', + contents: metadata, + }, + ], + extension: 'schema', + schema: [xmlMetadata], + preload: [xmlProtocol, xmlAssertion, xmldsigCore, xmlXenc, xml], + }); + if (validationResult.valid) { + LoggerProxy.debug('SAML Metadata is valid'); + return true; + } else { + LoggerProxy.warn('SAML Validate Metadata: Invalid metadata'); + LoggerProxy.warn(validationResult.errors.join('\n')); + } + } catch (error) { + // eslint-disable-next-line @typescript-eslint/no-unsafe-argument + LoggerProxy.warn(error); + } + return false; +} + +export async function validateResponse(response: string): Promise { + try { + const validationResult = await validateXML({ + xml: [ + { + fileName: 'response.xml', + contents: response, + }, + ], + extension: 'schema', + schema: [xmlProtocol], + preload: [xmlMetadata, xmlAssertion, xmldsigCore, xmlXenc, xml], + }); + if (validationResult.valid) { + LoggerProxy.debug('SAML Response is valid'); + return true; + } else { + LoggerProxy.warn('SAML Validate Response: Failed'); + LoggerProxy.warn(validationResult.errors.join('\n')); + } + } catch (error) { + // eslint-disable-next-line @typescript-eslint/no-unsafe-argument + LoggerProxy.warn(error); + } + return false; +} diff --git a/packages/cli/src/sso/saml/schema/saml-schema-assertion-2.0.xsd.ts b/packages/cli/src/sso/saml/schema/saml-schema-assertion-2.0.xsd.ts new file mode 100644 index 000000000..ff8d93c98 --- /dev/null +++ b/packages/cli/src/sso/saml/schema/saml-schema-assertion-2.0.xsd.ts @@ -0,0 +1,283 @@ +export const xsdSamlSchemaAssertion20 = ` + + + + + + Document identifier: saml-schema-assertion-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New assertion schema for SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/schema/saml-schema-metadata-2.0.xsd.ts b/packages/cli/src/sso/saml/schema/saml-schema-metadata-2.0.xsd.ts new file mode 100644 index 000000000..664168ef9 --- /dev/null +++ b/packages/cli/src/sso/saml/schema/saml-schema-metadata-2.0.xsd.ts @@ -0,0 +1,336 @@ +export const xsdSamlSchemaMetadata20 = ` + + + + + + + + Document identifier: saml-schema-metadata-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Schema for SAML metadata, first published in SAML 2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/schema/saml-schema-protocol-2.0.xsd.ts b/packages/cli/src/sso/saml/schema/saml-schema-protocol-2.0.xsd.ts new file mode 100644 index 000000000..18e27b006 --- /dev/null +++ b/packages/cli/src/sso/saml/schema/saml-schema-protocol-2.0.xsd.ts @@ -0,0 +1,302 @@ +export const xsdSamlSchemaProtocol20 = ` + + + + + + Document identifier: saml-schema-protocol-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New protocol schema based in a SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/schema/xenc-schema.xsd.ts b/packages/cli/src/sso/saml/schema/xenc-schema.xsd.ts new file mode 100644 index 000000000..de9d3ca34 --- /dev/null +++ b/packages/cli/src/sso/saml/schema/xenc-schema.xsd.ts @@ -0,0 +1,145 @@ +export const xsdXenc = ` + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/schema/xml.xsd.ts b/packages/cli/src/sso/saml/schema/xml.xsd.ts new file mode 100644 index 000000000..4487356ea --- /dev/null +++ b/packages/cli/src/sso/saml/schema/xml.xsd.ts @@ -0,0 +1,117 @@ +export const xsdXml = ` + + + + + + See http://www.w3.org/XML/1998/namespace.html and + http://www.w3.org/TR/REC-xml for information about this namespace. + + This schema document describes the XML namespace, in a form + suitable for import by other schema documents. + + Note that local names in this namespace are intended to be defined + only by the World Wide Web Consortium or its subgroups. The + following names are currently defined in this namespace and should + not be used with conflicting semantics by any Working Group, + specification, or document instance: + + base (as an attribute name): denotes an attribute whose value + provides a URI to be used as the base for interpreting any + relative URIs in the scope of