API-10892 techdebt passport selection fix

src/routes/acsHandlers.test.ts

@@ -5,12 +5,7 @@ import { MpiUserClient } from "../MpiUserClient";
 import { VsoClient } from "../VsoClient";
 import { MVIRequestMetrics } from "../metrics";
 import { TestCache } from "./types";
-import {
-  buildSamlResponseFunction,
-  defaultMockRequest,
-} from "../../test/testUtils";
-import { idpConfig } from "../../test/testServer";
-import { IDME_USER } from "../../test/testUsers";
+import { defaultMockRequest, dataFromFile } from "../../test/testUtils";
 import { accessiblePhoneNumber } from "../utils";
 import samlp from "samlp";
 jest.mock("passport");
@@ -593,7 +588,6 @@ describe("buildPassportLoginHandler", () => {
   let req: any;
   let mockResponse: any;
   let mockNext: any;
-  const buildSamlResponse = buildSamlResponseFunction(1);
   beforeEach(async () => {
     req = defaultMockRequest;
     mockResponse = {
@@ -608,7 +602,7 @@ describe("buildPassportLoginHandler", () => {
   });
 
   it("happy path", () => {
-    req.query.SAMLResponse = buildSamlResponse(IDME_USER, "3", idpConfig);
+    req.query.SAMLResponse = dataFromFile("idp1_example.xml.b64");
     handlers.buildPassportLoginHandler("http://example.com/acs")(
       req,
       mockResponse,

src/routes/passport.js

@@ -2,6 +2,7 @@ import passport from "passport";
 import { Strategy } from "passport-wsfed-saml2";
 import omit from "lodash.omit";
 import { IDPProfileMapper } from "../IDPProfileMapper";
+import { issuerFromSamlResponse } from "../utils";
 
 /**
  * Creates the passport strategy using the response params
@@ -74,12 +75,21 @@ export function preparePassport(strategy) {
  * @returns {*} A string with the correct spIdp key
  */
 export const selectPassportStrategyKey = (req) => {
-  const origin = req.headers.origin;
-  let passportKey = "id_me";
-  Object.entries(req.sps.options).forEach((spIdpEntry) => {
-    if (spIdpEntry[1].idpSsoUrl.startsWith(origin)) {
-      passportKey = spIdpEntry[0];
-    }
+  const samlResponse = req.body?.SAMLResponse
+    ? req.body.SAMLResponse
+    : req.query.SAMLResponse;
+  const issuer = issuerFromSamlResponse(samlResponse);
+  const spIdpKeys = Object.keys(req.sps.options);
+  const foundSpIdpKey = spIdpKeys.find((spIdpKey) => {
+    const url = new URL(req.sps.options[spIdpKey].idpMetaUrl);
+    const domain_parts = url.host.split(".");
+    const domain = (domain_parts.length > 1
+      ? domain_parts[domain_parts.length - 2] +
+        "." +
+        domain_parts[domain_parts.length - 1]
+      : domain_parts[0]
+    ).replace("preview", ""); // An IDP broke convention and created a mismatch between the metdata url domain vs the issuer in the saml response
+    return issuer.includes(domain);
   });
-  return passportKey;
+  return foundSpIdpKey ? foundSpIdpKey : spIdpKeys[0];
 };

src/routes/passport.test.js

@@ -1,5 +1,7 @@
+/* eslint-disable jsdoc/require-returns */
 import "jest";
 import { selectPassportStrategyKey } from "./passport";
+import { dataFromFile } from "../../test/testUtils";
 
