From 688f8d5f095438324292cf03b215bc40d8459ffe Mon Sep 17 00:00:00 2001
From: Chris Barth <chrisjbarth@hotmail.com>
Date: Sat, 30 Jan 2021 13:37:57 -0500
Subject: [PATCH 1/2] Format code and enforce code style on PR

---
 .eslintrc                                    |    3 +-
 .github/ISSUE_TEMPLATE/bug-report.md         |    8 +-
 .github/ISSUE_TEMPLATE/feature_request.md    |    3 +-
 .github/pull_request_template.md             |    8 +-
 .github/workflows/workflow.yml               |   20 +-
 README.md                                    |  187 +-
 docs/adfs/README.md                          |   72 +-
 docs/xml-signing-example.js                  |   54 +-
 multiSamlStrategy.d.ts                       |    4 +-
 multiSamlStrategy.js                         |    2 +-
 package-lock.json                            |   16 +
 package.json                                 |    9 +-
 src/passport-saml/algorithms.ts              |   44 +-
 src/passport-saml/index.ts                   |   29 +-
 src/passport-saml/inmemory-cache-provider.ts |  171 +-
 src/passport-saml/multiSamlStrategy.ts       |   82 +-
 src/passport-saml/saml-post-signing.ts       |   52 +-
 src/passport-saml/saml.ts                    | 1404 ++++--
 src/passport-saml/strategy.ts                |  150 +-
 src/passport-saml/types.ts                   |  190 +-
 test/mocha.opts                              |    3 +-
 test/multiSamlStrategy.js                    |  256 +-
 test/saml-post-signing-tests.js              |  107 +-
 test/samlTests.js                            |  152 +-
 test/test-signatures.js                      |  344 +-
 test/tests.js                                | 4694 ++++++++++--------
 tsconfig.json                                |   35 +-
 27 files changed, 4841 insertions(+), 3258 deletions(-)

diff --git a/.eslintrc b/.eslintrc
index c0476488..7dc76aad 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -17,7 +17,6 @@
     "prettier"
   ],
   "rules": {
-    "no-console": "warn",
-    "prettier/prettier": "warn"
+    "no-console": "warn"
   }
 }
diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md
index b418d5d0..859eb592 100644
--- a/.github/ISSUE_TEMPLATE/bug-report.md
+++ b/.github/ISSUE_TEMPLATE/bug-report.md
@@ -3,8 +3,7 @@ name: Bug report
 about: Create a report to help us improve
 title: "[BUG]"
 labels: bug
-assignees: ''
-
+assignees: ""
 ---
 
 <!--
@@ -39,5 +38,6 @@ Steps to reproduce the behavior. Ideally, expressesd through an automated test.
 A clear and concise description of what you expected to happen.
 
 **Environment**
- - Node.js version:
- - passport-saml version:
+
+- Node.js version:
+- passport-saml version:
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index 689f322c..3b981ea6 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -3,8 +3,7 @@ name: Feature request
 about: Suggest an idea for this project
 title: "[ENHANCE]"
 labels: enhancement
-assignees: ''
-
+assignees: ""
 ---
 
 <!--
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 09c4055f..891c676d 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -12,7 +12,7 @@ _Please include tests._ Doing so will ensure that the changes made in this PR ar
 
 # Checklist:
 
- - Issue Addressed: [ ]
- - Link to SAML spec: [ ]
- - Tests included? [ ]
- - Documentation updated? [ ]
+- Issue Addressed: [ ]
+- Link to SAML spec: [ ]
+- Tests included? [ ]
+- Documentation updated? [ ]
diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index f65dc3d6..be717eda 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -4,7 +4,6 @@ on: [push]
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     strategy:
@@ -12,13 +11,12 @@ jobs:
         node-version: [10.x, 12.x, 14.x]
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: npm install
-    - run: npm run lint
-    - run: npm test
-      env:
-        CI: true
+      - uses: actions/checkout@v2
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci
+      - run: npm test
+        env:
+          CI: true
diff --git a/README.md b/README.md
index 4afd09d9..58d03721 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
-Passport-SAML
-=============
+# Passport-SAML
+
 [![Build Status](https://github.com/node-saml/passport-saml/workflows/Build%20Status/badge.svg)](https://github.com/node-saml/passport-saml/actions?query=workflow%3ABuild%Status) [![GitHub version](https://badge.fury.io/gh/node-saml%2Fpassport-saml.svg)](https://badge.fury.io/gh/node-saml%2Fpassport-saml) [![npm version](https://badge.fury.io/js/passport-saml.svg)](http://badge.fury.io/js/passport-saml) [![NPM](https://nodei.co/npm/passport-saml.png?downloads=true&downloadRank=true&stars=true)](https://nodei.co/npm/passport-saml/) [![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)
 
 This is a [SAML 2.0](http://en.wikipedia.org/wiki/SAML_2.0) authentication provider for [Passport](http://passportjs.org/), the Node.js authentication library.
@@ -11,7 +11,9 @@ Passport-SAML has been tested to work with Onelogin, Okta, Shibboleth, [SimpleSA
 ## Installation
 
     $ npm install passport-saml
+
 /
+
 ## Usage
 
 The examples utilize the [Feide OpenIdp identity provider](https://openidp.feide.no/). You need an account there to log in with this. You also need to [register your site](https://openidp.feide.no/simplesaml/module.php/metaedit/index.php) as a service provider.
@@ -71,6 +73,7 @@ passport.use(new MultiSamlStrategy(
   })
 );
 ```
+
 The options passed when the `MultiSamlStrategy` is initialized are also passed as default values to each provider.
 e.g. If you provide an `issuer` on `MultiSamlStrategy`, this will be also a default value for every provider.
 You can override these defaults by passing a new value through the `getSamlOptions` function.
@@ -79,7 +82,6 @@ Using multiple providers supports `validateInResponseTo`, but all the `InRespons
 
 > :warning: **There's a race condition [bug](https://github.com/node-saml/passport-saml/issues/425) in versions < 1.3.3 which makes it vulnerable to DOS attacks**: Please use > 1.3.3 if you want to use this issue
 
-
 #### The profile object:
 
 The profile object referenced above contains the following:
@@ -92,53 +94,54 @@ type Profile = {
   nameIDFormat?: string;
   nameQualifier?: string;
   spNameQualifier?: string;
-  mail?: string;  // InCommon Attribute urn:oid:0.9.2342.19200300.100.1.3
-  email?: string;  // `mail` if not present in the assertion
-  getAssertionXml(): string;  // get the raw assertion XML
-  getAssertion(): object;  // get the assertion XML parsed as a JavaScript object
+  mail?: string; // InCommon Attribute urn:oid:0.9.2342.19200300.100.1.3
+  email?: string; // `mail` if not present in the assertion
+  getAssertionXml(): string; // get the raw assertion XML
+  getAssertion(): object; // get the assertion XML parsed as a JavaScript object
   getSamlResponseXml(): string; // get the raw SAML response XML
   ID?: string;
 } & {
-  [attributeName: string]: unknown;  // arbitrary `AttributeValue`s
-}
+  [attributeName: string]: unknown; // arbitrary `AttributeValue`s
+};
 ```
 
 #### Config parameter details:
 
- * **Core**
-  * `callbackUrl`: full callbackUrl (overrides path/protocol if supplied)
-  * `path`: path to callback; will be combined with protocol and server host information to construct callback url if `callbackUrl` is not specified (default: `/saml/consume`)
-  * `protocol`: protocol for callback; will be combined with path and server host information to construct callback url if `callbackUrl` is not specified (default: `http://`)
-  * `host`: host for callback; will be combined with path and protocol to construct callback url if `callbackUrl` is not specified (default: `localhost`)
-  * `entryPoint`: identity provider entrypoint (is required to be spec-compliant when the request is signed)
-  * `issuer`: issuer string to supply to identity provider
-  * `audience`: expected saml response Audience (if not provided, Audience won't be verified)
-  * `cert`: the IDP's public signing certificate used to validate the signatures of the incoming SAML Responses, see [Security and signatures](#security-and-signatures)
-  * `privateKey`: see [Security and signatures](#security-and-signatures). Old name of `privateCert` is accepted alternative.
-  * `decryptionPvk`: optional private key that will be used to attempt to decrypt any encrypted assertions that are received
-  * `signatureAlgorithm`: optionally set the signature algorithm for signing requests, valid values are 'sha1' (default), 'sha256', or 'sha512'
-  * `digestAlgorithm`: optionally set the digest algorithm used to provide a digest for the signed data object, valid values are 'sha1' (default), 'sha256', or 'sha512'
-  * `xmlSignatureTransforms`: optionally set an array of signature transforms to be used in HTTP-POST signatures. By default this is `[ 'http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#' ]`
- * **Additional SAML behaviors**
-  * `additionalParams`: dictionary of additional query params to add to all requests; if an object with this key is passed to `authenticate`, the dictionary of additional query params will be appended to those present on the returned URL, overriding any specified by initialization options' additional parameters (`additionalParams`, `additionalAuthorizeParams`, and `additionalLogoutParams`)
-  * `additionalAuthorizeParams`: dictionary of additional query params to add to 'authorize' requests
-  * `identifierFormat`: if truthy, name identifier format to request from identity provider (default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`)
-  * `acceptedClockSkewMs`: Time in milliseconds of skew that is acceptable between client and server when checking `OnBefore` and `NotOnOrAfter` assertion condition validity timestamps.  Setting to `-1` will disable checking these conditions entirely.  Default is `0`.
-  * `attributeConsumingServiceIndex`: optional `AttributeConsumingServiceIndex` attribute to add to AuthnRequest to instruct the IDP which attribute set to attach to the response ([link](http://blog.aniljohn.com/2014/01/data-minimization-front-channel-saml-attribute-requests.html))
-  * `disableRequestedAuthnContext`: if truthy, do not request a specific authentication context. This is [known to help when authenticating against Active Directory](https://github.com/node-saml/passport-saml/issues/226) (AD FS) servers.
-  * `authnContext`: if truthy, name identifier format to request auth context (default: `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`); array of values is also supported
-  * `RACComparison`: Requested Authentication Context comparison type. Possible values are 'exact','minimum','maximum','better'. Default is 'exact'.
-
-  * `forceAuthn`: if set to true, the initial SAML request from the service provider specifies that the IdP should force re-authentication of the user, even if they possess a valid session.
-  * `providerName`: optional human-readable name of the requester for use by the presenter's user agent or the identity provider
-  * `skipRequestCompression`: if set to true, the SAML request from the service provider won't be compressed.
-  * `authnRequestBinding`: if set to `HTTP-POST`, will request authentication from IDP via HTTP POST binding, otherwise defaults to HTTP Redirect
-  * `disableRequestACSUrl`: if truthy, SAML AuthnRequest from the service provider will not include the optional AssertionConsumerServiceURL. Default is falsy so it is automatically included.
-  * `scoping`: An optional configuration which implements the functionality [explained in the SAML spec paragraph "3.4.1.2 Element <Scoping>"](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf). The config object is structured as following:
+- **Core**
+- `callbackUrl`: full callbackUrl (overrides path/protocol if supplied)
+- `path`: path to callback; will be combined with protocol and server host information to construct callback url if `callbackUrl` is not specified (default: `/saml/consume`)
+- `protocol`: protocol for callback; will be combined with path and server host information to construct callback url if `callbackUrl` is not specified (default: `http://`)
+- `host`: host for callback; will be combined with path and protocol to construct callback url if `callbackUrl` is not specified (default: `localhost`)
+- `entryPoint`: identity provider entrypoint (is required to be spec-compliant when the request is signed)
+- `issuer`: issuer string to supply to identity provider
+- `audience`: expected saml response Audience (if not provided, Audience won't be verified)
+- `cert`: the IDP's public signing certificate used to validate the signatures of the incoming SAML Responses, see [Security and signatures](#security-and-signatures)
+- `privateKey`: see [Security and signatures](#security-and-signatures). Old name of `privateCert` is accepted alternative.
+- `decryptionPvk`: optional private key that will be used to attempt to decrypt any encrypted assertions that are received
+- `signatureAlgorithm`: optionally set the signature algorithm for signing requests, valid values are 'sha1' (default), 'sha256', or 'sha512'
+- `digestAlgorithm`: optionally set the digest algorithm used to provide a digest for the signed data object, valid values are 'sha1' (default), 'sha256', or 'sha512'
+- `xmlSignatureTransforms`: optionally set an array of signature transforms to be used in HTTP-POST signatures. By default this is `[ 'http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#' ]`
+- **Additional SAML behaviors**
+- `additionalParams`: dictionary of additional query params to add to all requests; if an object with this key is passed to `authenticate`, the dictionary of additional query params will be appended to those present on the returned URL, overriding any specified by initialization options' additional parameters (`additionalParams`, `additionalAuthorizeParams`, and `additionalLogoutParams`)
+- `additionalAuthorizeParams`: dictionary of additional query params to add to 'authorize' requests
+- `identifierFormat`: if truthy, name identifier format to request from identity provider (default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`)
+- `acceptedClockSkewMs`: Time in milliseconds of skew that is acceptable between client and server when checking `OnBefore` and `NotOnOrAfter` assertion condition validity timestamps. Setting to `-1` will disable checking these conditions entirely. Default is `0`.
+- `attributeConsumingServiceIndex`: optional `AttributeConsumingServiceIndex` attribute to add to AuthnRequest to instruct the IDP which attribute set to attach to the response ([link](http://blog.aniljohn.com/2014/01/data-minimization-front-channel-saml-attribute-requests.html))
+- `disableRequestedAuthnContext`: if truthy, do not request a specific authentication context. This is [known to help when authenticating against Active Directory](https://github.com/node-saml/passport-saml/issues/226) (AD FS) servers.
+- `authnContext`: if truthy, name identifier format to request auth context (default: `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`); array of values is also supported
+- `RACComparison`: Requested Authentication Context comparison type. Possible values are 'exact','minimum','maximum','better'. Default is 'exact'.
+
+- `forceAuthn`: if set to true, the initial SAML request from the service provider specifies that the IdP should force re-authentication of the user, even if they possess a valid session.
+- `providerName`: optional human-readable name of the requester for use by the presenter's user agent or the identity provider
+- `skipRequestCompression`: if set to true, the SAML request from the service provider won't be compressed.
+- `authnRequestBinding`: if set to `HTTP-POST`, will request authentication from IDP via HTTP POST binding, otherwise defaults to HTTP Redirect
+- `disableRequestACSUrl`: if truthy, SAML AuthnRequest from the service provider will not include the optional AssertionConsumerServiceURL. Default is falsy so it is automatically included.
+- `scoping`: An optional configuration which implements the functionality [explained in the SAML spec paragraph "3.4.1.2 Element <Scoping>"](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf). The config object is structured as following:
+
 ```javascript
 {
   idpList: [ // optional
-    { 
+    {
       entries: [ // required
         {
           providerId: 'yourProviderId', // required for each entry
@@ -153,22 +156,22 @@ type Profile = {
   requesterId: 'requesterId', // optional
 }
 ```
- * **InResponseTo Validation**
-  * `validateInResponseTo`: if truthy, then InResponseTo will be validated from incoming SAML responses
-  * `requestIdExpirationPeriodMs`: Defines the expiration time when a Request ID generated for a SAML request will not be valid if seen in a SAML response in the `InResponseTo` field.  Default is 8 hours.
-  * `cacheProvider`: Defines the implementation for a cache provider used to store request Ids generated in SAML requests as part of `InResponseTo` validation.  Default is a built-in in-memory cache provider.  For details see the 'Cache Provider' section.
- * **Issuer Validation**
-  * `idpIssuer`: if provided, then the IdP issuer will be validated for incoming Logout Requests/Responses. For ADFS this looks like `https://acme_tools.windows.net/deadbeef`
- * **Passport**
-  * `passReqToCallback`: if truthy, `req` will be passed as the first argument to the verify callback (default: `false`)
-  * `name`: Optionally, provide a custom name. (default: `saml`). Useful If you want to instantiate the strategy multiple times with different configurations,
-            allowing users to authenticate against multiple different SAML targets from the same site. You'll need to use a unique set of URLs
-            for each target, and use this custom name when calling `passport.authenticate()` as well.
- * **Logout**
-  * `logoutUrl`: base address to call with logout requests (default: `entryPoint`)
-  * `additionalLogoutParams`: dictionary of additional query params to add to 'logout' requests
-  * `logoutCallbackUrl`: The value with which to populate the `Location` attribute in the `SingleLogoutService` elements in the generated service provider metadata.
 