the element on which it + appears; its value is inherited. This name is reserved + by virtue of its definition in the XML Base specification. + + lang (as an attribute name): denotes an attribute whose value + is a language code for the natural language of the content of + any element; its value is inherited. This name is reserved + by virtue of its definition in the XML specification. + + space (as an attribute name): denotes an attribute whose + value is a keyword indicating what whitespace processing + discipline is intended for the content of the element; its + value is inherited. This name is reserved by virtue of its + definition in the XML specification. + + Father (in any context at all): denotes Jon Bosak, the chair of + the original XML Working Group. This name is reserved by + the following decision of the W3C XML Plenary and + XML Coordination groups: + + In appreciation for his vision, leadership and dedication + the W3C XML Plenary on this 10th day of February, 2000 + reserves for Jon Bosak in perpetuity the XML name + xml:Father + + + + + This schema defines attributes and an attribute group + suitable for use by + schemas wishing to allow xml:base, xml:lang or xml:space attributes + on elements they define. + + To enable this, such a schema must import this schema + for the XML namespace, e.g. as follows: + <schema . . .> + . . . + <import namespace="http://www.w3.org/XML/1998/namespace" + schemaLocation="xml.xsd"/> + + Subsequently, qualified reference to any of the attributes + or the group defined below will have the desired effect, e.g. + + <type . . .> + . . . + <attributeGroup ref="xml:specialAttrs"/> + + will define a type which will schema-validate an instance + element with any of those attributes + + + + In keeping with the XML Schema WG's standard versioning + policy, this schema document will persist at + http://www.w3.org/2001/03/xml.xsd. + At the date of issue it can also be found at + http://www.w3.org/2001/xml.xsd. + The schema document at that URI may however change in the future, + in order to remain compatible with the latest version of XML Schema + itself. In other words, if the XML Schema namespace changes, the version + of this document at + http://www.w3.org/2001/xml.xsd will change + accordingly; the version at + http://www.w3.org/2001/03/xml.xsd will not change. + + + + + + In due course, we should install the relevant ISO 2- and 3-letter + codes as the enumerated possible values . . . + + + + + + + + + + + + + + + See http://www.w3.org/TR/xmlbase/ for + information about this attribute. + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/schema/xmldsig-core-schema.xsd.ts b/packages/cli/src/sso/saml/schema/xmldsig-core-schema.xsd.ts new file mode 100644 index 000000000..9cd615b61 --- /dev/null +++ b/packages/cli/src/sso/saml/schema/xmldsig-core-schema.xsd.ts @@ -0,0 +1,318 @@ +export const xsdXmldsigCore = ` + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +`; diff --git a/packages/cli/src/sso/saml/serviceProvider.ee.ts b/packages/cli/src/sso/saml/serviceProvider.ee.ts index b99bc71a1..020ab83ed 100644 --- a/packages/cli/src/sso/saml/serviceProvider.ee.ts +++ b/packages/cli/src/sso/saml/serviceProvider.ee.ts @@ -1,18 +1,10 @@ import { getInstanceBaseUrl } from '@/UserManagement/UserManagementHelper'; import type { ServiceProviderInstance } from 'samlify'; -import { ServiceProvider, setSchemaValidator } from 'samlify'; +import { ServiceProvider } from 'samlify'; import { SamlUrls } from './constants'; let serviceProviderInstance: ServiceProviderInstance | undefined; -setSchemaValidator({ - // eslint-disable-next-line @typescript-eslint/no-unused-vars - validate: async (response: string) => { - // TODO:SAML: implment validation - return Promise.resolve('skipped'); - }, -}); - const metadata = ` =10.5.0'} + dev: false + /xpath/0.0.32: resolution: {integrity: sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw==} engines: {node: '>=0.6.0'}