[Question] Support for <AssertionConsumerServiceIndex> in AuthnContext

[stevenztruong]

Hi,

I am stuck in the situation where the IDP server (Siteminder) requires that the application needs to include and the IDP will use this index to look up the Assertion Consumer Service URL in case multiple SP servers are registered under one application name. This also means that AssertionConsumerServiceURL in the request will be ignored.

I have gone over passport-saml document but could not find anything. Does anyone know whether passport-saml supports this? If not, can anyone suggest a workaround?

Thanks!

[stevenztruong]

Worst case scenario, can I interrupt passport-saml flow somehow to modify the SAML request before it is sent to IDP?

[DbCrWk]

tl;dr passport-saml does correctly set this index.

After you instantiate the strategy, you can output the service provider metadata to see exactly what is sent, like this

const myPublicCertificate = ...;
const strategy = new SamlStrategy(opts, callbackFn);
// This will output XML
strategy.generateServiceProviderMetadata(myPublicCertificate [, optionalEncryptionCertificate]);

If you check the metadata, you'll see

<AssertionConsumerService
    index="1"
    isDefault="true"
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Location="https://your-service.sp/callbackRoute"
/>

[MoreSaltMoreLemon]

I am also running into a need for the ability to control the AssertionConsumerServiceIndex property.

I'm interfacing with an Okta SAML endpoint which allows multiple requestable endpoints which are specified with the AssertionConsumerServiceIndex property.

Looking over the source code there's nowhere where this property is can be externally specified. It is given a default value of 1 here, and a similar property is set in exactly the manner that I'd like to utilize here.

If I extend passport-saml to have a assertionConsumingServiceIndex property like so:

    if (this.options.attributeConsumingServiceIndex != null) {
      request['samlp:AuthnRequest']['@AssertionConsumingServiceIndex'] = this.options.assertionConsumingServiceIndex;
    }

  metadata.EntityDescriptor.SPSSODescriptor.AssertionConsumerService = {
    '@index': this.options.assertionConsumingServiceIndex || '1',
    '@isDefault': 'true',
    '@Binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
    '@Location': this.getCallbackUrl({})
  };

Will these modifications cause issues for the integrity of the SAML request?

[cjbarth]

At first glace, it doesn't seem that this would cause any problems. Would you be willing to make a PR that includes this new option, include tests, and references the part of the SAML spec that calls for this. That will likely get more eyes on this matter and help others down the road.