+- **InResponseTo Validation**
+- `validateInResponseTo`: if truthy, then InResponseTo will be validated from incoming SAML responses
+- `requestIdExpirationPeriodMs`: Defines the expiration time when a Request ID generated for a SAML request will not be valid if seen in a SAML response in the `InResponseTo` field. Default is 8 hours.
+- `cacheProvider`: Defines the implementation for a cache provider used to store request Ids generated in SAML requests as part of `InResponseTo` validation. Default is a built-in in-memory cache provider. For details see the 'Cache Provider' section.
+- **Issuer Validation**
+- `idpIssuer`: if provided, then the IdP issuer will be validated for incoming Logout Requests/Responses. For ADFS this looks like `https://acme_tools.windows.net/deadbeef`
+- **Passport**
+- `passReqToCallback`: if truthy, `req` will be passed as the first argument to the verify callback (default: `false`)
+- `name`: Optionally, provide a custom name. (default: `saml`). Useful If you want to instantiate the strategy multiple times with different configurations,
+  allowing users to authenticate against multiple different SAML targets from the same site. You'll need to use a unique set of URLs
+  for each target, and use this custom name when calling `passport.authenticate()` as well.
+- **Logout**
+- `logoutUrl`: base address to call with logout requests (default: `entryPoint`)
+- `additionalLogoutParams`: dictionary of additional query params to add to 'logout' requests
+- `logoutCallbackUrl`: The value with which to populate the `Location` attribute in the `SingleLogoutService` elements in the generated service provider metadata.
 
 ### Provide the authentication callback
 
@@ -177,13 +180,14 @@ You need to provide a route corresponding to the `path` configuration parameter
 The authentication callback must be invoked after the `body-parser` middlerware.
 
 ```javascript
-const bodyParser = require('body-parser');
+const bodyParser = require("body-parser");
 
-app.post('/login/callback',
+app.post(
+  "/login/callback",
   bodyParser.urlencoded({ extended: false }),
-  passport.authenticate('saml', { failureRedirect: '/', failureFlash: true }),
-  function(req, res) {
-    res.redirect('/');
+  passport.authenticate("saml", { failureRedirect: "/", failureFlash: true }),
+  function (req, res) {
+    res.redirect("/");
   }
 );
 ```
@@ -193,10 +197,11 @@ app.post('/login/callback',
 Use `passport.authenticate()`, specifying `saml` as the strategy:
 
 ```javascript
-app.get('/login',
-  passport.authenticate('saml', { failureRedirect: '/', failureFlash: true }),
-  function(req, res) {
-    res.redirect('/');
+app.get(
+  "/login",
+  passport.authenticate("saml", { failureRedirect: "/", failureFlash: true }),
+  function (req, res) {
+    res.redirect("/");
   }
 );
 ```
@@ -204,18 +209,20 @@ app.get('/login',
 ...or, if you wish to add or override query string parameters:
 
 ```javascript
-app.get('/login',
-  passport.authenticate('saml', { additionalParams: { 'username': 'user@domain.com' }}),
-  function(req, res) {
-    res.redirect('/');
+app.get(
+  "/login",
+  passport.authenticate("saml", {
+    additionalParams: { username: "user@domain.com" },
+  }),
+  function (req, res) {
+    res.redirect("/");
   }
 );
 ```
 
 ### generateServiceProviderMetadata( decryptionCert, signingCert )
 
-
-As a convenience, the strategy object exposes a `generateServiceProviderMetadata` method which will generate a service provider metadata document suitable for supplying to an identity provider.  This method will only work on strategies which are configured with a `callbackUrl` (since the relative path for the callback is not sufficient information to generate a complete metadata document).
+As a convenience, the strategy object exposes a `generateServiceProviderMetadata` method which will generate a service provider metadata document suitable for supplying to an identity provider. This method will only work on strategies which are configured with a `callbackUrl` (since the relative path for the callback is not sufficient information to generate a complete metadata document).
 
 The `decryptionCert` argument should be a public certificate matching the `decryptionPvk` and is required if the strategy is configured with a `decryptionPvk`.
 
@@ -223,12 +230,11 @@ The `signingCert` argument should be a public certificate matching the `privateC
 
 The `generateServiceProviderMetadata` method is also available on the `MultiSamlStrategy`, but needs an extra request and a callback argument (`generateServiceProviderMetadata( req, decryptionCert, signingCert, next )`), which are passed to the `getSamlOptions` to retrieve the correct configuration.
 
-
 ## Security and signatures
 
 Passport-SAML uses the HTTP Redirect Binding for its `AuthnRequest`s (unless overridden with the `authnRequestBinding` parameter), and expects to receive the messages back via the HTTP POST binding.
 
-Authentication requests sent by Passport-SAML can be signed using RSA signature with SHA1, SHA256 or SHA512 hashing algorithms. 
+Authentication requests sent by Passport-SAML can be signed using RSA signature with SHA1, SHA256 or SHA512 hashing algorithms.
 
 To select hashing algorithm, use:
 
@@ -252,12 +258,14 @@ Formats supported for `privateKey` field are,
 -----END PRIVATE KEY-----
 
 ```
+
 ```
 -----BEGIN RSA PRIVATE KEY-----
 <private key contents here delimited at 64 characters per row>
 -----END RSA PRIVATE KEY-----
 
 ```
+
 (both versions work)
 See example from tests of the first version of [well formatted private key](test/static/acme_tools_com.key).
 
@@ -268,29 +276,31 @@ See example from tests of [singleline private key](test/static/singleline_acme_t
 Add it to strategy options like this:
 
 ```javascript
-    privateCert: fs.readFileSync('./privateCert.pem', 'utf-8')
+privateCert: fs.readFileSync("./privateCert.pem", "utf-8");
 ```
 
-
 It is a good idea to validate the signatures of the incoming SAML Responses. For this, you can provide the Identity Provider's public PEM-encoded X.509 signing certificate using the `cert` configuration key. The "BEGIN CERTIFICATE" and "END CERTIFICATE" lines should be stripped out and the certificate should be provided on a single line.
 
 ```javascript
-    cert: 'MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W=='
+cert: "MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==";
 ```
 
 If you have a certificate in the binary DER encoding, you can convert it to the necessary PEM encoding like this:
 
 ```bash
      openssl x509 -inform der -in my_certificate.cer -out my_certificate.pem
-````
+```
 
 If the Identity Provider has multiple signing certificates that are valid (such as during the rolling from an old key to a new key and responses signed with either key are valid) then the `cert` configuration key can be an array:
 
 ```javascript
-    cert: [ 'MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==', 'MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6M ... g=' ]
+cert: [
+  "MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==",
+  "MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6M ... g=",
+];
 ```
 
-The `cert` configuration key can also be a function that receives a callback as argument calls back a possible error and a  certificate or array of certificates.  This allows the Identity Provider to be polled for valid certificates and the new certificate can be used if it is changed:
+The `cert` configuration key can also be a function that receives a callback as argument calls back a possible error and a certificate or array of certificates. This allows the Identity Provider to be polled for valid certificates and the new certificate can be used if it is changed:
 
 ```javascript
     cert: function(callback) { callback(null,polledCertificates); }
@@ -318,7 +328,7 @@ For more detailed instructions, see [ADFS documentation](docs/adfs/README.md).
 ## SAML Response Validation - NotBefore and NotOnOrAfter
 
 If the `NotBefore` or the `NotOnOrAfter` attributes are returned in the SAML response, Passport-SAML will validate them
-against the current time +/- a configurable clock skew value.  The default for the skew is 0s.  This is to account for
+against the current time +/- a configurable clock skew value. The default for the skew is 0s. This is to account for
 differences between the clock time on the client (Node server with Passport-SAML) and the server (Identity provider).
 
 `NotBefore` and `NotOnOrAfter` can be part of either the `SubjectConfirmation` element, or within in the `Assertion/Conditions` element
@@ -332,18 +342,18 @@ Validation will succeed if Passport-SAML previously generated a SAML request wit
 Also note that `InResponseTo` is validated as an attribute of the top level `Response` element in the SAML response, as well
 as part of the `SubjectConfirmation` element.
 
-Previous request id's generated for SAML requests will eventually expire.  This is controlled with the `requestIdExpirationPeriodMs` option
-passed into the Passport-SAML config.  The default is 28,800,000 ms (8 hours).  Once expired, a subsequent SAML response
+Previous request id's generated for SAML requests will eventually expire. This is controlled with the `requestIdExpirationPeriodMs` option
+passed into the Passport-SAML config. The default is 28,800,000 ms (8 hours). Once expired, a subsequent SAML response
 received with an `InResponseTo` equal to the expired id will not validate and an error will be returned.
 
 ## Cache Provider
 
-When `InResponseTo` validation is turned on, Passport-SAML will store generated request ids used in SAML requests to the IdP.  The implementation
+When `InResponseTo` validation is turned on, Passport-SAML will store generated request ids used in SAML requests to the IdP. The implementation
 of how things are stored, checked to see if they exist, and eventually removed is from the Cache Provider used by Passport-SAML.
 
-The default implementation is a simple in-memory cache provider.  For multiple server/process scenarios, this will not be sufficient as
+The default implementation is a simple in-memory cache provider. For multiple server/process scenarios, this will not be sufficient as
 the server/process that generated the request id and stored in memory could be different than the server/process handling the
-SAML response.  The `InResponseTo` could fail in this case erroneously.
+SAML response. The `InResponseTo` could fail in this case erroneously.
 
 To support this scenario you can provide an implementation for a cache provider by providing an object with following functions:
 
@@ -363,6 +373,7 @@ To support this scenario you can provide an implementation for a cache provider
 ```
 
 The `callback` argument is a function in the style of normal Node callbacks:
+
 ```
 function callback(err, result)
 {
@@ -375,11 +386,11 @@ Provide an instance of an object which has these functions passed to the `cacheP
 ## SLO (single logout)
 
 Passport-SAML has built in support for SLO including
-* Signature validation
-* IdP initiated and SP initiated logouts
-* Decryption of encrypted name identifiers in IdP initiated logout
-* `Redirect` and `POST` SAML Protocol Bindings
 
+- Signature validation
+- IdP initiated and SP initiated logouts
+- Decryption of encrypted name identifiers in IdP initiated logout
+- `Redirect` and `POST` SAML Protocol Bindings
 
 ## ChangeLog
 
diff --git a/docs/adfs/README.md b/docs/adfs/README.md
index 609d2659..e3b293dc 100644
--- a/docs/adfs/README.md
+++ b/docs/adfs/README.md
@@ -1,5 +1,4 @@
-Active Directory Federation Services
-====================================
+# Active Directory Federation Services
 
 This document attempts to describe a complete solution for integrating with AD FS.
 
@@ -11,13 +10,13 @@ Download [mellon_create_metadata.sh](https://github.com/UNINETT/mod_auth_mellon/
 
 Create a new key, certificate and relying party XML as follows:
 
-  ./mellon_create_metadata.sh acme_tools_com https://acme_tools.com/adfs/postResponse
+./mellon_create_metadata.sh acme_tools_com https://acme_tools.com/adfs/postResponse
 
 ## Retrieve AD FS Certificate
 
 Use retrieve_adfs_certificate.sh to get your AD FS server's signing certificate:
 
-  ./retrieve_adfs_certificate.sh https://adfs.acme_tools.com/ > adfs.acme_tools.com.crt
+./retrieve_adfs_certificate.sh https://adfs.acme_tools.com/ > adfs.acme_tools.com.crt
 
 # Create Relying Party
 
@@ -30,44 +29,44 @@ This example assumes you will pass in the UPN.
 Create a separate file for passport configuration (assumed to be config/passport.js).
 
 ```javascript
-var
-  fs = require('fs')
-  , passport = require('passport')
-  , SamlStrategy = require('passport-saml').Strategy
-;
-
-passport.serializeUser(function(user, done) {
+var fs = require("fs"),
+  passport = require("passport"),
+  SamlStrategy = require("passport-saml").Strategy;
+passport.serializeUser(function (user, done) {
   done(null, user);
 });
-passport.deserializeUser(function(user, done) {
+passport.deserializeUser(function (user, done) {
   done(null, user);
 });
 
-passport.use(new SamlStrategy(
-  {
-    entryPoint: 'https://adfs.acme_tools.com/adfs/ls/',
-    issuer: 'acme_tools_com',
-    callbackUrl: 'https://acme_tools.com/adfs/postResponse',
-    privateCert: fs.readFileSync('/path/to/acme_tools_com.key', 'utf-8'),
-    cert: fs.readFileSync('/path/to/adfs.acme_tools.com.crt', 'utf-8'),
-  // other authn contexts are available e.g. windows single sign-on
-    authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
-  // not sure if this is necessary?
-    acceptedClockSkewMs: -1,
-    identifierFormat: null,
-  // this is configured under the Advanced tab in AD FS relying party
-    signatureAlgorithm: 'sha256',
-    RACComparison: 'exact', // default to exact RequestedAuthnContext Comparison Type
-  },
-  function(profile, done) {
-    return done(null,
-      {
-        upn: profile['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn'],
+passport.use(
+  new SamlStrategy(
+    {
+      entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
+      issuer: "acme_tools_com",
+      callbackUrl: "https://acme_tools.com/adfs/postResponse",
+      privateCert: fs.readFileSync("/path/to/acme_tools_com.key", "utf-8"),
+      cert: fs.readFileSync("/path/to/adfs.acme_tools.com.crt", "utf-8"),
+      // other authn contexts are available e.g. windows single sign-on
+      authnContext:
+        "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
+      // not sure if this is necessary?
+      acceptedClockSkewMs: -1,
+      identifierFormat: null,
+      // this is configured under the Advanced tab in AD FS relying party
+      signatureAlgorithm: "sha256",
+      RACComparison: "exact", // default to exact RequestedAuthnContext Comparison Type
+    },
+    function (profile, done) {
+      return done(null, {
+        upn:
+          profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"],
         // e.g. if you added a Group claim
-        group: profile['http://schemas.xmlsoap.org/claims/Group']
-    });
-  }
-));
+        group: profile["http://schemas.xmlsoap.org/claims/Group"],
+      });
+    }
+  )
+);
 
 module.exports = passport;
 ```
@@ -110,6 +109,7 @@ module.exports = passport;
 
   var server = http.createServer(app);
 ```
+
 # Troubleshooting
 
 ## ADFS 2016
diff --git a/docs/xml-signing-example.js b/docs/xml-signing-example.js
index 4a4ef8cb..c1503d1f 100644
--- a/docs/xml-signing-example.js
+++ b/docs/xml-signing-example.js
@@ -1,41 +1,47 @@
 // This will help generate signing info for test cases.
 // Simply fill in the data and run it to get <DigestValue /> and <SignatureValue />.
 
-const crypto = require('crypto')
+const crypto = require("crypto");
 
 const private_key = `-----BEGIN PRIVATE KEY-----
 
 -----END PRIVATE KEY-----
-`
+`;
 
 const cert = `-----BEGIN CERTIFICATE-----
 
 -----END CERTIFICATE-----
-`
+`;
 
-const saml_message = ``
+const saml_message = ``;
 
-const signed_info = `<SignedInfo...</SignedInfo>`
+const signed_info = `<SignedInfo...</SignedInfo>`;
 
-const signer = crypto.createSign('RSA-SHA1');
+const signer = crypto.createSign("RSA-SHA1");
 signer.update(signed_info);
 signer.end();
 
-const signature = signer.sign(private_key)
-const signature_b64 = signature.toString('base64')
-
-const verifier = crypto.createVerify('RSA-SHA1')
-verifier.update(signed_info)
-verifier.end()
-
-const verified = verifier.verify(cert, signature)
-
-const hash = crypto.createHash('RSA-SHA1')
-hash.update(saml_message, 'utf8')
-const digest_b64 = hash.digest('base64')
-
-console.log(JSON.stringify({
-	signature: signature_b64,
-	digest: digest_b64,
-	verified: verified,
-}, null, 2))
+const signature = signer.sign(private_key);
+const signature_b64 = signature.toString("base64");
+
+const verifier = crypto.createVerify("RSA-SHA1");
+verifier.update(signed_info);
+verifier.end();
+
+const verified = verifier.verify(cert, signature);
+
+const hash = crypto.createHash("RSA-SHA1");
+hash.update(saml_message, "utf8");
+const digest_b64 = hash.digest("base64");
+
+console.log(
+  JSON.stringify(
+    {
+      signature: signature_b64,
+      digest: digest_b64,
+      verified: verified,
+    },
+    null,
+    2
+  )
+);
diff --git a/multiSamlStrategy.d.ts b/multiSamlStrategy.d.ts
index 8230dd39..888696c5 100644
--- a/multiSamlStrategy.d.ts
+++ b/multiSamlStrategy.d.ts
@@ -1,2 +1,2 @@
-import * as MultiSAMLStrategy from './lib/passport-saml/multiSamlStrategy';
-export = MultiSAMLStrategy;
\ No newline at end of file
+import * as MultiSAMLStrategy from "./lib/passport-saml/multiSamlStrategy";
+export = MultiSAMLStrategy;
diff --git a/multiSamlStrategy.js b/multiSamlStrategy.js
index 1c327dbd..d0abf8fd 100644
--- a/multiSamlStrategy.js
+++ b/multiSamlStrategy.js
@@ -1,2 +1,2 @@
-const MultiSamlStrategy = require('./lib/passport-saml/multiSamlStrategy.js');
+const MultiSamlStrategy = require("./lib/passport-saml/multiSamlStrategy.js");
 module.exports = MultiSamlStrategy;
diff --git a/package-lock.json b/package-lock.json
index afb14859..2e5e22fa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1053,6 +1053,16 @@
         "readdirp": "~3.5.0"
       }
     },
+    "choma": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/choma/-/choma-1.2.1.tgz",
+      "integrity": "sha512-4KwEouEHt6SfG8vYnN2gSJfq/cGmnY2gubnUgsgkRXzHoSRAgluX2YXQgDg6bTDWuOmUrTb/cfwMpNlvnnPZCg==",
+      "dev": true,
+      "requires": {
+        "chalk": "^2.3.2",
+        "seedrandom": "^2.4.3"
+      }
+    },
     "ci-info": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-2.0.0.tgz",
@@ -8188,6 +8198,12 @@
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
       "integrity": "sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw=="
     },
+    "seedrandom": {
+      "version": "2.4.4",
+      "resolved": "https://registry.npmjs.org/seedrandom/-/seedrandom-2.4.4.tgz",
+      "integrity": "sha512-9A+PDmgm+2du77B5i0Ip2cxOqqHjgNxnBgglxLcX78A2D6c2rTo61z4jnVABpF4cKeDMDG+cmXXvdnqse2VqMA==",
+      "dev": true
+    },
     "semver": {
       "version": "7.3.4",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.4.tgz",
diff --git a/package.json b/package.json
index 2932babd..18f19da3 100644
--- a/package.json
+++ b/package.json
@@ -38,15 +38,15 @@
     "build": "tsc",
     "changelog": "gren changelog --override --generate",
     "lint": "eslint --ext .ts src",
-    "lint-watch": "onchange 'src/**/*.ts' -- eslint {{file}}",
+    "lint-watch": "onchange -k -p 100 \"**/*.ts\" -- eslint {{file}}",
     "lint:fix": "eslint --ext .ts --fix src",
     "prepare": "tsc",
     "prettier-check": "prettier --config .prettierrc.json --check .",
     "prettier-format": "prettier --config .prettierrc.json --write .",
-    "prettier-watch": "onchange 'src/**/*.ts' -- prettier --write {{file}}",
-    "test": "npm run lint && npm run tsc && mocha",
+    "prettier-watch": "onchange -k -p 100 \".\" -- prettier --config .prettierrc.json --write {{file}}",
+    "test": "npm run prettier-check && npm run lint && npm run tsc && mocha",
     "tsc": "tsc",
-    "tsc-watch": "tsc && tsc --watch",
+    "tsc-watch": "tsc --watch",
     "watch": "concurrently --kill-others \"npm:*-watch\""
   },
   "dependencies": {
@@ -69,6 +69,7 @@
     "@typescript-eslint/eslint-plugin": "^4.9.1",
     "@typescript-eslint/parser": "^4.9.1",
     "body-parser": "^1.19.0",
+    "choma": "^1.2.1",
     "concurrently": "^5.3.0",
     "eslint": "^7.15.0",
     "eslint-config-prettier": "^7.0.0",
diff --git a/src/passport-saml/algorithms.ts b/src/passport-saml/algorithms.ts
index 3405dacf..9907cc8a 100644
--- a/src/passport-saml/algorithms.ts
+++ b/src/passport-saml/algorithms.ts
@@ -1,34 +1,34 @@
-import * as crypto from 'crypto';
+import * as crypto from "crypto";
 
-export function getSigningAlgorithm (shortName: string): string {
-  switch(shortName) {
-    case 'sha256':
-      return 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
-    case 'sha512':
-      return 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512';
+export function getSigningAlgorithm(shortName: string): string {
+  switch (shortName) {
+    case "sha256":
+      return "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
+    case "sha512":
+      return "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512";
     default:
-      return 'http://www.w3.org/2000/09/xmldsig#rsa-sha1';
+      return "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
   }
 }
 
-export function getDigestAlgorithm (shortName: string): string {
-  switch(shortName) {
-    case 'sha256':
-      return 'http://www.w3.org/2001/04/xmlenc#sha256';
-    case 'sha512':
-      return 'http://www.w3.org/2001/04/xmlenc#sha512';
+export function getDigestAlgorithm(shortName: string): string {
+  switch (shortName) {
+    case "sha256":
+      return "http://www.w3.org/2001/04/xmlenc#sha256";
+    case "sha512":
+      return "http://www.w3.org/2001/04/xmlenc#sha512";
     default:
-      return 'http://www.w3.org/2000/09/xmldsig#sha1';
+      return "http://www.w3.org/2000/09/xmldsig#sha1";
   }
 }
 
-export function getSigner (shortName: string): crypto.Signer {
-  switch(shortName) {
-    case 'sha256':
-      return crypto.createSign('RSA-SHA256');
-    case 'sha512':
-      return crypto.createSign('RSA-SHA512');
+export function getSigner(shortName: string): crypto.Signer {
+  switch (shortName) {
+    case "sha256":
+      return crypto.createSign("RSA-SHA256");
+    case "sha512":
+      return crypto.createSign("RSA-SHA512");
     default:
-      return crypto.createSign('RSA-SHA1');
+      return crypto.createSign("RSA-SHA1");
   }
 }
diff --git a/src/passport-saml/index.ts b/src/passport-saml/index.ts
index 976ce744..24e48ba4 100644
--- a/src/passport-saml/index.ts
+++ b/src/passport-saml/index.ts
@@ -1,7 +1,24 @@
-import type { CacheItem, CacheProvider} from './inmemory-cache-provider';
-import { SAML } from './saml';
-import Strategy = require('./strategy');
-import MultiSamlStrategy = require('./multiSamlStrategy');
-import type { Profile, SamlConfig, VerifiedCallback, VerifyWithRequest, VerifyWithoutRequest } from './types';
+import type { CacheItem, CacheProvider } from "./inmemory-cache-provider";
+import { SAML } from "./saml";
+import Strategy = require("./strategy");
+import MultiSamlStrategy = require("./multiSamlStrategy");
+import type {
+  Profile,
+  SamlConfig,
+  VerifiedCallback,
+  VerifyWithRequest,
+  VerifyWithoutRequest,
+} from "./types";
 
-export { SAML, Strategy, MultiSamlStrategy, CacheItem, CacheProvider, Profile, SamlConfig, VerifiedCallback, VerifyWithRequest, VerifyWithoutRequest };
+export {
+  SAML,
+  Strategy,
+  MultiSamlStrategy,
+  CacheItem,
+  CacheProvider,
+  Profile,
+  SamlConfig,
+  VerifiedCallback,
+  VerifyWithRequest,
+  VerifyWithoutRequest,
+};
diff --git a/src/passport-saml/inmemory-cache-provider.ts b/src/passport-saml/inmemory-cache-provider.ts
index 2c737ff1..55ef4493 100644
--- a/src/passport-saml/inmemory-cache-provider.ts
+++ b/src/passport-saml/inmemory-cache-provider.ts
@@ -14,104 +14,105 @@
  */
 
 export interface CacheItem {
-    value: string;
-    createdAt: number;
+  value: string;
+  createdAt: number;
 }
 
 interface CacheProviderOptions {
-    keyExpirationPeriodMs: number;
+  keyExpirationPeriodMs: number;
 }
 
 export class CacheProvider {
-    cacheKeys: Record<string, CacheItem>;
-    options: CacheProviderOptions;
+  cacheKeys: Record<string, CacheItem>;
+  options: CacheProviderOptions;
 
-    constructor(options: Partial<CacheProviderOptions>) {
-        this.cacheKeys = {};
+  constructor(options: Partial<CacheProviderOptions>) {
+    this.cacheKeys = {};
 
-        if (!options) {
-            options = {};
-        }
-
-        if(!options.keyExpirationPeriodMs){
-            options.keyExpirationPeriodMs = 28800000;  // 8 hours
-        }
-
-        this.options = options as CacheProviderOptions;
-
-        // Expire old cache keys
-        const expirationTimer = setInterval(() => {
-            const nowMs = new Date().getTime();
-            const keys = Object.keys(this.cacheKeys);
-            keys.forEach((key) => {
-                if(nowMs >= new Date(this.cacheKeys[key].createdAt).getTime() + this.options.keyExpirationPeriodMs){
-                    this.remove(key, () => undefined);
-                }
-            });
-        }, this.options.keyExpirationPeriodMs);
-
-        // we only want this to run if the process is still open; it shouldn't hold the process open (issue #68)
-        //   (unref only introduced in node 0.9, so check whether we have it)
-        // Skip this in 0.10.34 due to https://github.com/joyent/node/issues/8900
-        if (expirationTimer.unref && process.version !== 'v0.10.34')
-            expirationTimer.unref();
+    if (!options) {
+      options = {};
     }
 
-    /**
-     * Store an item in the cache, using the specified key and value.
-     * Internally will keep track of the time the item was added to the cache
-     * @param id
-     * @param value
-     */
-    save(key: string, value: string, callback: (error: null, value: CacheItem | null) => void){
-        if(!this.cacheKeys[key])
-        {
-            this.cacheKeys[key] = {
-                createdAt: new Date().getTime(),
-                value: value
-            };
-
-            callback(null, this.cacheKeys[key]);
-        }
-        else
-        {
-            callback(null, null);
-        }
-
+    if (!options.keyExpirationPeriodMs) {
+      options.keyExpirationPeriodMs = 28800000; // 8 hours
     }
 
-
-    /**
-     * Returns the value of the specified key in the cache
-     * @param id
-     * @returns {boolean}
-     */
-    get(key: string, callback: (key: string | null, value: string | null) => void){
-        if(this.cacheKeys[key]){
-            callback(null, this.cacheKeys[key].value);
-        }
-        else
-        {
-            callback(null, null);
+    this.options = options as CacheProviderOptions;
+
+    // Expire old cache keys
+    const expirationTimer = setInterval(() => {
+      const nowMs = new Date().getTime();
+      const keys = Object.keys(this.cacheKeys);
+      keys.forEach((key) => {
+        if (
+          nowMs >=
+          new Date(this.cacheKeys[key].createdAt).getTime() +
+            this.options.keyExpirationPeriodMs
+        ) {
+          this.remove(key, () => undefined);
         }
-
+      });
+    }, this.options.keyExpirationPeriodMs);
+
+    // we only want this to run if the process is still open; it shouldn't hold the process open (issue #68)
+    //   (unref only introduced in node 0.9, so check whether we have it)
+    // Skip this in 0.10.34 due to https://github.com/joyent/node/issues/8900
+    if (expirationTimer.unref && process.version !== "v0.10.34")
+      expirationTimer.unref();
+  }
+
+  /**
+   * Store an item in the cache, using the specified key and value.
+   * Internally will keep track of the time the item was added to the cache
+   * @param id
+   * @param value
+   */
+  save(
+    key: string,
+    value: string,
+    callback: (error: null, value: CacheItem | null) => void
+  ) {
+    if (!this.cacheKeys[key]) {
+      this.cacheKeys[key] = {
+        createdAt: new Date().getTime(),
+        value: value,
+      };
+
+      callback(null, this.cacheKeys[key]);
+    } else {
+      callback(null, null);
     }
-
-
-    /**
-     * Removes an item from the cache if it exists
-     * @param key
-     */
-    remove(key: string, callback: (err: Error | null, key: string | null) => void){
-        if(this.cacheKeys[key])
-        {
-            delete this.cacheKeys[key];
-            callback(null, key);
-        }
-        else
-        {
-            callback(null, null);
-        }
-
+  }
+
+  /**
+   * Returns the value of the specified key in the cache
+   * @param id
+   * @returns {boolean}
+   */
+  get(
+    key: string,
+    callback: (key: string | null, value: string | null) => void
+  ) {
+    if (this.cacheKeys[key]) {
+      callback(null, this.cacheKeys[key].value);
+    } else {
+      callback(null, null);
+    }
+  }
+
+  /**
+   * Removes an item from the cache if it exists
+   * @param key
+   */
+  remove(
+    key: string,
+    callback: (err: Error | null, key: string | null) => void
+  ) {
+    if (this.cacheKeys[key]) {
+      delete this.cacheKeys[key];
+      callback(null, key);
+    } else {
+      callback(null, null);
     }
+  }
 }
diff --git a/src/passport-saml/multiSamlStrategy.ts b/src/passport-saml/multiSamlStrategy.ts
index 0f77c531..ad7e845d 100644
--- a/src/passport-saml/multiSamlStrategy.ts
+++ b/src/passport-saml/multiSamlStrategy.ts
@@ -1,51 +1,70 @@
-import * as util from 'util';
-import * as saml from './saml';
-import {CacheProvider as InMemoryCacheProvider} from './inmemory-cache-provider';
-import SamlStrategy = require('./strategy');
-import type { Request } from 'express';
-import { AuthenticateOptions, AuthorizeOptions, MultiSamlConfig, RequestWithUser, VerifyWithoutRequest, VerifyWithRequest } from './types';
+import * as util from "util";
+import * as saml from "./saml";
+import { CacheProvider as InMemoryCacheProvider } from "./inmemory-cache-provider";
+import SamlStrategy = require("./strategy");
+import type { Request } from "express";
+import {
+  AuthenticateOptions,
+  AuthorizeOptions,
+  MultiSamlConfig,
+  RequestWithUser,
+  VerifyWithoutRequest,
+  VerifyWithRequest,
+} from "./types";
 
 class MultiSamlStrategy extends SamlStrategy {
-  _options: MultiSamlConfig
-  constructor(options: MultiSamlConfig, verify: VerifyWithRequest | VerifyWithoutRequest) {
-    if (!options || typeof options.getSamlOptions != 'function') {
-      throw new Error('Please provide a getSamlOptions function');
+  _options: MultiSamlConfig;
+  constructor(
+    options: MultiSamlConfig,
+    verify: VerifyWithRequest | VerifyWithoutRequest
+  ) {
+    if (!options || typeof options.getSamlOptions != "function") {
+      throw new Error("Please provide a getSamlOptions function");
     }
 
-    if(!options.requestIdExpirationPeriodMs){
-      options.requestIdExpirationPeriodMs = 28800000;  // 8 hours
+    if (!options.requestIdExpirationPeriodMs) {
+      options.requestIdExpirationPeriodMs = 28800000; // 8 hours
     }
 
-    if(!options.cacheProvider){
-        options.cacheProvider = new InMemoryCacheProvider(
-            {keyExpirationPeriodMs: options.requestIdExpirationPeriodMs });
+    if (!options.cacheProvider) {
+      options.cacheProvider = new InMemoryCacheProvider({
+        keyExpirationPeriodMs: options.requestIdExpirationPeriodMs,
+      });
     }
 
     super(options, verify);
     this._options = options;
   }
 
-  authenticate(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions) {
+  authenticate(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions
+  ) {
     this._options.getSamlOptions(req, (err, samlOptions) => {
       if (err) {
         return this.error(err);
       }
 
-      const samlService = new saml.SAML({...this._options, ...samlOptions});
-      const strategy = Object.assign({}, this, {_saml: samlService});
+      const samlService = new saml.SAML({ ...this._options, ...samlOptions });
+      const strategy = Object.assign({}, this, { _saml: samlService });
       Object.setPrototypeOf(strategy, this);
       super.authenticate.call(strategy, req, options);
     });
   }
 
-  logout(req: RequestWithUser, callback: (err: Error | null, url?: string | null | undefined) => void) {
+  logout(
+    req: RequestWithUser,
+    callback: (err: Error | null, url?: string | null | undefined) => void
+  ) {
     this._options.getSamlOptions(req, (err, samlOptions) => {
       if (err) {
         return callback(err);
       }
 
-      const samlService = new saml.SAML(Object.assign({}, this._options, samlOptions));
-      const strategy = Object.assign({}, this, {_saml: samlService});
+      const samlService = new saml.SAML(
+        Object.assign({}, this._options, samlOptions)
+      );
+      const strategy = Object.assign({}, this, { _saml: samlService });
       Object.setPrototypeOf(strategy, this);
       super.logout.call(strategy, req, callback);
     });
@@ -58,8 +77,10 @@ class MultiSamlStrategy extends SamlStrategy {
     signingCert: string | null,
     callback: (err: Error | null, metadata?: string) => void
   ) {
-    if (typeof callback !== 'function') {
-      throw new Error("Metadata can't be provided synchronously for MultiSamlStrategy.");
+    if (typeof callback !== "function") {
+      throw new Error(
+        "Metadata can't be provided synchronously for MultiSamlStrategy."
+      );
     }
 
     return this._options.getSamlOptions(req, (err, samlOptions) => {
@@ -67,10 +88,19 @@ class MultiSamlStrategy extends SamlStrategy {
         return callback(err);
       }
 
-      const samlService = new saml.SAML(Object.assign({}, this._options, samlOptions));
-      const strategy = Object.assign({}, this, {_saml: samlService});
+      const samlService = new saml.SAML(
+        Object.assign({}, this._options, samlOptions)
+      );
+      const strategy = Object.assign({}, this, { _saml: samlService });
       Object.setPrototypeOf(strategy, this);
-      return callback(null, super.generateServiceProviderMetadata.call(strategy, decryptionCert, signingCert));
+      return callback(
+        null,
+        super.generateServiceProviderMetadata.call(
+          strategy,
+          decryptionCert,
+          signingCert
+        )
+      );
     });
   }
 }
diff --git a/src/passport-saml/saml-post-signing.ts b/src/passport-saml/saml-post-signing.ts
index c23ce557..7f479e40 100644
--- a/src/passport-saml/saml-post-signing.ts
+++ b/src/passport-saml/saml-post-signing.ts
@@ -1,39 +1,61 @@
-import { SignedXml } from 'xml-crypto';
-import * as algorithms from './algorithms';
-import { SAMLOptions } from './types';
+import { SignedXml } from "xml-crypto";
+import * as algorithms from "./algorithms";
+import { SAMLOptions } from "./types";
 
-const authnRequestXPath = '/*[local-name(.)="AuthnRequest" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:protocol"]';
-const issuerXPath = '/*[local-name(.)="Issuer" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:assertion"]';
-const defaultTransforms = [ 'http://www.w3.org/2000/09/xmldsig#enveloped-signature', 'http://www.w3.org/2001/10/xml-exc-c14n#' ];
+const authnRequestXPath =
+  '/*[local-name(.)="AuthnRequest" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:protocol"]';
+const issuerXPath =
+  '/*[local-name(.)="Issuer" and namespace-uri(.)="urn:oasis:names:tc:SAML:2.0:assertion"]';
+const defaultTransforms = [
+  "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
+  "http://www.w3.org/2001/10/xml-exc-c14n#",
+];
 
-export function signSamlPost(samlMessage: string, xpath: string, options: SAMLOptions) {
-  if (!samlMessage) throw new Error('samlMessage is required');
-  if (!xpath) throw new Error('xpath is required');
+export function signSamlPost(
+  samlMessage: string,
+  xpath: string,
+  options: SAMLOptions
+) {
+  if (!samlMessage) throw new Error("samlMessage is required");
+  if (!xpath) throw new Error("xpath is required");
   if (!options) {
     options = {} as SAMLOptions;
   }
 
   if (options.privateCert) {
-    console.warn("options.privateCert has been deprecated; use options.privateKey instead.");
+    console.warn(
+      "options.privateCert has been deprecated; use options.privateKey instead."
+    );
 
     if (!options.privateKey) {
       options.privateKey = options.privateCert;
     }
   }
 
-  if (!options.privateKey) throw new Error('options.privateKey is required');
+  if (!options.privateKey) throw new Error("options.privateKey is required");
 
   const transforms = options.xmlSignatureTransforms || defaultTransforms;
   const sig = new SignedXml();
   if (options.signatureAlgorithm) {
-    sig.signatureAlgorithm = algorithms.getSigningAlgorithm(options.signatureAlgorithm);
+    sig.signatureAlgorithm = algorithms.getSigningAlgorithm(
+      options.signatureAlgorithm
+    );
   }
-  sig.addReference(xpath, transforms, algorithms.getDigestAlgorithm(options.digestAlgorithm));
+  sig.addReference(
+    xpath,
+    transforms,
+    algorithms.getDigestAlgorithm(options.digestAlgorithm)
+  );
   sig.signingKey = options.privateKey;
-  sig.computeSignature(samlMessage, { location: { reference: xpath + issuerXPath, action: 'after' }});
+  sig.computeSignature(samlMessage, {
+    location: { reference: xpath + issuerXPath, action: "after" },
+  });
   return sig.getSignedXml();
 }
 
-export function signAuthnRequestPost(authnRequest: string, options: SAMLOptions) {
+export function signAuthnRequestPost(
+  authnRequest: string,
+  options: SAMLOptions
+) {
   return signSamlPost(authnRequest, authnRequestXPath, options);
 }
diff --git a/src/passport-saml/saml.ts b/src/passport-saml/saml.ts
index 5a93ef51..783034a1 100644
--- a/src/passport-saml/saml.ts
+++ b/src/passport-saml/saml.ts
@@ -1,61 +1,66 @@
-import Debug from 'debug';
-const debug = Debug('passport-saml');
-import * as zlib from 'zlib';
-import * as xml2js from 'xml2js';
-import * as xmlCrypto from 'xml-crypto';
-import * as crypto from 'crypto';
-import * as xmldom from 'xmldom';
-import * as url from 'url';
-import * as querystring from 'querystring';
-import * as xmlbuilder from 'xmlbuilder';
-import * as xmlenc from 'xml-encryption';
-import * as util from 'util';
-import {CacheProvider as InMemoryCacheProvider} from './inmemory-cache-provider';
-import * as algorithms from './algorithms';
-import { signAuthnRequestPost } from './saml-post-signing';
-import type { Request } from 'express';
-import { ParsedQs } from 'qs';
-import { AudienceRestrictionXML,
-         AuthenticateOptions,
-         AuthorizeOptions,
-         AuthorizeRequestXML,
-         CertCallback,
-         LogoutRequestXML,
-         Profile,
-         RequestWithUser,
-         SAMLOptions,
-         SamlIDPListConfig,
-         SamlIDPEntryConfig,
-         SamlScopingConfig,
-         ServiceMetadataXML,
-         XMLInput,
-         XMLObject,
-         XMLOutput,
-         XMLValue
-       } from './types';
+import Debug from "debug";
+const debug = Debug("passport-saml");
+import * as zlib from "zlib";
+import * as xml2js from "xml2js";
+import * as xmlCrypto from "xml-crypto";
+import * as crypto from "crypto";
+import * as xmldom from "xmldom";
+import * as url from "url";
+import * as querystring from "querystring";
+import * as xmlbuilder from "xmlbuilder";
+import * as xmlenc from "xml-encryption";
+import * as util from "util";
+import { CacheProvider as InMemoryCacheProvider } from "./inmemory-cache-provider";
+import * as algorithms from "./algorithms";
+import { signAuthnRequestPost } from "./saml-post-signing";
+import type { Request } from "express";
+import { ParsedQs } from "qs";
+import {
+  AudienceRestrictionXML,
+  AuthenticateOptions,
+  AuthorizeOptions,
+  AuthorizeRequestXML,
+  CertCallback,
+  LogoutRequestXML,
+  Profile,
+  RequestWithUser,
+  SAMLOptions,
+  SamlIDPListConfig,
+  SamlIDPEntryConfig,
+  SamlScopingConfig,
+  ServiceMetadataXML,
+  XMLInput,
+  XMLObject,
+  XMLOutput,
+  XMLValue,
+} from "./types";
 
 const inflateRawAsync = util.promisify(zlib.inflateRaw);
 const deflateRawAsync = util.promisify(zlib.deflateRaw);
 
 interface NameID {
-    value: string | null;
-    format: string | null;
+  value: string | null;
+  format: string | null;
 }
 
-async function processValidlySignedPostRequestAsync(self: SAML, doc: XMLOutput, dom: Document): Promise<{profile?: Profile, loggedOut?: boolean}> {
+async function processValidlySignedPostRequestAsync(
+  self: SAML,
+  doc: XMLOutput,
+  dom: Document
+): Promise<{ profile?: Profile; loggedOut?: boolean }> {
   const request = doc.LogoutRequest;
   if (request) {
     const profile = {} as Profile;
     if (request.$.ID) {
-        profile.ID = request.$.ID;
+      profile.ID = request.$.ID;
     } else {
-      throw new Error('Missing SAML LogoutRequest ID');
+      throw new Error("Missing SAML LogoutRequest ID");
     }
     const issuer = request.Issuer;
     if (issuer && issuer[0]._) {
       profile.issuer = issuer[0]._;
     } else {
-      throw new Error('Missing SAML issuer');
+      throw new Error("Missing SAML issuer");
     }
     const nameID = await util.promisify(self.getNameID).bind(self)(self, dom);
     if (nameID) {
@@ -64,7 +69,7 @@ async function processValidlySignedPostRequestAsync(self: SAML, doc: XMLOutput,
         profile.nameIDFormat = nameID.format;
       }
     } else {
-      throw new Error('Missing SAML NameID');
+      throw new Error("Missing SAML NameID");
     }
     const sessionIndex = request.SessionIndex;
     if (sessionIndex) {
@@ -72,20 +77,24 @@ async function processValidlySignedPostRequestAsync(self: SAML, doc: XMLOutput,
     }
     return { profile, loggedOut: true };
   } else {
-    throw new Error('Unknown SAML request message');
+    throw new Error("Unknown SAML request message");
   }
 }
 
-async function processValidlySignedSamlLogoutAsync(self: SAML, doc: XMLOutput, dom: Document): Promise<{ profile?: Profile | null, loggedOut?: boolean }> {
+async function processValidlySignedSamlLogoutAsync(
+  self: SAML,
+  doc: XMLOutput,
+  dom: Document
+): Promise<{ profile?: Profile | null; loggedOut?: boolean }> {
   const response = doc.LogoutResponse;
   const request = doc.LogoutRequest;
 
-  if (response){
+  if (response) {
     return { profile: null, loggedOut: true };
   } else if (request) {
-   return await processValidlySignedPostRequestAsync(self, doc, dom);
+    return await processValidlySignedPostRequestAsync(self, doc, dom);
   } else {
-    throw new Error('Unknown SAML response message');
+    throw new Error("Unknown SAML response message");
   }
 }
 
@@ -93,7 +102,7 @@ async function promiseWithNameID(nameid: Node): Promise<NameID> {
   const format = xmlCrypto.xpath(nameid, "@Format") as Node[];
   return {
     value: nameid.textContent,
-    format: format && format[0] && format[0].nodeValue
+    format: format && format[0] && format[0].nodeValue,
   };
 }
 
@@ -111,35 +120,42 @@ class SAML {
     }
 
     if (options.privateCert) {
-      console.warn("options.privateCert has been deprecated; use options.privateKey instead.");
+      console.warn(
+        "options.privateCert has been deprecated; use options.privateKey instead."
+      );
 
       if (!options.privateKey) {
         options.privateKey = options.privateCert;
       }
     }
 
-    if (Object.prototype.hasOwnProperty.call(options, 'cert') && !options.cert) {
-      throw new Error('Invalid property: cert must not be empty');
+    if (
+      Object.prototype.hasOwnProperty.call(options, "cert") &&
+      !options.cert
+    ) {
+      throw new Error("Invalid property: cert must not be empty");
     }
 
     if (!options.path) {
-      options.path = '/saml/consume';
+      options.path = "/saml/consume";
     }
 
     if (!options.host) {
-      options.host = 'localhost';
+      options.host = "localhost";
     }
 
     if (!options.issuer) {
-      options.issuer = 'onelogin_saml';
+      options.issuer = "onelogin_saml";
     }
 
     if (options.identifierFormat === undefined) {
-      options.identifierFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+      options.identifierFormat =
+        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
     }
 
     if (options.authnContext === undefined) {
-      options.authnContext = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
+      options.authnContext =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
     }
 
     if (!Array.isArray(options.authnContext)) {
@@ -151,27 +167,28 @@ class SAML {
       options.acceptedClockSkewMs = 0;
     }
 
-    if(!options.validateInResponseTo){
+    if (!options.validateInResponseTo) {
       options.validateInResponseTo = false;
     }
 
-    if(!options.requestIdExpirationPeriodMs){
-      options.requestIdExpirationPeriodMs = 28800000;  // 8 hours
+    if (!options.requestIdExpirationPeriodMs) {
+      options.requestIdExpirationPeriodMs = 28800000; // 8 hours
     }
 
-    if(!options.cacheProvider){
-      options.cacheProvider = new InMemoryCacheProvider(
-          {keyExpirationPeriodMs: options.requestIdExpirationPeriodMs });
+    if (!options.cacheProvider) {
+      options.cacheProvider = new InMemoryCacheProvider({
+        keyExpirationPeriodMs: options.requestIdExpirationPeriodMs,
+      });
     }
 
     if (!options.logoutUrl) {
       // Default to Entry Point
-      options.logoutUrl = options.entryPoint || '';
+      options.logoutUrl = options.entryPoint || "";
     }
 
     // sha1, sha256, or sha512
     if (!options.signatureAlgorithm) {
-      options.signatureAlgorithm = 'sha1';
+      options.signatureAlgorithm = "sha1";
     }
 
     /**
@@ -181,18 +198,23 @@ class SAML {
      * - maximum:  Assertion context must be no stronger than a context in the list
      * - better:  Assertion context must be stronger than all contexts in the list
      */
-    if (!options.RACComparison || ['exact','minimum','maximum','better'].indexOf(options.RACComparison) === -1){
-      options.RACComparison = 'exact';
+    if (
+      !options.RACComparison ||
+      ["exact", "minimum", "maximum", "better"].indexOf(
+        options.RACComparison
+      ) === -1
+    ) {
+      options.RACComparison = "exact";
     }
 
     return options as SAMLOptions;
   }
 
-  getProtocol(req: Request | {headers?: undefined, protocol?: undefined}) {
-    return this.options.protocol || (req.protocol || 'http').concat('://');
+  getProtocol(req: Request | { headers?: undefined; protocol?: undefined }) {
+    return this.options.protocol || (req.protocol || "http").concat("://");
   }
 
-  getCallbackUrl(req: Request | {headers?: undefined, protocol?: undefined}) {
+  getCallbackUrl(req: Request | { headers?: undefined; protocol?: undefined }) {
     // Post-auth destination
     if (this.options.callbackUrl) {
       return this.options.callbackUrl;
@@ -207,8 +229,8 @@ class SAML {
     }
   }
 
-  generateUniqueID () {
-    return crypto.randomBytes(10).toString('hex');
+  generateUniqueID() {
+    return crypto.randomBytes(10).toString("hex");
   }
 
   generateInstant() {
@@ -217,7 +239,9 @@ class SAML {
 
   signRequest(samlMessage: querystring.ParsedUrlQueryInput) {
     const samlMessageToSign: querystring.ParsedUrlQueryInput = {};
-    samlMessage.SigAlg = algorithms.getSigningAlgorithm(this.options.signatureAlgorithm);
+    samlMessage.SigAlg = algorithms.getSigningAlgorithm(
+      this.options.signatureAlgorithm
+    );
     const signer = algorithms.getSigner(this.options.signatureAlgorithm);
     if (samlMessage.SAMLRequest) {
       samlMessageToSign.SAMLRequest = samlMessage.SAMLRequest;
@@ -232,134 +256,163 @@ class SAML {
       samlMessageToSign.SigAlg = samlMessage.SigAlg;
     }
     signer.update(querystring.stringify(samlMessageToSign));
-    samlMessage.Signature = signer.sign(this.keyToPEM(this.options.privateKey), 'base64');
+    samlMessage.Signature = signer.sign(
+      this.keyToPEM(this.options.privateKey),
+      "base64"
+    );
   }
 
   /**
-   * 
-   * @deprecated 
+   *
+   * @deprecated
    */
-  generateAuthorizeRequest(req: Request, isPassive: boolean, isHttpPostBinding: boolean, callback: (err: Error | null, request?: string) => void) {
-    return util.callbackify(() => this.generateAuthorizeRequestAsync(req, isPassive, isHttpPostBinding))(callback);
+  generateAuthorizeRequest(
+    req: Request,
+    isPassive: boolean,
+    isHttpPostBinding: boolean,
+    callback: (err: Error | null, request?: string) => void
+  ) {
+    return util.callbackify(() =>
+      this.generateAuthorizeRequestAsync(req, isPassive, isHttpPostBinding)
+    )(callback);
   }
 
