-
Notifications
You must be signed in to change notification settings - Fork 5.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(core): Add SAML XML validation (#5600)
* consolidate SSO settings * update saml settings * fix type error * limit user changes when saml is enabled * add test * add toggle endpoint and fetch metadata * rename enabled param * add handling of POST saml login request * add config test endpoint * adds saml XML validation * add comment * protect test endpoint * improve ignoreSSL and some cleanup * fix wrong schema used * remove console.log
- Loading branch information
1 parent
ddfa16c
commit ca66ec8
Showing
16 changed files
with
1,672 additions
and
51 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| import { LoggerProxy } from 'n8n-workflow'; | ||
| import type { XMLFileInfo } from 'xmllint-wasm'; | ||
| import { validateXML } from 'xmllint-wasm'; | ||
| import { xsdSamlSchemaAssertion20 } from './schema/saml-schema-assertion-2.0.xsd'; | ||
| import { xsdSamlSchemaMetadata20 } from './schema/saml-schema-metadata-2.0.xsd'; | ||
| import { xsdSamlSchemaProtocol20 } from './schema/saml-schema-protocol-2.0.xsd'; | ||
| import { xsdXenc } from './schema/xenc-schema.xsd'; | ||
| import { xsdXml } from './schema/xml.xsd'; | ||
| import { xsdXmldsigCore } from './schema/xmldsig-core-schema.xsd'; | ||
|
|
||
| const xml: XMLFileInfo = { | ||
| fileName: 'xml.xsd', | ||
| contents: xsdXml, | ||
| }; | ||
|
|
||
| const xmldsigCore: XMLFileInfo = { | ||
| fileName: 'xmldsig-core-schema.xsd', | ||
| contents: xsdXmldsigCore, | ||
| }; | ||
|
|
||
| const xmlXenc: XMLFileInfo = { | ||
| fileName: 'xenc-schema.xsd', | ||
| contents: xsdXenc, | ||
| }; | ||
|
|
||
| const xmlMetadata: XMLFileInfo = { | ||
| fileName: 'saml-schema-metadata-2.0.xsd', | ||
| contents: xsdSamlSchemaMetadata20, | ||
| }; | ||
|
|
||
| const xmlAssertion: XMLFileInfo = { | ||
| fileName: 'saml-schema-assertion-2.0.xsd', | ||
| contents: xsdSamlSchemaAssertion20, | ||
| }; | ||
|
|
||
| const xmlProtocol: XMLFileInfo = { | ||
| fileName: 'saml-schema-protocol-2.0.xsd', | ||
| contents: xsdSamlSchemaProtocol20, | ||
| }; | ||
|
|
||
| export async function validateMetadata(metadata: string): Promise<boolean> { | ||
| try { | ||
| const validationResult = await validateXML({ | ||
| xml: [ | ||
| { | ||
| fileName: 'metadata.xml', | ||
| contents: metadata, | ||
| }, | ||
| ], | ||
| extension: 'schema', | ||
| schema: [xmlMetadata], | ||
| preload: [xmlProtocol, xmlAssertion, xmldsigCore, xmlXenc, xml], | ||
| }); | ||
| if (validationResult.valid) { | ||
| LoggerProxy.debug('SAML Metadata is valid'); | ||
| return true; | ||
| } else { | ||
| LoggerProxy.warn('SAML Validate Metadata: Invalid metadata'); | ||
| LoggerProxy.warn(validationResult.errors.join('\n')); | ||
| } | ||
| } catch (error) { | ||
| // eslint-disable-next-line @typescript-eslint/no-unsafe-argument | ||
| LoggerProxy.warn(error); | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| export async function validateResponse(response: string): Promise<boolean> { | ||
| try { | ||
| const validationResult = await validateXML({ | ||
| xml: [ | ||
| { | ||
| fileName: 'response.xml', | ||
| contents: response, | ||
| }, | ||
| ], | ||
| extension: 'schema', | ||
| schema: [xmlProtocol], | ||
| preload: [xmlMetadata, xmlAssertion, xmldsigCore, xmlXenc, xml], | ||
| }); | ||
| if (validationResult.valid) { | ||
| LoggerProxy.debug('SAML Response is valid'); | ||
| return true; | ||
| } else { | ||
| LoggerProxy.warn('SAML Validate Response: Failed'); | ||
| LoggerProxy.warn(validationResult.errors.join('\n')); | ||
| } | ||
| } catch (error) { | ||
| // eslint-disable-next-line @typescript-eslint/no-unsafe-argument | ||
| LoggerProxy.warn(error); | ||
| } | ||
| return false; | ||
| } |
Oops, something went wrong.