Skip to content

Commit

Permalink
Improve Google SAML support
Browse files Browse the repository at this point in the history
  • Loading branch information
vincelwt committed May 20, 2024
1 parent 586c9dc commit a852db2
Showing 1 changed file with 21 additions and 8 deletions.
29 changes: 21 additions & 8 deletions packages/backend/src/api/v1/auth/saml.ts
Original file line number Diff line number Diff line change
Expand Up @@ -76,22 +76,35 @@ export async function getLoginUrl(orgId: string) {
return context
}

function parseAttributes(attributes: any) {
let email = ""
// This function parses the attributes from the SAML response
// and returns the email and name
function parseAttributes(attributes: any, nameID: string) {
let email = nameID
let name = ""

for (const key in attributes) {
if (key.toLowerCase().includes("emailaddress")) {
if (
key.toLowerCase().includes("emailaddress") ||
key.toLowerCase() === "email"
) {
email = sanitizeEmail(attributes[key])
} else if (key.toLowerCase().includes("displayname")) {
} else if (
key.toLowerCase().includes("displayname") ||
key.toLowerCase() === "name"
) {
name = attributes[key]
}
}

if (!name && attributes.firstname && attributes.lastname) {
name = `${attributes.firstname} ${attributes.lastname}`
}

return { email, name }
}

route.get("/success", async (ctx: Context) => {
const { orgId } = ctx.params as { orgId: string }
// const { orgId } = ctx.params as { orgId: string }

ctx.redirect(process.env.APP_URL!)
})
Expand Down Expand Up @@ -137,7 +150,7 @@ route.post("/acs", async (ctx: Context) => {

const parsedResult = await sp.parseLoginResponse(idp, "post", ctx.request)

const { attributes, conditions } = parsedResult.extract
const { attributes, conditions, nameID } = parsedResult.extract

if (!attributes) {
ctx.throw(400, "No attributes found")
Expand All @@ -153,7 +166,7 @@ route.post("/acs", async (ctx: Context) => {
}
}

const { email, name } = parseAttributes(attributes)
const { email, name } = parseAttributes(attributes, nameID)

const singleUseToken = await generateOneTimeToken()

Expand All @@ -173,7 +186,7 @@ route.post("/acs", async (ctx: Context) => {

route.post("/slo", async (ctx: Context) => {
const { orgId } = ctx.params as { orgId: string }
ctx.body = "SAML SLO received for orgId: " + orgId
ctx.body = "SAML SLO received for org: " + orgId

Check failure

Code scanning / CodeQL

Reflected cross-site scripting High

Cross-site scripting vulnerability due to a
user-provided value
.
})

export default route

0 comments on commit a852db2

Please sign in to comment.