-  async generateAuthorizeRequestAsync(req: Request, isPassive: boolean, isHttpPostBinding: boolean): Promise<string | undefined> {
+  async generateAuthorizeRequestAsync(
+    req: Request,
+    isPassive: boolean,
+    isHttpPostBinding: boolean
+  ): Promise<string | undefined> {
     const id = "_" + this.generateUniqueID();
     const instant = this.generateInstant();
     const forceAuthn = this.options.forceAuthn || false;
 
-    if(this.options.validateInResponseTo) {
-      await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(id, instant);
+    if (this.options.validateInResponseTo) {
+      await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(
+        id,
+        instant
+      );
     }
     const request: AuthorizeRequestXML = {
-      'samlp:AuthnRequest': {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@ID': id,
-        '@Version': '2.0',
-        '@IssueInstant': instant,
-        '@ProtocolBinding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-        '@Destination': this.options.entryPoint,
-        'saml:Issuer' : {
-          '@xmlns:saml' : 'urn:oasis:names:tc:SAML:2.0:assertion',
-          '#text': this.options.issuer
-        }
-      }
+      "samlp:AuthnRequest": {
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "@ID": id,
+        "@Version": "2.0",
+        "@IssueInstant": instant,
+        "@ProtocolBinding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+        "@Destination": this.options.entryPoint,
+        "saml:Issuer": {
+          "@xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+          "#text": this.options.issuer,
+        },
+      },
     };
 
-    if (isPassive)
-      request['samlp:AuthnRequest']['@IsPassive'] = true;
+    if (isPassive) request["samlp:AuthnRequest"]["@IsPassive"] = true;
 
     if (forceAuthn) {
-      request['samlp:AuthnRequest']['@ForceAuthn'] = true;
+      request["samlp:AuthnRequest"]["@ForceAuthn"] = true;
     }
 
     if (!this.options.disableRequestACSUrl) {
-      request['samlp:AuthnRequest']['@AssertionConsumerServiceURL'] = this.getCallbackUrl(req);
+      request["samlp:AuthnRequest"][
+        "@AssertionConsumerServiceURL"
+      ] = this.getCallbackUrl(req);
     }
 
     if (this.options.identifierFormat) {
-      request['samlp:AuthnRequest']['samlp:NameIDPolicy'] = {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@Format': this.options.identifierFormat,
-        '@AllowCreate': 'true'
+      request["samlp:AuthnRequest"]["samlp:NameIDPolicy"] = {
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "@Format": this.options.identifierFormat,
+        "@AllowCreate": "true",
       };
     }
 
     if (!this.options.disableRequestedAuthnContext) {
       const authnContextClassRefs: XMLInput[] = [];
-      (this.options.authnContext as string[]).forEach(function(value) {
+      (this.options.authnContext as string[]).forEach(function (value) {
         authnContextClassRefs.push({
-            '@xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-            '#text': value
+          "@xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+          "#text": value,
         });
       });
 
-      request['samlp:AuthnRequest']['samlp:RequestedAuthnContext'] = {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@Comparison': this.options.RACComparison,
-        'saml:AuthnContextClassRef': authnContextClassRefs
+      request["samlp:AuthnRequest"]["samlp:RequestedAuthnContext"] = {
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "@Comparison": this.options.RACComparison,
+        "saml:AuthnContextClassRef": authnContextClassRefs,
       };
     }
 
     if (this.options.attributeConsumingServiceIndex != null) {
-      request['samlp:AuthnRequest']['@AttributeConsumingServiceIndex'] = this.options.attributeConsumingServiceIndex;
+      request["samlp:AuthnRequest"][
+        "@AttributeConsumingServiceIndex"
+      ] = this.options.attributeConsumingServiceIndex;
     }
 
     if (this.options.providerName) {
-      request['samlp:AuthnRequest']['@ProviderName'] = this.options.providerName;
+      request["samlp:AuthnRequest"][
+        "@ProviderName"
+      ] = this.options.providerName;
     }
 
     if (this.options.scoping) {
       const scoping: XMLInput = {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
       };
 
-      if (typeof this.options.scoping.proxyCount === 'number') {
-        scoping['@ProxyCount'] = this.options.scoping.proxyCount;
+      if (typeof this.options.scoping.proxyCount === "number") {
+        scoping["@ProxyCount"] = this.options.scoping.proxyCount;
       }
 
       if (this.options.scoping.idpList) {
-        scoping['samlp:IDPList'] = this.options.scoping.idpList.map((idpListItem: SamlIDPListConfig) => {
-          const formattedIdpListItem: XMLInput = {
-            '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-          };
+        scoping["samlp:IDPList"] = this.options.scoping.idpList.map(
+          (idpListItem: SamlIDPListConfig) => {
+            const formattedIdpListItem: XMLInput = {
+              "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            };
+
+            if (idpListItem.entries) {
+              formattedIdpListItem["samlp:IDPEntry"] = idpListItem.entries.map(
+                (entry: SamlIDPEntryConfig) => {
+                  const formattedEntry: XMLInput = {
+                    "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  };
 
-          if (idpListItem.entries) {
-            formattedIdpListItem['samlp:IDPEntry'] = idpListItem.entries.map((entry: SamlIDPEntryConfig) => {
-              const formattedEntry: XMLInput = {
-                '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              };
+                  formattedEntry["@ProviderID"] = entry.providerId;
 
-              formattedEntry['@ProviderID'] = entry.providerId;
+                  if (entry.name) {
+                    formattedEntry["@Name"] = entry.name;
+                  }
 
-              if (entry.name) {
-                formattedEntry['@Name'] = entry.name;
-              }
+                  if (entry.loc) {
+                    formattedEntry["@Loc"] = entry.loc;
+                  }
 
-              if (entry.loc) {
-                formattedEntry['@Loc'] = entry.loc;
-              }
+                  return formattedEntry;
+                }
+              );
+            }
 
-              return formattedEntry;
-            });
-          }
+            if (idpListItem.getComplete) {
+              formattedIdpListItem["samlp:GetComplete"] =
+                idpListItem.getComplete;
+            }
 
-          if (idpListItem.getComplete) {
-            formattedIdpListItem['samlp:GetComplete'] = idpListItem.getComplete;
+            return formattedIdpListItem;
           }
-
-          return formattedIdpListItem;
-        });
+        );
       }
 
       if (this.options.scoping.requesterId) {
-        scoping['samlp:RequesterID'] = this.options.scoping.requesterId;
+        scoping["samlp:RequesterID"] = this.options.scoping.requesterId;
       }
 
-      request['samlp:AuthnRequest']['samlp:Scoping'] = scoping;
+      request["samlp:AuthnRequest"]["samlp:Scoping"] = scoping;
     }
 
-    let stringRequest = xmlbuilder.create(request as unknown as Record<string, any>).end();
+    let stringRequest = xmlbuilder
+      .create((request as unknown) as Record<string, any>)
+      .end();
     if (isHttpPostBinding && this.options.privateKey) {
       stringRequest = signAuthnRequestPost(stringRequest, this.options);
     }
@@ -371,41 +424,48 @@ class SAML {
     const instant = this.generateInstant();
 
     const request = {
-      'samlp:LogoutRequest' : {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-        '@ID': id,
-        '@Version': '2.0',
-        '@IssueInstant': instant,
-        '@Destination': this.options.logoutUrl,
-        'saml:Issuer' : {
-          '@xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-          '#text': this.options.issuer
+      "samlp:LogoutRequest": {
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "@xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+        "@ID": id,
+        "@Version": "2.0",
+        "@IssueInstant": instant,
+        "@Destination": this.options.logoutUrl,
+        "saml:Issuer": {
+          "@xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+          "#text": this.options.issuer,
         },
-        'saml:NameID' : {
-          '@Format': req.user!.nameIDFormat,
-          '#text': req.user!.nameID
-        }
-      }
+        "saml:NameID": {
+          "@Format": req.user!.nameIDFormat,
+          "#text": req.user!.nameID,
+        },
+      },
     } as LogoutRequestXML;
 
     if (req.user!.nameQualifier != null) {
-      request['samlp:LogoutRequest']['saml:NameID']['@NameQualifier'] = req.user!.nameQualifier;
+      request["samlp:LogoutRequest"]["saml:NameID"][
+        "@NameQualifier"
+      ] = req.user!.nameQualifier;
     }
 
     if (req.user!.spNameQualifier != null) {
-      request['samlp:LogoutRequest']['saml:NameID']['@SPNameQualifier'] = req.user!.spNameQualifier;
+      request["samlp:LogoutRequest"]["saml:NameID"][
+        "@SPNameQualifier"
+      ] = req.user!.spNameQualifier;
     }
 
     if (req.user!.sessionIndex) {
-      request['samlp:LogoutRequest']['saml2p:SessionIndex'] = {
-        '@xmlns:saml2p': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '#text': req.user!.sessionIndex
+      request["samlp:LogoutRequest"]["saml2p:SessionIndex"] = {
+        "@xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "#text": req.user!.sessionIndex,
       };
     }
 
-    await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(id, instant);
-    return xmlbuilder.create((request as unknown as Record<string, any>)).end();
+    await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(
+      id,
+      instant
+    );
+    return xmlbuilder.create((request as unknown) as Record<string, any>).end();
   }
 
   generateLogoutResponse(req: Request, logoutRequest: Profile) {
@@ -413,23 +473,23 @@ class SAML {
     const instant = this.generateInstant();
 
     const request = {
-      'samlp:LogoutResponse' : {
-        '@xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-        '@xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-        '@ID': id,
-        '@Version': '2.0',
-        '@IssueInstant': instant,
-        '@Destination': this.options.logoutUrl,
-        '@InResponseTo': logoutRequest.ID,
-        'saml:Issuer' : {
-          '#text': this.options.issuer
+      "samlp:LogoutResponse": {
+        "@xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+        "@xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+        "@ID": id,
+        "@Version": "2.0",
+        "@IssueInstant": instant,
+        "@Destination": this.options.logoutUrl,
+        "@InResponseTo": logoutRequest.ID,
+        "saml:Issuer": {
+          "#text": this.options.issuer,
         },
-        'samlp:Status': {
-          'samlp:StatusCode': {
-            '@Value': 'urn:oasis:names:tc:SAML:2.0:status:Success'
-          }
-        }
-      }
+        "samlp:Status": {
+          "samlp:StatusCode": {
+            "@Value": "urn:oasis:names:tc:SAML:2.0:status:Success",
+          },
+        },
+      },
     };
 
     return xmlbuilder.create(request).end();
@@ -438,47 +498,62 @@ class SAML {
   /**
    * @deprecated
    */
-  requestToUrl(request: string | null | undefined, response: string | null, operation: string, additionalParameters: querystring.ParsedUrlQuery, callback: (err: Error | null, url?: string | null | undefined) => void) {
-    util.callbackify(() => this.requestToUrlAsync(request, response, operation, additionalParameters))(callback);
+  requestToUrl(
+    request: string | null | undefined,
+    response: string | null,
+    operation: string,
+    additionalParameters: querystring.ParsedUrlQuery,
+    callback: (err: Error | null, url?: string | null | undefined) => void
+  ) {
+    util.callbackify(() =>
+      this.requestToUrlAsync(request, response, operation, additionalParameters)
+    )(callback);
   }
-  async requestToUrlAsync(request: string | null | undefined, response: string | null, operation: string, additionalParameters: querystring.ParsedUrlQuery): Promise<string> {
-
+  async requestToUrlAsync(
+    request: string | null | undefined,
+    response: string | null,
+    operation: string,
+    additionalParameters: querystring.ParsedUrlQuery
+  ): Promise<string> {
     let buffer: Buffer;
     if (this.options.skipRequestCompression) {
-      buffer = Buffer.from((request || response)!, 'utf8');
-    }
-    else {
+      buffer = Buffer.from((request || response)!, "utf8");
+    } else {
       buffer = await deflateRawAsync((request || response)!);
     }
 
-    const base64 = buffer.toString('base64');
+    const base64 = buffer.toString("base64");
     let target = url.parse(this.options.entryPoint, true);
 
-    if (operation === 'logout') {
+    if (operation === "logout") {
       if (this.options.logoutUrl) {
         target = url.parse(this.options.logoutUrl, true);
       }
-    } else if (operation !== 'authorize') {
-        throw new Error("Unknown operation: " + operation);
+    } else if (operation !== "authorize") {
+      throw new Error("Unknown operation: " + operation);
     }
 
-    const samlMessage: querystring.ParsedUrlQuery = request ? {
-      SAMLRequest: base64
-    } : {
-      SAMLResponse: base64
-    };
-    Object.keys(additionalParameters).forEach(k => {
+    const samlMessage: querystring.ParsedUrlQuery = request
+      ? {
+          SAMLRequest: base64,
+        }
+      : {
+          SAMLResponse: base64,
+        };
+    Object.keys(additionalParameters).forEach((k) => {
       samlMessage[k] = additionalParameters[k];
     });
     if (this.options.privateKey) {
       if (!this.options.entryPoint) {
-        throw new Error('"entryPoint" config parameter is required for signed messages');
+        throw new Error(
+          '"entryPoint" config parameter is required for signed messages'
+        );
       }
 
       // sets .SigAlg and .Signature
       this.signRequest(samlMessage);
     }
-    Object.keys(samlMessage).forEach(k => {
+    Object.keys(samlMessage).forEach((k) => {
       target.query[k] = samlMessage[k];
     });
 
@@ -489,33 +564,40 @@ class SAML {
     return url.format(target);
   }
 
-  getAdditionalParams(req: Request, operation: string, overrideParams?: querystring.ParsedUrlQuery) {
+  getAdditionalParams(
+    req: Request,
+    operation: string,
+    overrideParams?: querystring.ParsedUrlQuery
+  ) {
     const additionalParams: querystring.ParsedUrlQuery = {};
 
-    const RelayState = req.query && req.query.RelayState || req.body && req.body.RelayState;
+    const RelayState =
+      (req.query && req.query.RelayState) || (req.body && req.body.RelayState);
     if (RelayState) {
       additionalParams.RelayState = RelayState;
     }
 
     const optionsAdditionalParams = this.options.additionalParams || {};
-    Object.keys(optionsAdditionalParams).forEach(function(k) {
+    Object.keys(optionsAdditionalParams).forEach(function (k) {
       additionalParams[k] = optionsAdditionalParams[k];
     });
 
     let optionsAdditionalParamsForThisOperation: Record<string, string> = {};
     if (operation == "authorize") {
-      optionsAdditionalParamsForThisOperation = this.options.additionalAuthorizeParams || {};
+      optionsAdditionalParamsForThisOperation =
+        this.options.additionalAuthorizeParams || {};
     }
     if (operation == "logout") {
-      optionsAdditionalParamsForThisOperation = this.options.additionalLogoutParams || {};
+      optionsAdditionalParamsForThisOperation =
+        this.options.additionalLogoutParams || {};
     }
 
-    Object.keys(optionsAdditionalParamsForThisOperation).forEach(function(k) {
+    Object.keys(optionsAdditionalParamsForThisOperation).forEach(function (k) {
       additionalParams[k] = optionsAdditionalParamsForThisOperation[k];
     });
 
     overrideParams = overrideParams || {};
-    Object.keys(overrideParams).forEach(function(k) {
+    Object.keys(overrideParams).forEach(function (k) {
       additionalParams[k] = overrideParams![k];
     });
 
@@ -523,115 +605,187 @@ class SAML {
   }
 
   /**
-   * @deprecated 
+   * @deprecated
    */
-  getAuthorizeUrl(req: Request, options: AuthenticateOptions & AuthorizeOptions, callback: (err: Error | null, url?: string | null) => void) {
+  getAuthorizeUrl(
+    req: Request,
+    options: AuthenticateOptions & AuthorizeOptions,
+    callback: (err: Error | null, url?: string | null) => void
+  ) {
     util.callbackify(() => this.getAuthorizeUrlAsync(req, options))(callback);
   }
 
