Option disableRequestAcsUrl seems not to be working

[alry83]

Hi everyone,
I'm trying to configure a Strategy that does not include the AssertionConsumerServiceURL in the metadata.xml.
For that, I set the option disableRequestAcsUrl to true. But every time I generate the metadata.xml file, the AssertionConsumerServiceURL field remains there, and I cannot get rid of it.

Here is the SAML Strategy I'm defining:

const myStrategy = new SamlStrategy(
	{
		callbackUrl: process.env.BACKEND_APIPATH + '/login/callback',
		entryPoint: process.env.SAML_ENTRYPOINT,
		decryptionPvk: process.env.BackendPrivateKey,
		privateKey: process.env.BackendPrivateKey,
		cert: process.env.IsamIdpPublicKey,
		logoutUrl: process.env.SAML_SLO,
                disableRequestACSUrl: true,
		issuer: 'project-issuer'
	}
	function (profile, done) {   ...
       }
);

And this is the resulting medatada XML file:

<?xml version="1.0"?>
<EntityDescriptor
	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="project-issuer" ID="project_issuer">
	<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
		<KeyDescriptor use="signing">
			<ds:KeyInfo>
				<ds:X509Data>
					<ds:X509Certificate>... </ds:X509Certificate>
				</ds:X509Data>
			</ds:KeyInfo>
		</KeyDescriptor>
		<KeyDescriptor use="encryption">
			<ds:KeyInfo>
				<ds:X509Data>
					<ds:X509Certificate>... </ds:X509Certificate>
				</ds:X509Data>
			</ds:KeyInfo>
			<EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
			<EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
			<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
			<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
		</KeyDescriptor>
		<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
		<AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost/login/callback"/>
	</SPSSODescriptor>
</EntityDescriptor>

Am I doing anything wrong? I'm completely lost :(

Thanks in advance, and regards!
Alex

[srd90]

disableRequestAcsUrl is not related to SAML SP metadata. It is related to AuthnRequest as stated in passport-saml documentation:

• disableRequestAcsUrl: if truthy, SAML AuthnRequest from the service provider will not include the optional AssertionConsumerServiceURL. Default is falsy so it is automatically included.

source of the quote: https://github.com/node-saml/passport-saml/tree/d5ab7be931d894aab4844d0e19b9915b546c411a#config-parameter-details

If you check ultimate documentation (source code) you'll see that the only place where that configration option is used is:

passport-saml/src/node-saml/saml.ts

Lines 267 to 269 in d5ab7be

	if (!this.options.disableRequestAcsUrl) {
	request["samlp:AuthnRequest"]["@AssertionConsumerServiceURL"] = this.getCallbackUrl(host);
	}

where it is used to determine whether ACS URL is added to AuthnRequest (btw. link points to version v3.2.0 because that version of node-saml/passport-saml repository's content contains also stuff which has been since then splitted to node-saml/node-saml repository).

Furthermore AssertionConsumingService element is mandatory in SAML SP's metadata.xml. There must exist one or more of those. Quote from paragraph 2.4.4 Element <SPSSODescriptor> of document https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

<AssertionConsumerService> [One or More]
One or more elements that describe indexed endpoints that support the profiles of the Authentication Request protocol defined in [SAMLProf]. All service providers support at least one such endpoint, by definition.

Rationale for AssertionConsumerService endpoints at SAML SP metadata can be read e.g. from https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645420/MetadataForSP

Assertion Consumer Services

SPs support SSO protocols by including one or more <md:AssertionConsumerService> endpoint elements in their metadata. These are the locations to which the IdP will eventually send the user at the SP. By enumerating them in the metadata, the IdP can ensure that the user's information is sent only to authorized locations.

[alry83]

Hi @srd90,
First of all, thanks for the quick reply, and sorry for not being able to give you an answer until now.
After you explanation, I finally understood the reason and usage of AssertionConsumerService.

The issue I'm facing here is that I want to use passport-SAML to authenticate via an ISAM instance (IBM Security Access Manager).
And there is another issue in the way: the backend that is supposed to process the request and forward it to ISAM, is behind an API Gateway (which acts as a balancer and adds an additional layer of security). When I generate the metadata.xml file for the Strategy in the backend (in order to configure the SP) I get the hostname for the APIGW in the AssertionConsumerService field, instead of the backend hostname.
Because if this, when I try to login, instread of being redirected to the ISAM landing page, I got an error with the following message: The specifications for the SAML2.AssertionConsumerService endpoint are not valid.

That was why I tried to get rid of the AssertionConsumerService entry in the first place. But seing that it is a mandatory field, my question is: does anyone have any suggestion on what to try to get this scenario working? I run out of ideas long time ago, and I think there is something I'm defnintely doing wrong in all this .

Thanks so much for your help, and regards.
Álex

[cjbarth]

I wouldn't normally suggest it, but you can capture the metadata and modify it how you need and then pass that along to the service for federation. The two don't need to be linked in real-time. Also, you might find that working with node-saml might work better for you if you aren't using Passport.