From d73063922c2781e64660b8f0694b398d1c27c0e0 Mon Sep 17 00:00:00 2001 From: Emmanuel Ormancey Date: Wed, 12 Dec 2018 10:40:24 +0100 Subject: [PATCH] Added a configuration option for passport-saml: disableRequestedAuthnContext: true|false By default only Password authmethod is accepted, this option allows any other method. Issue and option described here: https://github.com/bergie/passport-saml/issues/226 Signed-off-by: Emmanuel Ormancey --- README.md | 1 + config.json.example | 1 + lib/config/default.js | 1 + lib/config/environment.js | 1 + lib/config/hackmdEnvironment.js | 1 + lib/web/auth/saml/index.js | 3 ++- 6 files changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c68d6cb0..1894d254 100644 --- a/README.md +++ b/README.md @@ -225,6 +225,7 @@ There are some config settings you need to change in the files below. | `CMD_SAML_IDPCERT` | `/path/to/cert.pem` | certificate file path of IdP in PEM format | | `CMD_SAML_ISSUER` | no example | identity of the service provider (optional, default: serverurl)" | | `CMD_SAML_IDENTIFIERFORMAT` | no example | name identifier format (optional, default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) | +| `CMD_SAML_DISABLEREQUESTEDAUTHNCONTEXT` | `true` or `false` | true to allow any authentication method, false restricts to password authentication (PasswordProtectedTransport) method (default: false) | | `CMD_SAML_GROUPATTRIBUTE` | `memberOf` | attribute name for group list (optional) | | `CMD_SAML_REQUIREDGROUPS` | `Hackmd-users` | group names that allowed (use vertical bar to separate) (optional) | | `CMD_SAML_EXTERNALGROUPS` | `Temporary-staff` | group names that not allowed (use vertical bar to separate) (optional) | diff --git a/config.json.example b/config.json.example index fe8c810c..f028d8b8 100644 --- a/config.json.example +++ b/config.json.example @@ -93,6 +93,7 @@ "idpCert": "change: certificate file path of IdP in PEM format", "issuer": "change or delete: identity of the service provider (default: serverurl)", "identifierFormat": "change or delete: name identifier format (default: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress')", + "disableRequestedAuthnContext": "change or delete: true to allow any authentication method, false restricts to password authentication method (default: false)", "groupAttribute": "change or delete: attribute name for group list (ex: memberOf)", "requiredGroups": [ "change or delete: group names that allowed" ], "externalGroups": [ "change or delete: group names that not allowed" ], diff --git a/lib/config/default.js b/lib/config/default.js index 5a7ae0a0..f9a6df4f 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -138,6 +138,7 @@ module.exports = { idpCert: undefined, issuer: undefined, identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', + disableRequestedAuthnContext: false, groupAttribute: undefined, externalGroups: [], requiredGroups: [], diff --git a/lib/config/environment.js b/lib/config/environment.js index a57fe0db..594daeef 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -115,6 +115,7 @@ module.exports = { idpCert: process.env.CMD_SAML_IDPCERT, issuer: process.env.CMD_SAML_ISSUER, identifierFormat: process.env.CMD_SAML_IDENTIFIERFORMAT, + disableRequestedAuthnContext: toBooleanConfig(process.env.CMD_SAML_DISABLEREQUESTEDAUTHNCONTEXT), groupAttribute: process.env.CMD_SAML_GROUPATTRIBUTE, externalGroups: toArrayConfig(process.env.CMD_SAML_EXTERNALGROUPS, '|', []), requiredGroups: toArrayConfig(process.env.CMD_SAML_REQUIREDGROUPS, '|', []), diff --git a/lib/config/hackmdEnvironment.js b/lib/config/hackmdEnvironment.js index e1c11569..cd1613f9 100644 --- a/lib/config/hackmdEnvironment.js +++ b/lib/config/hackmdEnvironment.js @@ -109,6 +109,7 @@ module.exports = { idpCert: process.env.HMD_SAML_IDPCERT, issuer: process.env.HMD_SAML_ISSUER, identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT, + disableRequestedAuthnContext: toBooleanConfig(process.env.HMD_SAML_DISABLEREQUESTEDAUTHNCONTEXT), groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE, externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []), requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []), diff --git a/lib/web/auth/saml/index.js b/lib/web/auth/saml/index.js index b8d98340..3cdb7fe2 100644 --- a/lib/web/auth/saml/index.js +++ b/lib/web/auth/saml/index.js @@ -17,7 +17,8 @@ passport.use(new SamlStrategy({ entryPoint: config.saml.idpSsoUrl, issuer: config.saml.issuer || config.serverURL, cert: fs.readFileSync(config.saml.idpCert, 'utf-8'), - identifierFormat: config.saml.identifierFormat + identifierFormat: config.saml.identifierFormat, + disableRequestedAuthnContext: config.saml.disableRequestedAuthnContext }, function (user, done) { // check authorization if needed if (config.saml.externalGroups && config.saml.groupAttribute) {