-  async getAuthorizeUrlAsync(req: Request, options: AuthenticateOptions & AuthorizeOptions) {
-    const request = await this.generateAuthorizeRequestAsync(req, this.options.passive, false);
-    const operation = 'authorize';
+  async getAuthorizeUrlAsync(
+    req: Request,
+    options: AuthenticateOptions & AuthorizeOptions
+  ) {
+    const request = await this.generateAuthorizeRequestAsync(
+      req,
+      this.options.passive,
+      false
+    );
+    const operation = "authorize";
     const overrideParams = options ? options.additionalParams || {} : {};
-    return await this.requestToUrlAsync(request, null, operation, this.getAdditionalParams(req, operation, overrideParams));
+    return await this.requestToUrlAsync(
+      request,
+      null,
+      operation,
+      this.getAdditionalParams(req, operation, overrideParams)
+    );
   }
 
   /**
-   * @deprecated 
+   * @deprecated
    */
-  getAuthorizeForm(req: Request, callback: (err: Error | null, data?: unknown) => void) {
+  getAuthorizeForm(
+    req: Request,
+    callback: (err: Error | null, data?: unknown) => void
+  ) {
     util.callbackify(() => this.getAuthorizeFormAsync(req))(callback);
   }
   async getAuthorizeFormAsync(req: Request) {
     // The quoteattr() function is used in a context, where the result will not be evaluated by javascript
     // but must be interpreted by an XML or HTML parser, and it must absolutely avoid breaking the syntax
     // of an element attribute.
-    const quoteattr = function(s: string | number | boolean | undefined | null | readonly string[] | readonly number[] | readonly boolean[], preserveCR?: boolean) {
-      const preserveCRChar = preserveCR ? '&#13;' : '\n';
-      return ('' + s) // Forces the conversion to string.
-        .replace(/&/g, '&amp;') // This MUST be the 1st replacement.
-        .replace(/'/g, '&apos;') // The 4 other predefined entities, required.
-        .replace(/"/g, '&quot;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        // Add other replacements here for HTML only
-        // Or for XML, only if the named entities are defined in its DTD.
-        .replace(/\r\n/g, preserveCRChar) // Must be before the next replacement.
-        .replace(/[\r\n]/g, preserveCRChar);
+    const quoteattr = function (
+      s:
+        | string
+        | number
+        | boolean
+        | undefined
+        | null
+        | readonly string[]
+        | readonly number[]
+        | readonly boolean[],
+      preserveCR?: boolean
+    ) {
+      const preserveCRChar = preserveCR ? "&#13;" : "\n";
+      return (
+        ("" + s) // Forces the conversion to string.
+          .replace(/&/g, "&amp;") // This MUST be the 1st replacement.
+          .replace(/'/g, "&apos;") // The 4 other predefined entities, required.
+          .replace(/"/g, "&quot;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          // Add other replacements here for HTML only
+          // Or for XML, only if the named entities are defined in its DTD.
+          .replace(/\r\n/g, preserveCRChar) // Must be before the next replacement.
+          .replace(/[\r\n]/g, preserveCRChar)
+      );
     };
 
-    const request = await this.generateAuthorizeRequestAsync(req, this.options.passive, true);
+    const request = await this.generateAuthorizeRequestAsync(
+      req,
+      this.options.passive,
+      true
+    );
     let buffer: Buffer;
     if (this.options.skipRequestCompression) {
-      buffer = Buffer.from(request!, 'utf8');
+      buffer = Buffer.from(request!, "utf8");
     } else {
       buffer = await deflateRawAsync(request!);
     }
 
-    const operation = 'authorize';
+    const operation = "authorize";
     const additionalParameters = this.getAdditionalParams(req, operation);
     const samlMessage: querystring.ParsedUrlQueryInput = {
-      SAMLRequest: buffer!.toString('base64')
+      SAMLRequest: buffer!.toString("base64"),
     };
 
-    Object.keys(additionalParameters).forEach(k => {
-      samlMessage[k] = additionalParameters[k] || '';
+    Object.keys(additionalParameters).forEach((k) => {
+      samlMessage[k] = additionalParameters[k] || "";
     });
 
-    const formInputs = Object.keys(samlMessage).map(k => {
-      return '<input type="hidden" name="' + k + '" value="' + quoteattr(samlMessage[k]) + '" />';
-    }).join('\r\n');
+    const formInputs = Object.keys(samlMessage)
+      .map((k) => {
+        return (
+          '<input type="hidden" name="' +
+          k +
+          '" value="' +
+          quoteattr(samlMessage[k]) +
+          '" />'
+        );
+      })
+      .join("\r\n");
 
     return [
-      '<!DOCTYPE html>',
-      '<html>',
-      '<head>',
+      "<!DOCTYPE html>",
+      "<html>",
+      "<head>",
       '<meta charset="utf-8">',
       '<meta http-equiv="x-ua-compatible" content="ie=edge">',
-      '</head>',
+      "</head>",
       '<body onload="document.forms[0].submit()">',
-      '<noscript>',
-      '<p><strong>Note:</strong> Since your browser does not support JavaScript, you must press the button below once to proceed.</p>',
-      '</noscript>',
-      '<form method="post" action="' + encodeURI(this.options.entryPoint) + '">',
+      "<noscript>",
+      "<p><strong>Note:</strong> Since your browser does not support JavaScript, you must press the button below once to proceed.</p>",
+      "</noscript>",
+      '<form method="post" action="' +
+        encodeURI(this.options.entryPoint) +
+        '">',
       formInputs,
       '<input type="submit" value="Submit" />',
-      '</form>',
+      "</form>",
       '<script>document.forms[0].style.display="none";</script>', // Hide the form if JavaScript is enabled
-      '</body>',
-      '</html>'
-    ].join('\r\n');
+      "</body>",
+      "</html>",
+    ].join("\r\n");
   }
 
   /**
    * @deprecated
    */
-  getLogoutUrl(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions, callback: (err: Error | null, url?: string | null) => void) {
+  getLogoutUrl(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions,
+    callback: (err: Error | null, url?: string | null) => void
+  ) {
     util.callbackify(() => this.getLogoutUrlAsync(req, options))(callback);
   }
-  async getLogoutUrlAsync(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions) {
+  async getLogoutUrlAsync(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions
+  ) {
     const request = await this.generateLogoutRequest(req);
-    const operation = 'logout';
+    const operation = "logout";
     const overrideParams = options ? options.additionalParams || {} : {};
-    return await this.requestToUrlAsync(request, null, operation, this.getAdditionalParams(req, operation, overrideParams));
+    return await this.requestToUrlAsync(
+      request,
+      null,
+      operation,
+      this.getAdditionalParams(req, operation, overrideParams)
+    );
   }
 
-  getLogoutResponseUrl(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions, callback: (err: Error | null, url?: string | null) => void) {
-    util.callbackify(() => this.getLogoutResponseUrlAsync(req, options))(callback);
+  getLogoutResponseUrl(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions,
+    callback: (err: Error | null, url?: string | null) => void
+  ) {
+    util.callbackify(() => this.getLogoutResponseUrlAsync(req, options))(
+      callback
+    );
   }
-  async getLogoutResponseUrlAsync(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions) {
+  async getLogoutResponseUrlAsync(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions
+  ) {
     const response = this.generateLogoutResponse(req, req.samlLogoutRequest);
-    const operation = 'logout';
+    const operation = "logout";
     const overrideParams = options ? options.additionalParams || {} : {};
-    return await this.requestToUrlAsync(null, response, operation, this.getAdditionalParams(req, operation, overrideParams));
+    return await this.requestToUrlAsync(
+      null,
+      response,
+      operation,
+      this.getAdditionalParams(req, operation, overrideParams)
+    );
   }
 
   certToPEM(cert: string): string {
-    cert = cert.match(/.{1,64}/g)!.join('\n');
+    cert = cert.match(/.{1,64}/g)!.join("\n");
 
-    if (cert.indexOf('-BEGIN CERTIFICATE-') === -1)
+    if (cert.indexOf("-BEGIN CERTIFICATE-") === -1)
       cert = "-----BEGIN CERTIFICATE-----\n" + cert;
-    if (cert.indexOf('-END CERTIFICATE-') === -1)
+    if (cert.indexOf("-END CERTIFICATE-") === -1)
       cert = cert + "\n-----END CERTIFICATE-----\n";
 
     return cert;
@@ -641,14 +795,15 @@ class SAML {
     if (!this.options.cert) {
       return undefined;
     }
-    if (typeof(this.options.cert) === 'function') {
-      return util.promisify(this.options.cert as CertCallback)()
-      .then((certs) => {
-        if (!Array.isArray(certs)) {
-          certs = [certs as string];
-        }
-        return certs as string[];
-      });
+    if (typeof this.options.cert === "function") {
+      return util
+        .promisify(this.options.cert as CertCallback)()
+        .then((certs) => {
+          if (!Array.isArray(certs)) {
+            certs = [certs as string];
+          }
+          return certs as string[];
+        });
     }
     let certs = this.options.cert;
     if (!Array.isArray(certs)) {
@@ -662,12 +817,19 @@ class SAML {
   //
   // See https://github.com/bergie/passport-saml/issues/19 for references to some of the attack
   //   vectors against SAML signature verification.
-  validateSignature(fullXml: string, currentNode: HTMLElement, certs: string[]) {
-    const xpathSigQuery = ".//*[" +
-                        "local-name(.)='Signature' and " +
-                        "namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#' and " +
-                        "descendant::*[local-name(.)='Reference' and @URI='#"+currentNode.getAttribute('ID')+"']" +
-                        "]";
+  validateSignature(
+    fullXml: string,
+    currentNode: HTMLElement,
+    certs: string[]
+  ) {
+    const xpathSigQuery =
+      ".//*[" +
+      "local-name(.)='Signature' and " +
+      "namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#' and " +
+      "descendant::*[local-name(.)='Reference' and @URI='#" +
+      currentNode.getAttribute("ID") +
+      "']" +
+      "]";
     const signatures = xmlCrypto.xpath(currentNode, xpathSigQuery);
     // This function is expecting to validate exactly one signature, so if we find more or fewer
     //   than that, reject.
@@ -676,35 +838,45 @@ class SAML {
     }
 
     const signature = signatures[0];
-    return certs.some(certToCheck => {
-      return this.validateSignatureForCert(signature as string, certToCheck, fullXml, currentNode);
+    return certs.some((certToCheck) => {
+      return this.validateSignatureForCert(
+        signature as string,
+        certToCheck,
+        fullXml,
+        currentNode
+      );
     });
   }
 
-// This function checks that the |signature| is signed with a given |cert|.
-  validateSignatureForCert(signature: string | Node, cert: string, fullXml: string, currentNode: HTMLElement) {
+  // This function checks that the |signature| is signed with a given |cert|.
+  validateSignatureForCert(
+    signature: string | Node,
+    cert: string,
+    fullXml: string,
+    currentNode: HTMLElement
+  ) {
     const sig = new xmlCrypto.SignedXml();
     sig.keyInfoProvider = {
-      file: '',
-      getKeyInfo: key => "<X509Data></X509Data>",
-      getKey: keyInfo => Buffer.from(this.certToPEM(cert)),
+      file: "",
+      getKeyInfo: (key) => "<X509Data></X509Data>",
+      getKey: (keyInfo) => Buffer.from(this.certToPEM(cert)),
     };
     signature = this.normalizeNewlines(signature.toString());
     sig.loadSignature(signature);
     // We expect each signature to contain exactly one reference to the top level of the xml we
     //   are validating, so if we see anything else, reject.
-    if (sig.references.length != 1 )
-      return false;
+    if (sig.references.length != 1) return false;
     const refUri = sig.references[0].uri!;
-    const refId = (refUri[0] === '#') ? refUri.substring(1) : refUri;
+    const refId = refUri[0] === "#" ? refUri.substring(1) : refUri;
     // If we can't find the reference at the top level, reject
-    const idAttribute = currentNode.getAttribute('ID') ? 'ID' : 'Id';
-    if (currentNode.getAttribute(idAttribute) != refId)
-      return false;
+    const idAttribute = currentNode.getAttribute("ID") ? "ID" : "Id";
+    if (currentNode.getAttribute(idAttribute) != refId) return false;
     // If we find any extra referenced nodes, reject.  (xml-crypto only verifies one digest, so
     //   multiple candidate references is bad news)
-    const totalReferencedNodes = xmlCrypto.xpath(currentNode.ownerDocument,
-                                    "//*[@" + idAttribute + "='" + refId + "']");
+    const totalReferencedNodes = xmlCrypto.xpath(
+      currentNode.ownerDocument,
+      "//*[@" + idAttribute + "='" + refId + "']"
+    );
 
     if (totalReferencedNodes.length > 1) {
       return false;
@@ -716,73 +888,114 @@ class SAML {
   /**
    * @deprecated
    */
-  validatePostResponse(container: Record<string, string>, callback: (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => void) {
-    this.validatePostResponseAsync(container).then((res) => callback(null, res.profile, res.loggedOut)).catch(err => callback(err));
-
+  validatePostResponse(
+    container: Record<string, string>,
+    callback: (
+      err: Error | null,
+      profile?: Profile | null,
+      loggedOut?: boolean
+    ) => void
+  ) {
+    this.validatePostResponseAsync(container)
+      .then((res) => callback(null, res.profile, res.loggedOut))
+      .catch((err) => callback(err));
   }
-  
-  async validatePostResponseAsync(container: Record<string, string>): Promise<{profile?: Profile | null, loggedOut?: boolean}> {
+
+  async validatePostResponseAsync(
+    container: Record<string, string>
+  ): Promise<{ profile?: Profile | null; loggedOut?: boolean }> {
     let xml: string, doc: Document, inResponseTo: string | null;
     try {
-      xml = Buffer.from(container.SAMLResponse, 'base64').toString('utf8');
-      doc = new xmldom.DOMParser({
-      }).parseFromString(xml);
+      xml = Buffer.from(container.SAMLResponse, "base64").toString("utf8");
+      doc = new xmldom.DOMParser({}).parseFromString(xml);
 
-      if (!Object.prototype.hasOwnProperty.call(doc, 'documentElement'))
-        throw new Error('SAMLResponse is not valid base64-encoded XML');
+      if (!Object.prototype.hasOwnProperty.call(doc, "documentElement"))
+        throw new Error("SAMLResponse is not valid base64-encoded XML");
 
-      const inResponseToNodes = xmlCrypto.xpath(doc, "/*[local-name()='Response']/@InResponseTo") as Attr[];
+      const inResponseToNodes = xmlCrypto.xpath(
+        doc,
+        "/*[local-name()='Response']/@InResponseTo"
+      ) as Attr[];
 
       if (inResponseToNodes) {
-        inResponseTo = inResponseToNodes.length ? inResponseToNodes[0].nodeValue : null;
+        inResponseTo = inResponseToNodes.length
+          ? inResponseToNodes[0].nodeValue
+          : null;
 
         await this.validateInResponseTo(inResponseTo);
       }
       const certs = await this.certsToCheck();
       // Check if this document has a valid top-level signature
       let validSignature = false;
-      if (this.options.cert && this.validateSignature(xml, doc.documentElement, certs!)) {
+      if (
+        this.options.cert &&
+        this.validateSignature(xml, doc.documentElement, certs!)
+      ) {
         validSignature = true;
       }
 
