NodeJS SAML Lib [closed]

Question

Are there any SAML libraries for NodeJS? There seems to be a ton of code available for node but no SAML libraries. If not, is there a reason why not?

Bookman

Answer 1

I did not really tried this yet, but it seems to be what you are looking for : https://npmjs.org/package/passport-saml

It is also kind of new (it came out after the last answer was posted).

Siler

I think it can't act as an identity provider, only a service (authentication) provider. – Overlive

@Overlive yeah, that is expected. – Siler

Not really sure what the protocol is for marking an answer that is only possible at a much later date, but marking this answer in any event. – Bookman

It should be noted that passport-saml is no longer being maintained as of Dec 2015, and has known security vulnerabilities as well as a host of outstanding issues that will not be resolved. I don't know of a good alternative -- found this while searching for one. But the solution is certainly no longer passport-saml – Ersatz

This is a possible solution: github.com/auth0/passport-wsfed-saml2. It is a fork of passport-saml that has continued to be worked on and is under the auth0 Github organization. – Ersatz

Answer 2

Node.js is still a new technology and mostly being used on startups or enterprises that are innovating with realtime. Hence SAML is not popular among them, you will find more OAuth in that space. SAML is not a simple spec to implement (as opposed something like SWT or JWT). The hard piece is the Digital Signature which requires XML canonicalization among other things.

Couple of months ago I wrote an article about using Windows Azure ACS (which uses WS-Federation protocol and SimpleWebTokens) with node.js

http://nodeblog.cloudapp.net/using-windows-azure-access-control-service-acs-from-a-node-app

If you are interested in writing a SAML library for node.js let me know. I am interested in that.

Matias

Nanny

The link is broken at this time – Fash

Answer 3

There is also this npm package, I haven't used or implemented it yet, but it looks promising...

https://www.npmjs.com/package/saml2-js

Sara

Answer 4

Here you have one http://github.com/leandrob/saml20

var saml = require('saml20');

var options = {
    publicKey: 'MIICDzCCAXygAwIBAgIQVWXAvbbQyI5Bc...',
    audince: 'http://myservice.com/'
}

saml.validate(rawAssertion, options, function(err, profile) {
    // err

    var claims = profile.claims; // Array of user attributes;
    var issuer = profile.issuer: // String Issuer name.
});

Overthrow

HI - I saw this package, but where does the rawAssertion parameter come from? Is it part of the http request? – Nanji

rawAssertion is comming from samlResponse coming from an IDP server after authentication,basically samlresponse consist of Assertion , for this saml20, api u have to pass Assertion – Bedchamber

Answer 5

Collection of SAML libraries for Node.js:

1. samlify
2. Passport-SAML
3. SAML2-js
4. Node SAML

Fanatical