 const mockReq = {
   headers: {
@@ -8,24 +10,49 @@ const mockReq = {
   sps: {
     options: {
       idp1: {
-        idpSsoUrl: "http://login.example1.com/saml/sso",
+        category: "idp1",
+        idpMetaUrl: "https://api.idp1.com/saml/metadata/provider",
       },
       idp2: {
-        idpSsoUrl: "http://login.example2.com/saml/sso",
+        category: "idp2",
+        idpMetaUrl: "https://idp.int.idp2.org/api/saml/metadata2023",
+      },
+      idp3: {
+        category: "idp3",
+        idpMetaUrl: "https://idp3:18443/realms/xxxx/protocol/saml/descriptor",
+      },
+      idp4: {
+        category: "idp4",
+        idpMetaUrl:
+          "https://deptyyy.idp4preview.com/app/yyyy/sso/saml/metadata",
       },
     },
   },
 };
 describe("selectPassportStrategyKey", () => {
   test("selectPassportStrategyKey idp1", () => {
+    mockReq.body = { SAMLResponse: dataFromFile("idp1_example.xml.b64") };
     expect(selectPassportStrategyKey(mockReq)).toBe("idp1");
   });
   test("selectPassportStrategyKey idp2", () => {
-    mockReq.headers.origin = "http://login.example2.com";
+    mockReq.body = { SAMLResponse: dataFromFile("idp2_example.xml.b64") };
     expect(selectPassportStrategyKey(mockReq)).toBe("idp2");
   });
-  test("selectPassportStrategyKey default 'id_me'", () => {
-    mockReq.headers.origin = "http://login.example0.com";
-    expect(selectPassportStrategyKey(mockReq)).toBe("id_me");
+
+  test("selectPassportStrategyKey idp3", () => {
+    mockReq.body = { SAMLResponse: dataFromFile("idp3_example.xml.b64") };
+    expect(selectPassportStrategyKey(mockReq)).toBe("idp3");
+  });
+
+  test("selectPassportStrategyKey idp4", () => {
+    mockReq.body = { SAMLResponse: dataFromFile("idp4_example.xml.b64") };
+    expect(selectPassportStrategyKey(mockReq)).toBe("idp4");
+  });
+
+  test("selectPassportStrategyKey default 'idp1'", () => {
+    mockReq.body = {
+      SAMLResponse: dataFromFile("unmatched_example.xml.b64"),
+    };
+    expect(selectPassportStrategyKey(mockReq)).toBe("idp1");
   });
 });

src/utils.js

@@ -220,6 +220,29 @@ function getInResponseToFromSAML(samlResponse) {
   }
 }
 
+/**
+ * Retrieves the issuer from a b64 encoded SAMLResponse
+ *
+ * @param {string} samlResponse the raw samlResponse
+ * @returns {*} a string if Issuer is present
+ */
+export function issuerFromSamlResponse(samlResponse) {
+  try {
+    const decoded = Buffer.from(samlResponse, "base64").toString("ascii");
+    const parser = new DOMParser();
+    const issuerElems = parser
+      .parseFromString(decoded)
+      .documentElement.getElementsByTagNameNS(
+        "urn:oasis:names:tc:SAML:2.0:assertion",
+        "Issuer"
+      );
+    const issuer = issuerElems[0].textContent.trim();
+    return issuer;
+  } catch (err) {
+    logger.error("decodedSamlResponse failed: ", err);
+  }
+}
+
 /**
  * Retrieves ID assertion from SAMLRequest
  *

test/samlResponses/decoded/idp1_example.xml

@@ -0,0 +1,7 @@
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_7bb1775fba384475ae3593649740af7d"
+    Version="2.0" IssueInstant="2023-09-01T22:00:12Z"
+    Destination="http://localhost:7000/samlproxy/sp/saml/sso"
+    InResponseTo="id32154644961507252952328722">
+    <saml:Issuer>api.idp1.com</saml:Issuer>
+</samlp:Response>

test/samlResponses/decoded/idp2_example.xml

@@ -0,0 +1,7 @@
+<samlp:Response ID="_03af590d-49cf-4360-9da8-cef9ce89986e" Version="2.0"
+    IssueInstant="2023-09-01T22:33:07Z" Destination="https://localhost:9001/samlproxy/sp/saml/sso"
+    Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
+    InResponseTo="id771166074202739869068838" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
+    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
+        https://idp2.org/api/saml</Issuer>
+</samlp:Response>

