-
Notifications
You must be signed in to change notification settings - Fork 477
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: attrValueMapper fails to parse complex AttributeValue tags (#245)
This fixes an issue where the `attrValueMapper` would fail to properly map the value for complex `AttributeValue` tags. This handles the case where the `AttributeValue` contains a nested `NameID` tag. One such example is the `eduPersonTargetedID` that is used as an identifier in [eduGAIN][1] which can return an Attribute of the form ```xml <saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml2:AttributeValue> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://idp.example-university.fr/idp/shibboleth" SPNameQualifier="https://www.service-provider.com/shibboleth">a6c2c4d4-08b9-4ca7-8ff9-43d83e6e1d35</saml2:NameID> </saml2:AttributeValue> </saml2:Attribute> ``` Note that in reality, the `AttributeValue` tags can be much more complex. [The Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0][2] uses the following schema for the `Attribute` tag: ```xml <element name="Attribute" type="saml:AttributeType"/> <complexType name="AttributeType"> <sequence> <element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/> </sequence> <attribute name="Name" type="string" use="required"/> <attribute name="NameFormat" type="anyURI" use="optional"/> <attribute name="FriendlyName" type="string" use="optional"/> <anyAttribute namespace="##other" processContents="lax"/> </complexType> ``` and the following schema for the `AttributeValue`: ```xml <element name="AttributeValue" type="anyType" nillable="true"/> ``` which means it can take any type. As pointed in [3], it is customary to use `NameQualifier` and the `SPNameQualifier` in addition to the actual value to create a unique identifier for the platform. That is why the `AttributeValue` is mapped to an object containing the attribute of the `NameID` tag as well as the string value for `eduPersonTargetedID` that is stored in the `Value` property. [1]: https://wiki.geant.org/display/eduGAIN/Identifier+Attributes [2]: https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf [3]: #245 (comment)
- Loading branch information
1 parent
fb1bda0
commit c1801a4
Showing
3 changed files
with
164 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,109 @@ | ||
module.exports = [ | ||
{ | ||
$: { | ||
FriendlyName: "mail", | ||
Name: "urn:oid:0.9.2342.19200300.100.1.3", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
_: "example-user@example-university.edu", | ||
$: { | ||
"xmlns:xsd": "http://www.w3.org/2001/XMLSchema", | ||
"xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", | ||
"xsi:type": "xsd:string" | ||
} | ||
} | ||
] | ||
}, | ||
{ | ||
$: { | ||
FriendlyName: "eduPersonTargetedID", | ||
Name: "urn:oid:1.3.6.1.4.1.5923.1.1.1.10", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
NameID: [ | ||
{ | ||
_: "SBJMMcDv00BWSefyNqumyK0A+Jb=", | ||
$: { | ||
Format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", | ||
NameQualifier: | ||
"https://idp.example-university.edu/idp/shibboleth", | ||
SPNameQualifier: "https://www.example-service-provider.com/entity" | ||
} | ||
} | ||
] | ||
} | ||
] | ||
}, | ||
{ | ||
$: { | ||
FriendlyName: "eduPersonPrimaryAffiliation", | ||
Name: "urn:oid:1.3.6.1.4.1.5923.1.1.1.5", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
_: "staff", | ||
$: { | ||
"xmlns:xsd": "http://www.w3.org/2001/XMLSchema", | ||
"xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", | ||
"xsi:type": "xsd:string" | ||
} | ||
} | ||
] | ||
}, | ||
{ | ||
$: { | ||
FriendlyName: "displayName", | ||
Name: "urn:oid:2.16.840.1.113730.3.1.241", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
_: "Smith John", | ||
$: { | ||
"xmlns:xsd": "http://www.w3.org/2001/XMLSchema", | ||
"xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", | ||
"xsi:type": "xsd:string" | ||
} | ||
} | ||
] | ||
}, | ||
{ | ||
$: { | ||
FriendlyName: "givenName", | ||
Name: "urn:oid:2.5.4.42", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
_: "John", | ||
$: { | ||
"xmlns:xsd": "http://www.w3.org/2001/XMLSchema", | ||
"xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", | ||
"xsi:type": "xsd:string" | ||
} | ||
} | ||
] | ||
}, | ||
{ | ||
$: { | ||
FriendlyName: "surname", | ||
Name: "urn:oid:2.5.4.4", | ||
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
}, | ||
AttributeValue: [ | ||
{ | ||
_: "Smith", | ||
$: { | ||
"xmlns:xsd": "http://www.w3.org/2001/XMLSchema", | ||
"xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", | ||
"xsi:type": "xsd:string" | ||
} | ||
} | ||
] | ||
} | ||
]; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters