diff --git a/docs/adfs/README.md b/docs/adfs/README.md index 3472df32..c076d546 100644 --- a/docs/adfs/README.md +++ b/docs/adfs/README.md @@ -56,7 +56,8 @@ passport.use(new SamlStrategy( acceptedClockSkewMs: -1, identifierFormat: null, // this is configured under the Advanced tab in AD FS relying party - signatureAlgorithm: 'sha256' + signatureAlgorithm: 'sha256', + comparisonType: 'exact', // default to exact RequestedAuthnContext Comparison Type }, function(profile, done) { return done(null, diff --git a/lib/passport-saml/saml.js b/lib/passport-saml/saml.js index 8fe7e80c..1c022ccb 100644 --- a/lib/passport-saml/saml.js +++ b/lib/passport-saml/saml.js @@ -80,6 +80,17 @@ SAML.prototype.initialize = function (options) { options.signatureAlgorithm = 'sha1'; } + /** + * List of possible values: + * - exact : Assertion context must exactly match a context in the list + * - minimum: Assertion context must be at least as strong as a context in the list + * - maximum: Assertion context must be no stronger than a context in the list + * - better: Assertion context must be stronger than all contexts in the list + */ + if (!options.comparisonType || ['exact','minimum','maximum','better'].indexOf(options.comparisonType) === -1){ + options.comparisonType = 'exact'; + } + return options; }; @@ -202,7 +213,7 @@ SAML.prototype.generateAuthorizeRequest = function (req, isPassive, callback) { request['samlp:AuthnRequest']['samlp:RequestedAuthnContext'] = { '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol', - '@Comparison': 'exact', + '@Comparison': self.options.comparisonType, 'saml:AuthnContextClassRef': authnContextClassRefs }; } diff --git a/test/tests.js b/test/tests.js index 08e190c0..082aec6e 100644 --- a/test/tests.js +++ b/test/tests.js @@ -1353,6 +1353,19 @@ describe( 'passport-saml /', function() { done(); }); + + it('should check the value of the option `comparisonType`', function(done) { + var samlObjBadComparisonType = new SAML({ comparisonType: 'bad_value' }); + should.equal(samlObjBadComparisonType.options.comparisonType, 'exact', ['the default value of the option `comparisonType` must be exact']); + + var validComparisonTypes = ['exact','minimum','maximum','better'], samlObjValidComparisonType; + validComparisonTypes.forEach(function(comparisonType) { + samlObjValidComparisonType = new SAML( {comparisonType: comparisonType} ); + should.equal(samlObjValidComparisonType.options.comparisonType, comparisonType); + }); + done(); + }); + }); describe( 'InResponseTo validation checks /', function(){