-      const assertions = xmlCrypto.xpath(doc, "/*[local-name()='Response']/*[local-name()='Assertion']") as HTMLElement[];
-      const encryptedAssertions = xmlCrypto.xpath(doc,
-                                      "/*[local-name()='Response']/*[local-name()='EncryptedAssertion']");
+      const assertions = xmlCrypto.xpath(
+        doc,
+        "/*[local-name()='Response']/*[local-name()='Assertion']"
+      ) as HTMLElement[];
+      const encryptedAssertions = xmlCrypto.xpath(
+        doc,
+        "/*[local-name()='Response']/*[local-name()='EncryptedAssertion']"
+      );
 
       if (assertions.length + encryptedAssertions.length > 1) {
         // There's no reason I know of that we want to handle multiple assertions, and it seems like a
         //   potential risk vector for signature scope issues, so treat this as an invalid signature
-        throw new Error('Invalid signature: multiple assertions');
+        throw new Error("Invalid signature: multiple assertions");
       }
 
       if (assertions.length == 1) {
-        if (this.options.cert &&
-            !validSignature &&
-              !this.validateSignature(xml, assertions[0], certs!)) {
-          throw new Error('Invalid signature');
+        if (
+          this.options.cert &&
+          !validSignature &&
+          !this.validateSignature(xml, assertions[0], certs!)
+        ) {
+          throw new Error("Invalid signature");
         }
-        return this.processValidlySignedAssertionAsync(assertions[0].toString(), xml, inResponseTo!);
+        return this.processValidlySignedAssertionAsync(
+          assertions[0].toString(),
+          xml,
+          inResponseTo!
+        );
       }
 
       if (encryptedAssertions.length == 1) {
         if (!this.options.decryptionPvk)
-          throw new Error('No decryption key for encrypted SAML response');
+          throw new Error("No decryption key for encrypted SAML response");
 
         const encryptedAssertionXml = encryptedAssertions[0].toString();
 
         const xmlencOptions = { key: this.options.decryptionPvk };
-        const decryptedXml: string = await util.promisify(xmlenc.decrypt).bind(xmlenc)(encryptedAssertionXml, xmlencOptions);
-        const decryptedDoc = new xmldom.DOMParser().parseFromString(decryptedXml);
-        const decryptedAssertions = xmlCrypto.xpath(decryptedDoc, "/*[local-name()='Assertion']") as HTMLElement[];
+        const decryptedXml: string = await util
+          .promisify(xmlenc.decrypt)
+          .bind(xmlenc)(encryptedAssertionXml, xmlencOptions);
+        const decryptedDoc = new xmldom.DOMParser().parseFromString(
+          decryptedXml
+        );
+        const decryptedAssertions = xmlCrypto.xpath(
+          decryptedDoc,
+          "/*[local-name()='Assertion']"
+        ) as HTMLElement[];
         if (decryptedAssertions.length != 1)
-          throw new Error('Invalid EncryptedAssertion content');
-
-        if (this.options.cert &&
-            !validSignature &&
-              !this.validateSignature(decryptedXml, decryptedAssertions[0], certs!))
-          throw new Error('Invalid signature from encrypted assertion');
-
-        return await this.processValidlySignedAssertionAsync(decryptedAssertions[0].toString(), xml, inResponseTo!);
+          throw new Error("Invalid EncryptedAssertion content");
+
+        if (
+          this.options.cert &&
+          !validSignature &&
+          !this.validateSignature(decryptedXml, decryptedAssertions[0], certs!)
+        )
+          throw new Error("Invalid signature from encrypted assertion");
+
+        return await this.processValidlySignedAssertionAsync(
+          decryptedAssertions[0].toString(),
+          xml,
+          inResponseTo!
+        );
       }
 
       // If there's no assertion, fall back on xml2js response parsing for the status &
@@ -791,7 +1004,7 @@ class SAML {
       const parserConfig = {
         explicitRoot: true,
         explicitCharkey: true,
-        tagNameProcessors: [xml2js.processors.stripPrefix]
+        tagNameProcessors: [xml2js.processors.stripPrefix],
       };
       const parser = new xml2js.Parser(parserConfig);
       const xmljsDoc = await parser.parseStringPromise(xml);
@@ -802,11 +1015,19 @@ class SAML {
           const status = response.Status;
           if (status) {
             const statusCode = status[0].StatusCode;
-            if (statusCode && statusCode[0].$.Value === "urn:oasis:names:tc:SAML:2.0:status:Responder") {
+            if (
+              statusCode &&
+              statusCode[0].$.Value ===
+                "urn:oasis:names:tc:SAML:2.0:status:Responder"
+            ) {
               const nestedStatusCode = statusCode[0].StatusCode;
-              if (nestedStatusCode && nestedStatusCode[0].$.Value === "urn:oasis:names:tc:SAML:2.0:status:NoPassive") {
+              if (
+                nestedStatusCode &&
+                nestedStatusCode[0].$.Value ===
+                  "urn:oasis:names:tc:SAML:2.0:status:NoPassive"
+              ) {
                 if (this.options.cert && !validSignature) {
-                  throw new Error('Invalid signature: NoPassive');
+                  throw new Error("Invalid signature: NoPassive");
                 }
                 return { profile: null, loggedOut: false };
               }
@@ -817,41 +1038,47 @@ class SAML {
             //   let's go ahead and give the potentially more helpful error.
             if (statusCode && statusCode[0].$.Value) {
               const msgType = statusCode[0].$.Value.match(/[^:]*$/)[0];
-              if (msgType != 'Success') {
-                  let msg = 'unspecified';
-                  if (status[0].StatusMessage) {
-                    msg = status[0].StatusMessage[0]._;
-                  } else if (statusCode[0].StatusCode) {
-                    msg = statusCode[0].StatusCode[0].$.Value.match(/[^:]*$/)[0];
-                  }
-                  const error = new Error('SAML provider returned ' + msgType + ' error: ' + msg);
-                  const builderOpts = {
-                    rootName: 'Status',
-                    headless: true
-                  };
-                  // @ts-expect-error adding extra attr to default Error object
-                  error.statusXml = new xml2js.Builder(builderOpts).buildObject(status[0]);
-                  throw error;
+              if (msgType != "Success") {
+                let msg = "unspecified";
+                if (status[0].StatusMessage) {
+                  msg = status[0].StatusMessage[0]._;
+                } else if (statusCode[0].StatusCode) {
+                  msg = statusCode[0].StatusCode[0].$.Value.match(/[^:]*$/)[0];
                 }
+                const error = new Error(
+                  "SAML provider returned " + msgType + " error: " + msg
+                );
+                const builderOpts = {
+                  rootName: "Status",
+                  headless: true,
+                };
+                // @ts-expect-error adding extra attr to default Error object
+                error.statusXml = new xml2js.Builder(builderOpts).buildObject(
+                  status[0]
+                );
+                throw error;
               }
             }
           }
-          throw new Error('Missing SAML assertion');
+        }
+        throw new Error("Missing SAML assertion");
+      } else {
+        if (this.options.cert && !validSignature) {
+          throw new Error("Invalid signature: No response found");
+        }
+        const logoutResponse = xmljsDoc.LogoutResponse;
+        if (logoutResponse) {
+          return { profile: null, loggedOut: true };
         } else {
-          if (this.options.cert && !validSignature) {
-            throw new Error('Invalid signature: No response found');
-          }
-          const logoutResponse = xmljsDoc.LogoutResponse;
-          if (logoutResponse){
-            return { profile: null, loggedOut: true };
-          } else {
-            throw new Error('Unknown SAML response message');
-          }
+          throw new Error("Unknown SAML response message");
         }
+      }
     } catch (err) {
-      debug('validatePostResponse resulted in an error: %s', err);
+      debug("validatePostResponse resulted in an error: %s", err);
       if (this.options.validateInResponseTo) {
-        await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo!);
+        await util
+          .promisify(this.cacheProvider.remove)
+          .bind(this.cacheProvider)(inResponseTo!);
       }
       throw err;
     }
@@ -860,12 +1087,13 @@ class SAML {
   async validateInResponseTo(inResponseTo: string | null) {
     if (this.options.validateInResponseTo) {
       if (inResponseTo) {
-        const result = await util.promisify(this.cacheProvider.get).bind(this.cacheProvider)(inResponseTo);
-        if (!result)
-          throw new Error('InResponseTo is not valid');
+        const result = await util
+          .promisify(this.cacheProvider.get)
+          .bind(this.cacheProvider)(inResponseTo);
+        if (!result) throw new Error("InResponseTo is not valid");
         return;
       } else {
-        throw new Error('InResponseTo is missing from response');
+        throw new Error("InResponseTo is missing from response");
       }
     } else {
       return;
@@ -875,12 +1103,27 @@ class SAML {
   /**
    * @deprecated
    */
-  validateRedirect(container: ParsedQs, originalQuery: string | null, callback: (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => void) {
-    this.validateRedirectAsync(container, originalQuery).then((res) => callback(null, res.profile, res.loggedOut)).catch(err => callback(err));
+  validateRedirect(
+    container: ParsedQs,
+    originalQuery: string | null,
+    callback: (
+      err: Error | null,
+      profile?: Profile | null,
+      loggedOut?: boolean
+    ) => void
+  ) {
+    this.validateRedirectAsync(container, originalQuery)
+      .then((res) => callback(null, res.profile, res.loggedOut))
+      .catch((err) => callback(err));
   }
 
-  async validateRedirectAsync(container: ParsedQs, originalQuery: string | null): Promise<{profile?: Profile | null, loggedOut?: boolean}> {
-    const samlMessageType = container.SAMLRequest ? 'SAMLRequest' : 'SAMLResponse';
+  async validateRedirectAsync(
+    container: ParsedQs,
+    originalQuery: string | null
+  ): Promise<{ profile?: Profile | null; loggedOut?: boolean }> {
+    const samlMessageType = container.SAMLRequest
+      ? "SAMLRequest"
+      : "SAMLResponse";
 
     const data = Buffer.from(container[samlMessageType] as string, "base64");
     const inflated = await inflateRawAsync(data);
@@ -889,67 +1132,80 @@ class SAML {
     const parserConfig = {
       explicitRoot: true,
       explicitCharkey: true,
-      tagNameProcessors: [xml2js.processors.stripPrefix]
+      tagNameProcessors: [xml2js.processors.stripPrefix],
     };
     const parser = new xml2js.Parser(parserConfig);
     const doc: XMLOutput = await parser.parseStringPromise(inflated);
-    samlMessageType === 'SAMLResponse' ?
-      await this.verifyLogoutResponse(doc) : this.verifyLogoutRequest(doc);
+    samlMessageType === "SAMLResponse"
+      ? await this.verifyLogoutResponse(doc)
+      : this.verifyLogoutRequest(doc);
     await this.hasValidSignatureForRedirect(container, originalQuery);
     return await processValidlySignedSamlLogoutAsync(this, doc, dom);
   }
 
-  async hasValidSignatureForRedirect(container: ParsedQs, originalQuery: string | null): Promise<boolean | void> {
-    const tokens = originalQuery!.split('&');
+  async hasValidSignatureForRedirect(
+    container: ParsedQs,
+    originalQuery: string | null
+  ): Promise<boolean | void> {
+    const tokens = originalQuery!.split("&");
     const getParam = (key: string) => {
-      const exists = tokens.filter(t => { return new RegExp(key).test(t); });
+      const exists = tokens.filter((t) => {
+        return new RegExp(key).test(t);
+      });
       return exists[0];
     };
 
     if (container.Signature && this.options.cert) {
-      let urlString = getParam('SAMLRequest') || getParam('SAMLResponse');
+      let urlString = getParam("SAMLRequest") || getParam("SAMLResponse");
 
-      if (getParam('RelayState')) {
-        urlString += '&' + getParam('RelayState');
+      if (getParam("RelayState")) {
+        urlString += "&" + getParam("RelayState");
       }
 
-      urlString += '&' + getParam('SigAlg');
+      urlString += "&" + getParam("SigAlg");
 
       const certs = await this.certsToCheck();
-      const hasValidQuerySignature = certs!.some(cert => {
+      const hasValidQuerySignature = certs!.some((cert) => {
         return this.validateSignatureForRedirect(
-          urlString, (container.Signature as string), (container.SigAlg as string), cert
+          urlString,
+          container.Signature as string,
+          container.SigAlg as string,
+          cert
         );
       });
       if (!hasValidQuerySignature) {
-        throw new Error('Invalid signature');
+        throw new Error("Invalid signature");
       }
     } else {
       return true;
     }
   }
 
-  validateSignatureForRedirect(urlString: crypto.BinaryLike, signature: string, alg: string, cert: string) {
+  validateSignatureForRedirect(
+    urlString: crypto.BinaryLike,
+    signature: string,
+    alg: string,
+    cert: string
+  ) {
     // See if we support a matching algorithm, case-insensitive. Otherwise, throw error.
-    function hasMatch (ourAlgo: string) {
+    function hasMatch(ourAlgo: string) {
       // The incoming algorithm is forwarded as a URL.
       // We trim everything before the last # get something we can compare to the Node.js list
-      const algFromURI = alg.toLowerCase().replace(/.*#(.*)$/,'$1');
+      const algFromURI = alg.toLowerCase().replace(/.*#(.*)$/, "$1");
       return ourAlgo.toLowerCase() === algFromURI;
     }
     const i = crypto.getHashes().findIndex(hasMatch);
     let matchingAlgo;
     if (i > -1) {
       matchingAlgo = crypto.getHashes()[i];
-    }
-    else {
-      throw new Error(alg + ' is not supported');
+    } else {
+      throw new Error(alg + " is not supported");
     }
 
     const verifier = crypto.createVerify(matchingAlgo);
     verifier.update(urlString);
 
-    return verifier.verify(this.certToPEM(cert), signature, 'base64');
+    return verifier.verify(this.certToPEM(cert), signature, "base64");
   }
 
   verifyLogoutRequest(doc: XMLOutput) {
@@ -957,7 +1213,9 @@ class SAML {
     const nowMs = new Date().getTime();
     const conditions = doc.LogoutRequest.$;
     const conErr = this.checkTimestampsValidityError(
-      nowMs, conditions.NotBefore, conditions.NotOnOrAfter
+      nowMs,
+      conditions.NotBefore,
+      conditions.NotOnOrAfter
     );
     if (conErr) {
       throw conErr;
@@ -967,7 +1225,7 @@ class SAML {
   async verifyLogoutResponse(doc: XMLOutput) {
     const statusCode = doc.LogoutResponse.Status[0].StatusCode[0].$.Value;
     if (statusCode !== "urn:oasis:names:tc:SAML:2.0:status:Success")
-      throw new Error('Bad status code: ' + statusCode);
+      throw new Error("Bad status code: " + statusCode);
 
     this.verifyIssuer(doc.LogoutResponse);
     const inResponseTo = doc.LogoutResponse.$.InResponseTo;
@@ -979,30 +1237,50 @@ class SAML {
   }
 
   verifyIssuer(samlMessage: XMLOutput) {
-    if(this.options.idpIssuer) {
+    if (this.options.idpIssuer) {
       const issuer = samlMessage.Issuer;
       if (issuer) {
         if (issuer[0]._ !== this.options.idpIssuer)
-          throw new Error('Unknown SAML issuer. Expected: ' + this.options.idpIssuer + ' Received: ' + issuer[0]._);
+          throw new Error(
+            "Unknown SAML issuer. Expected: " +
+              this.options.idpIssuer +
+              " Received: " +
+              issuer[0]._
+          );
       } else {
-        throw new Error('Missing SAML issuer');
+        throw new Error("Missing SAML issuer");
       }
     }
   }
-  
+
   /**
-   * @deprecated 
+   * @deprecated
    */
-  processValidlySignedAssertion(xml: xml2js.convertableToString, samlResponseXml: string, inResponseTo: string, callback: (err: Error | null, profile?: Profile | undefined, loggedOut?: boolean | undefined) => void) {
-    this.processValidlySignedAssertionAsync(xml, samlResponseXml, inResponseTo).then(res => callback(null, res.profile, res.loggedOut)).catch(err => callback(err));
+  processValidlySignedAssertion(
+    xml: xml2js.convertableToString,
+    samlResponseXml: string,
+    inResponseTo: string,
+    callback: (
+      err: Error | null,
+      profile?: Profile | undefined,
+      loggedOut?: boolean | undefined
+    ) => void
+  ) {
+    this.processValidlySignedAssertionAsync(xml, samlResponseXml, inResponseTo)
+      .then((res) => callback(null, res.profile, res.loggedOut))
+      .catch((err) => callback(err));
   }
 
-  async processValidlySignedAssertionAsync(xml: xml2js.convertableToString, samlResponseXml: string, inResponseTo: string) {
+  async processValidlySignedAssertionAsync(
+    xml: xml2js.convertableToString,
+    samlResponseXml: string,
+    inResponseTo: string
+  ) {
     let msg;
     const parserConfig = {
       explicitRoot: true,
       explicitCharkey: true,
-      tagNameProcessors: [xml2js.processors.stripPrefix]
+      tagNameProcessors: [xml2js.processors.stripPrefix],
     };
     const nowMs = new Date().getTime();
     const profile = {} as Profile;
@@ -1011,7 +1289,6 @@ class SAML {
     const parsedAssertion: XMLOutput = doc;
     const assertion: XMLOutput = doc.Assertion;
     getInResponseTo: {
-
       const issuer = assertion.Issuer;
       if (issuer && issuer[0]._) {
         profile.issuer = issuer[0]._;
@@ -1042,12 +1319,19 @@ class SAML {
           }
         }
 
-        subjectConfirmation = subject[0].SubjectConfirmation ?
-                              subject[0].SubjectConfirmation[0] : null;
-        confirmData = subjectConfirmation && subjectConfirmation.SubjectConfirmationData ?
-                      subjectConfirmation.SubjectConfirmationData[0] : null;
-        if (subject[0].SubjectConfirmation && subject[0].SubjectConfirmation.length > 1) {
-          msg = 'Unable to process multiple SubjectConfirmations in SAML assertion';
+        subjectConfirmation = subject[0].SubjectConfirmation
+          ? subject[0].SubjectConfirmation[0]
+          : null;
+        confirmData =
+          subjectConfirmation && subjectConfirmation.SubjectConfirmationData
+            ? subjectConfirmation.SubjectConfirmationData[0]
+            : null;
+        if (
+          subject[0].SubjectConfirmation &&
+          subject[0].SubjectConfirmation.length > 1
+        ) {
+          msg =
+            "Unable to process multiple SubjectConfirmations in SAML assertion";
           throw new Error(msg);
         }
 