test/samlResponses/decoded/idp3_example.xml

@@ -0,0 +1,7 @@
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    Destination="http://localhost:7000/samlproxy/sp/saml/sso"
+    ID="ID_218901a1-603f-4688-87e0-2072c87bf36c" InResponseTo="id31972267796844074658910450"
+    IssueInstant="2023-08-30T19:54:56.160Z" Version="2.0">
+    <saml:Issuer>https://idp3:18443/idp</saml:Issuer>
+</samlp:Response>

test/samlResponses/decoded/idp4_example.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<saml2p:Response Destination="http://localhost:7000/samlproxy/sp/saml/sso"
+    ID="id62198144964841931471458631" InResponseTo="id58204955972369371611730360"
+    IssueInstant="2023-09-02T04:30:28.137Z" Version="2.0"
+    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
+        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.idp4.com/yyyyyy</saml2:Issuer>
+</saml2p:Response>

test/samlResponses/decoded/unmatched_example.xml

@@ -0,0 +1,10 @@
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    Destination="http://localhost:7000/samlproxy/sp/saml/sso"
+    ID="ID_218901a1-603f-4688-87e0-2072c87bf36c" InResponseTo="id31972267796844074658910450"
+    IssueInstant="2023-08-30T19:54:56.160Z" Version="2.0">
+    <saml:Issuer>http://wontfind/xxxx</saml:Issuer>
+    <samlp:Status>
+        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
+    </samlp:Status>
+</samlp:Response>

test/samlResponses/idp1_example.xml.b64

@@ -0,0 +1 @@
+PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiCiAgICB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iXzdiYjE3NzVmYmEzODQ0NzVhZTM1OTM2NDk3NDBhZjdkIgogICAgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjMtMDktMDFUMjI6MDA6MTJaIgogICAgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6NzAwMC9zYW1scHJveHkvc3Avc2FtbC9zc28iCiAgICBJblJlc3BvbnNlVG89ImlkMzIxNTQ2NDQ5NjE1MDcyNTI5NTIzMjg3MjIiPgogICAgPHNhbWw6SXNzdWVyPmFwaS5pZHAxLmNvbTwvc2FtbDpJc3N1ZXI+Cjwvc2FtbHA6UmVzcG9uc2U+

test/samlResponses/idp2_example.xml.b64

@@ -0,0 +1 @@
+PHNhbWxwOlJlc3BvbnNlIElEPSJfMDNhZjU5MGQtNDljZi00MzYwLTlkYTgtY2VmOWNlODk5ODZlIiBWZXJzaW9uPSIyLjAiCiAgICBJc3N1ZUluc3RhbnQ9IjIwMjMtMDktMDFUMjI6MzM6MDdaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2NhbGhvc3Q6OTAwMS9zYW1scHJveHkvc3Avc2FtbC9zc28iCiAgICBDb25zZW50PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y29uc2VudDp1bnNwZWNpZmllZCIKICAgIEluUmVzcG9uc2VUbz0iaWQ3NzExNjYwNzQyMDI3Mzk4NjkwNjg4MzgiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPgogICAgPElzc3VlciB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+CiAgICAgICAgaHR0cHM6Ly9pZHAyLm9yZy9hcGkvc2FtbDwvSXNzdWVyPgo8L3NhbWxwOlJlc3BvbnNlPg==

test/samlResponses/idp3_example.xml.b64

@@ -0,0 +1 @@
+PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiCiAgICB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIgogICAgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6NzAwMC9zYW1scHJveHkvc3Avc2FtbC9zc28iCiAgICBJRD0iSURfMjE4OTAxYTEtNjAzZi00Njg4LTg3ZTAtMjA3MmM4N2JmMzZjIiBJblJlc3BvbnNlVG89ImlkMzE5NzIyNjc3OTY4NDQwNzQ2NTg5MTA0NTAiCiAgICBJc3N1ZUluc3RhbnQ9IjIwMjMtMDgtMzBUMTk6NTQ6NTYuMTYwWiIgVmVyc2lvbj0iMi4wIj4KICAgIDxzYW1sOklzc3Vlcj5odHRwczovL2lkcDM6MTg0NDMvaWRwPC9zYW1sOklzc3Vlcj4KPC9zYW1scDpSZXNwb25zZT4=

