[EVAKA-HOTFIX] Support Single Logout w/o 3rd party cookies

[mikkopiu]

Summary of SLO issue / vulnerability

• Many browsers are starting to disable 3rd party cookies by default (even SameSite None) which breaks Single Logout with passport-saml that currently only supports logging out with a cookie
  • Browser details: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ and https://blog.google/products/chrome/more-intuitive-privacy-and-security-controls-chrome/
  • passport-saml issues: passport-saml's IdP initiated LogoutRequest handling doesn't always close sessions node-saml/passport-saml#419 and IdP-initiated SLO node-saml/passport-saml#221
    • This also causes an usability issue when the user tries to initate SLO from another application, fails to end the eVaka session, attempts a logout from eVaka and gets an ugly JSON error message as a response when APIGW attempts to make a LogoutRequest to the IdP that already ended the session -> will be fixed separately

1. User logs into eVaka via IdP
2. User logs into service B via same IdP SSO session
3. User starts Single Logout from service B and IdP initiates SAML LogoutRequests via the User's browser
4. User's browser blocks 3rd party cookies, i.e. eVaka's logout cookie/token
5. eVaka incorrectly responds with SAML success message and User thinks they've logged out of eVaka but haven't <- the major security issue
6. Another entity/person with access to the same computer can use User's eVaka session

Summary

• apigw: support SLO without cookies, drop logout cookie
  • Other systems like Shibboleth get around the 3rd party cookie issue with Single Logout by not utilizing cookies at all for this but instead use the SAML nameID (and sessionIndex) properties presented in all SAML LogoutRequest messages
    • Source: https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameSite+Testing#IdPSameSiteTesting-SameSiteandSingleLogout
  • When logouts are always only done through SAML there's no need for the logout cookie itself but the idea is actually useful as an effective "secondary index" for Redis:
    • By storing a nameID + sessionIndex keyed item pointing to the session ID, we effectively create a second index that can be used with just the SAML LogoutRequest's nameID and sessionIndex properties
• apigw: clarify logout start error logging
  • No SAML error will ever be present when starting the logout flow from the SP (eVaka itself) -> don't waste time attempting to parse SAML errors and clarify the error description
• apigw: split SAML config creation from Strategy creation
  • Allows separate instation of the SAML class (from passport-saml) used for parsing SAML messages for SLO
  • NOTE: This would be entirely unnecessary if passport-saml either supported hooking into passport.authenticate() before it automatically redirects on SAMLRequest or if it had separate methods for first parsing the request and then doing everything else (redirects etc.)
• apigw: don't use deprecated body-parser directly
  • Express still actually uses the same body-parser package/methods behind the scenes but as the library user we should use the official wrapper methods express.json() and express.urlencoded()
  • Options stay as-is as the implementations stay as-is
• apigw: Extend GatewayTester to allow further cookie manipulation and non-dummy authentication
• apigw: add test certificates for unit testing
• apigw: add dependencies and features to test tooling for testing the new SAML functionality & mocking required parts of app setup and authentication
• Add .editorconfig for apigw/ (matches frontend/.editorconfig)
• apigw: enable @typescript/no-floating-promises rule for ESLint (can't forget to await a Promise, already enabled in frontend projects)

Testing instructions

On master version (e.g. staging):

1. Go to https://staging.espoonvarhaiskasvatus.fi/ -> login with Suomi.fi (any user)
2. Go to https://staging.espoositoavustukset.fi/nuoriso/ in the same browser session -> login with Suomi.fi -> will use the same IdP session
3. Open dev tools for request logs
4. Attempt to log out in https://staging.espoositoavustukset.fi/nuoriso/
5. -> Suomi.fi will trigger Single Logout (SLO) for https://staging.espoonvarhaiskasvatus.fi/api/application/auth/saml/logout/callback (with a SAMLRequest query parameter)
6. -> eVaka will respond with 302 with a SAMLResponse indicating success
7. -> Suomi.fi shows "Sinut on jo kirjattu ulos seuraavista palveluista Espoon kaupungin varhaiskasvatus Kirjauduttu ulos"
8. Go to eVaka tab and attempt to log out
9. -> You will get an (ugly) JSON error response page with {"message":"Internal server error"} + an alert

On dev (once this branch is deployed):

1. Repeat process
2. -> you will be successfully logged out without any errors

• Manually tested in staging against Suomi.fi
• Manually tested in staging against Azure AD
• Manually tested in staging against Keycloak
• Manually tested in staging with mobile employee authentication

[mikkopiu]

Replacing this with undefined should effectively simulate the situation in master when running the regression tests: if nothing is parsed from the SAML message, only cookies are used (and the tests don't currently care about SameSite in this context, so evaka.eugw.session will be available in the "IdP-initiated logout" test case).