test/samlResponses/idp4_example.xml.b64

@@ -0,0 +1 @@
+PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHNhbWwycDpSZXNwb25zZSBEZXN0aW5hdGlvbj0iaHR0cDovL2xvY2FsaG9zdDo3MDAwL3NhbWxwcm94eS9zcC9zYW1sL3NzbyIKICAgIElEPSJpZDYyMTk4MTQ0OTY0ODQxOTMxNDcxNDU4NjMxIiBJblJlc3BvbnNlVG89ImlkNTgyMDQ5NTU5NzIzNjkzNzE2MTE3MzAzNjAiCiAgICBJc3N1ZUluc3RhbnQ9IjIwMjMtMDktMDJUMDQ6MzA6MjguMTM3WiIgVmVyc2lvbj0iMi4wIgogICAgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSI+CiAgICA8c2FtbDI6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5IgogICAgICAgIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vd3d3LmlkcDQuY29tL3l5eXl5eTwvc2FtbDI6SXNzdWVyPgo8L3NhbWwycDpSZXNwb25zZT4=

test/samlResponses/unmatched_example.xml.b64

@@ -0,0 +1 @@
+PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiCiAgICB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIgogICAgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6NzAwMC9zYW1scHJveHkvc3Avc2FtbC9zc28iCiAgICBJRD0iSURfMjE4OTAxYTEtNjAzZi00Njg4LTg3ZTAtMjA3MmM4N2JmMzZjIiBJblJlc3BvbnNlVG89ImlkMzE5NzIyNjc3OTY4NDQwNzQ2NTg5MTA0NTAiCiAgICBJc3N1ZUluc3RhbnQ9IjIwMjMtMDgtMzBUMTk6NTQ6NTYuMTYwWiIgVmVyc2lvbj0iMi4wIj4KICAgIDxzYW1sOklzc3Vlcj5odHRwOi8vd29udGZpbmQveHh4eDwvc2FtbDpJc3N1ZXI+CiAgICA8c2FtbHA6U3RhdHVzPgogICAgICAgIDxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiIC8+CiAgICA8L3NhbWxwOlN0YXR1cz4KPC9zYW1scDpSZXNwb25zZT4=

test/testUtils.js

@@ -1,6 +1,8 @@
 import btoa from "btoa";
 import { getSamlResponse } from "samlp";
 import { getUser } from "./testUsers";
+const fs = require("fs");
+const path = require("path");
 
 /**
  * This test function builds the saml response function using session index
@@ -33,9 +35,6 @@ export let defaultMockRequest = {
   query: {
     relayState: "relay",
   },
-  headers: {
-    origin: "https://idp.example.com",
-  },
   body: {
     RelayState: "relay",
     SAMLResponse: null
@@ -45,6 +44,7 @@ export let defaultMockRequest = {
       id_me: {
         getResponseParams: jest.fn(() => {}),
         idpSsoUrl: "https://idp.example.com/saml/sso",
+        idpMetaUrl: "https://api.idmelabs.com/metadata",
       },
     },
   },
@@ -72,3 +72,16 @@ export let defaultMockRequest = {
   originalUrl: "http://original.example.com",
   x_fowarded_host: "fowarded.example.com",
 };
+
+/**
+ * Loads test data into a string.
+ * 
+ * @param {*} fname The file with test data
+ */
+export function dataFromFile(fname) {
+  const file = path.join("./test/samlResponses", fname);
+  const out = fs.readFileSync(file, "utf8", function (err, data) {
+    return data;
+  });
+  return out;
+}