@@ -1057,7 +1341,10 @@ class SAML {
             const subjectNotOnOrAfter = confirmData.$.NotOnOrAfter;
 
             const subjErr = this.checkTimestampsValidityError(
-                            nowMs, subjectNotBefore, subjectNotOnOrAfter);
+              nowMs,
+              subjectNotBefore,
+              subjectNotOnOrAfter
+            );
             if (subjErr) {
               throw subjErr;
             }
@@ -1071,26 +1358,41 @@ class SAML {
         if (subjectConfirmation) {
           if (confirmData && confirmData.$) {
             const subjectInResponseTo = confirmData.$.InResponseTo;
-            if (inResponseTo && subjectInResponseTo && subjectInResponseTo != inResponseTo) {
-              await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo);
-              throw new Error('InResponseTo is not valid');
+            if (
+              inResponseTo &&
+              subjectInResponseTo &&
+              subjectInResponseTo != inResponseTo
+            ) {
+              await util
+                .promisify(this.cacheProvider.remove)
+                .bind(this.cacheProvider)(inResponseTo);
+              throw new Error("InResponseTo is not valid");
             } else if (subjectInResponseTo) {
               let foundValidInResponseTo = false;
-              const result = await util.promisify(this.cacheProvider.get).bind(this.cacheProvider)(subjectInResponseTo);
+              const result = await util
+                .promisify(this.cacheProvider.get)
+                .bind(this.cacheProvider)(subjectInResponseTo);
               if (result) {
                 const createdAt = new Date(result);
-                if (nowMs < createdAt.getTime() + this.options.requestIdExpirationPeriodMs)
+                if (
+                  nowMs <
+                  createdAt.getTime() + this.options.requestIdExpirationPeriodMs
+                )
                   foundValidInResponseTo = true;
               }
-              await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo);
+              await util
+                .promisify(this.cacheProvider.remove)
+                .bind(this.cacheProvider)(inResponseTo);
               if (!foundValidInResponseTo) {
-                throw new Error('InResponseTo is not valid');
+                throw new Error("InResponseTo is not valid");
               }
               break getInResponseTo;
             }
           }
         } else {
-          await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo);
+          await util
+            .promisify(this.cacheProvider.remove)
+            .bind(this.cacheProvider)(inResponseTo);
           break getInResponseTo;
         }
       } else {
@@ -1099,36 +1401,46 @@ class SAML {
     }
     const conditions = assertion.Conditions ? assertion.Conditions[0] : null;
     if (assertion.Conditions && assertion.Conditions.length > 1) {
-      msg = 'Unable to process multiple conditions in SAML assertion';
+      msg = "Unable to process multiple conditions in SAML assertion";
       throw new Error(msg);
     }
-    if(conditions && conditions.$) {
+    if (conditions && conditions.$) {
       const conErr = this.checkTimestampsValidityError(
-                    nowMs, conditions.$.NotBefore, conditions.$.NotOnOrAfter);
-      if(conErr)
-        throw conErr;
+        nowMs,
+        conditions.$.NotBefore,
+        conditions.$.NotOnOrAfter
+      );
+      if (conErr) throw conErr;
     }
 
     if (this.options.audience) {
       const audienceErr = this.checkAudienceValidityError(
-                    this.options.audience, conditions.AudienceRestriction);
-      if(audienceErr)
-        throw audienceErr;
+        this.options.audience,
+        conditions.AudienceRestriction
+      );
+      if (audienceErr) throw audienceErr;
     }
 
     const attributeStatement = assertion.AttributeStatement;
     if (attributeStatement) {
-      const attributes: XMLOutput[] = [].concat(...attributeStatement.filter((attr: XMLObject) => Array.isArray(attr.Attribute))
-                                                  .map((attr: XMLObject) => attr.Attribute));
+      const attributes: XMLOutput[] = [].concat(
+        ...attributeStatement
+          .filter((attr: XMLObject) => Array.isArray(attr.Attribute))
+          .map((attr: XMLObject) => attr.Attribute)
+      );
 
       const attrValueMapper = (value: XMLObject) => {
-        const hasChildren = Object.keys(value).some((cur)=> { return (cur!=='_' && cur!=='$'); });
-        return (hasChildren) ? value : value._;
+        const hasChildren = Object.keys(value).some((cur) => {
+          return cur !== "_" && cur !== "$";
+        });
+        return hasChildren ? value : value._;
       };
 
       if (attributes) {
-        attributes.forEach(attribute => {
-        if(!Object.prototype.hasOwnProperty.call(attribute, 'AttributeValue')) {
+        attributes.forEach((attribute) => {
+          if (
+            !Object.prototype.hasOwnProperty.call(attribute, "AttributeValue")
+          ) {
             // if attributes has no AttributeValue child, continue
             return;
           }
@@ -1142,10 +1454,10 @@ class SAML {
       }
     }
 
-    if (!profile.mail && profile['urn:oid:0.9.2342.19200300.100.1.3']) {
+    if (!profile.mail && profile["urn:oid:0.9.2342.19200300.100.1.3"]) {
       // See https://spaces.internet2.edu/display/InCFederation/Supported+Attribute+Summary
       // for definition of attribute OIDs
-      profile.mail = profile['urn:oid:0.9.2342.19200300.100.1.3'];
+      profile.mail = profile["urn:oid:0.9.2342.19200300.100.1.3"];
     }
 
     if (!profile.email && profile.mail) {
@@ -1156,42 +1468,56 @@ class SAML {
     profile.getAssertion = () => parsedAssertion;
     profile.getSamlResponseXml = () => samlResponseXml;
 
-    return {profile, loggedOut: false};
+    return { profile, loggedOut: false };
   }
 
-  checkTimestampsValidityError(nowMs: number, notBefore: string, notOnOrAfter: string) {
-    if (this.options.acceptedClockSkewMs == -1)
-        return null;
+  checkTimestampsValidityError(
+    nowMs: number,
+    notBefore: string,
+    notOnOrAfter: string
+  ) {
+    if (this.options.acceptedClockSkewMs == -1) return null;
 
     if (notBefore) {
       const notBeforeMs = Date.parse(notBefore);
       if (nowMs + this.options.acceptedClockSkewMs < notBeforeMs)
-          return new Error('SAML assertion not yet valid');
+        return new Error("SAML assertion not yet valid");
     }
     if (notOnOrAfter) {
       const notOnOrAfterMs = Date.parse(notOnOrAfter);
       if (nowMs - this.options.acceptedClockSkewMs >= notOnOrAfterMs)
-        return new Error('SAML assertion expired');
+        return new Error("SAML assertion expired");
     }
 
     return null;
   }
 
-  checkAudienceValidityError(expectedAudience: string, audienceRestrictions: AudienceRestrictionXML[]) {
+  checkAudienceValidityError(
+    expectedAudience: string,
+    audienceRestrictions: AudienceRestrictionXML[]
+  ) {
     if (!audienceRestrictions || audienceRestrictions.length < 1) {
-      return new Error('SAML assertion has no AudienceRestriction');
-    }
-    const errors = audienceRestrictions.map((restriction) => {
-      if (!restriction.Audience || !restriction.Audience[0] || !restriction.Audience[0]._) {
-        return new Error('SAML assertion AudienceRestriction has no Audience value');
-      }
-      if (restriction.Audience[0]._ !== expectedAudience) {
-        return new Error('SAML assertion audience mismatch');
-      }
-      return null;
-    }).filter(result => {
-      return result !== null;
-    });
+      return new Error("SAML assertion has no AudienceRestriction");
+    }
+    const errors = audienceRestrictions
+      .map((restriction) => {
+        if (
+          !restriction.Audience ||
+          !restriction.Audience[0] ||
+          !restriction.Audience[0]._
+        ) {
+          return new Error(
+            "SAML assertion AudienceRestriction has no Audience value"
+          );
+        }
+        if (restriction.Audience[0]._ !== expectedAudience) {
+          return new Error("SAML assertion audience mismatch");
+        }
+        return null;
+      })
+      .filter((result) => {
+        return result !== null;
+      });
     if (errors.length > 0) {
       return errors[0];
     }
@@ -1201,23 +1527,37 @@ class SAML {
   /**
    * @deprecated
    */
-  validatePostRequest(container: Record<string, string>, callback: (err: Error | null, profile?: Profile, loggedOut?: boolean) => void) {
-    this.validatePostRequestAsync(container).then((res) => callback(null, res.profile, res.loggedOut)).catch(err => callback(err));
+  validatePostRequest(
+    container: Record<string, string>,
+    callback: (
+      err: Error | null,
+      profile?: Profile,
+      loggedOut?: boolean
+    ) => void
+  ) {
+    this.validatePostRequestAsync(container)
+      .then((res) => callback(null, res.profile, res.loggedOut))
+      .catch((err) => callback(err));
   }
 
-  async validatePostRequestAsync(container: Record<string, string>): Promise<{profile?: Profile, loggedOut?: boolean}> {
-    const xml = Buffer.from(container.SAMLRequest, 'base64').toString('utf8');
+  async validatePostRequestAsync(
+    container: Record<string, string>
+  ): Promise<{ profile?: Profile; loggedOut?: boolean }> {
+    const xml = Buffer.from(container.SAMLRequest, "base64").toString("utf8");
     const dom = new xmldom.DOMParser().parseFromString(xml);
     const parserConfig = {
       explicitRoot: true,
       explicitCharkey: true,
-      tagNameProcessors: [xml2js.processors.stripPrefix]
+      tagNameProcessors: [xml2js.processors.stripPrefix],
     };
     const parser = new xml2js.Parser(parserConfig);
     const doc = await parser.parseStringPromise(xml);
     const certs = await this.certsToCheck();
-    if (this.options.cert && !this.validateSignature(xml, dom.documentElement, certs!)) {
-      throw new Error('Invalid signature on documentElement');
+    if (
+      this.options.cert &&
+      !this.validateSignature(xml, dom.documentElement, certs!)
+    ) {
+      throw new Error("Invalid signature on documentElement");
     }
     return await processValidlySignedPostRequestAsync(this, doc, dom);
   }
@@ -1225,120 +1565,148 @@ class SAML {
   /**
    * @deprecated
    */
-  getNameID(self: SAML, doc: Node, callback: (err: Error | null, nameID?: XMLOutput) => void) {
-    return util.callbackify(() => this.getNameIDAsync(self, doc)).bind(this)(callback);
+  getNameID(
+    self: SAML,
+    doc: Node,
+    callback: (err: Error | null, nameID?: XMLOutput) => void
+  ) {
+    return util.callbackify(() => this.getNameIDAsync(self, doc)).bind(this)(
+      callback
+    );
   }
 
   async getNameIDAsync(self: SAML, doc: Node): Promise<NameID> {
-    const nameIds = xmlCrypto.xpath(doc, "/*[local-name()='LogoutRequest']/*[local-name()='NameID']") as Node[];
-    const encryptedIds = xmlCrypto.xpath(doc,
-      "/*[local-name()='LogoutRequest']/*[local-name()='EncryptedID']") as Node[];
+    const nameIds = xmlCrypto.xpath(
+      doc,
+      "/*[local-name()='LogoutRequest']/*[local-name()='NameID']"
+    ) as Node[];
+    const encryptedIds = xmlCrypto.xpath(
+      doc,
+      "/*[local-name()='LogoutRequest']/*[local-name()='EncryptedID']"
+    ) as Node[];
 
     if (nameIds.length + encryptedIds.length > 1) {
-      throw new Error('Invalid LogoutRequest');
+      throw new Error("Invalid LogoutRequest");
     }
     if (nameIds.length === 1) {
       return promiseWithNameID(nameIds[0]);
     }
     if (encryptedIds.length === 1) {
       if (!self.options.decryptionPvk) {
-        throw new Error('No decryption key for encrypted SAML response');
+        throw new Error("No decryption key for encrypted SAML response");
       }
 
-      const encryptedDatas = xmlCrypto.xpath(encryptedIds[0], "./*[local-name()='EncryptedData']");
+      const encryptedDatas = xmlCrypto.xpath(
+        encryptedIds[0],
+        "./*[local-name()='EncryptedData']"
+      );
 
       if (encryptedDatas.length !== 1) {
-        throw new Error('Invalid LogoutRequest');
+        throw new Error("Invalid LogoutRequest");
       }
       const encryptedDataXml = encryptedDatas[0].toString();
 
       const xmlencOptions = { key: self.options.decryptionPvk };
-      const decryptedXml: string = await util.promisify(xmlenc.decrypt).bind(xmlenc)(encryptedDataXml, xmlencOptions);
+      const decryptedXml: string = await util
+        .promisify(xmlenc.decrypt)
+        .bind(xmlenc)(encryptedDataXml, xmlencOptions);
       const decryptedDoc = new xmldom.DOMParser().parseFromString(decryptedXml);
-      const decryptedIds = xmlCrypto.xpath(decryptedDoc, "/*[local-name()='NameID']") as Node[];
+      const decryptedIds = xmlCrypto.xpath(
+        decryptedDoc,
+        "/*[local-name()='NameID']"
+      ) as Node[];
       if (decryptedIds.length !== 1) {
-        throw new Error('Invalid EncryptedAssertion content');
+        throw new Error("Invalid EncryptedAssertion content");
       }
       return await promiseWithNameID(decryptedIds[0]);
     }
-    throw new Error('Missing SAML NameID');
+    throw new Error("Missing SAML NameID");
   }
 
-  generateServiceProviderMetadata( decryptionCert: string | null, signingCert?: string | null ) {
+  generateServiceProviderMetadata(
+    decryptionCert: string | null,
+    signingCert?: string | null
+  ) {
     const metadata: ServiceMetadataXML = {
-      'EntityDescriptor' : {
-        '@xmlns': 'urn:oasis:names:tc:SAML:2.0:metadata',
-        '@xmlns:ds': 'http://www.w3.org/2000/09/xmldsig#',
-        '@entityID': this.options.issuer,
-        '@ID': this.options.issuer.replace(/\W/g, '_'),
-        'SPSSODescriptor' : {
-          '@protocolSupportEnumeration': 'urn:oasis:names:tc:SAML:2.0:protocol',
+      EntityDescriptor: {
+        "@xmlns": "urn:oasis:names:tc:SAML:2.0:metadata",
+        "@xmlns:ds": "http://www.w3.org/2000/09/xmldsig#",
+        "@entityID": this.options.issuer,
+        "@ID": this.options.issuer.replace(/\W/g, "_"),
+        SPSSODescriptor: {
+          "@protocolSupportEnumeration": "urn:oasis:names:tc:SAML:2.0:protocol",
         },
-      }
+      },
     };
 
     if (this.options.decryptionPvk) {
       if (!decryptionCert) {
         throw new Error(
-          "Missing decryptionCert while generating metadata for decrypting service provider");
+          "Missing decryptionCert while generating metadata for decrypting service provider"
+        );
       }
     }
-    if(this.options.privateKey){
-      if(!signingCert){
+    if (this.options.privateKey) {
+      if (!signingCert) {
         throw new Error(
-          "Missing signingCert while generating metadata for signing service provider messages");
+          "Missing signingCert while generating metadata for signing service provider messages"
+        );
       }
     }
 
-    if(this.options.decryptionPvk || this.options.privateKey){
-      metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor=[];
+    if (this.options.decryptionPvk || this.options.privateKey) {
+      metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor = [];
       if (this.options.privateKey) {
-
-        signingCert = signingCert!.replace( /-+BEGIN CERTIFICATE-+\r?\n?/, '' );
-        signingCert = signingCert.replace( /-+END CERTIFICATE-+\r?\n?/, '' );
-        signingCert = signingCert.replace( /\r\n/g, '\n' );
+        signingCert = signingCert!.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, "");
+        signingCert = signingCert.replace(/-+END CERTIFICATE-+\r?\n?/, "");
+        signingCert = signingCert.replace(/\r\n/g, "\n");
 
         metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor.push({
-          '@use': 'signing',
-          'ds:KeyInfo' : {
-            'ds:X509Data' : {
-              'ds:X509Certificate': {
-                '#text': signingCert
-              }
-            }
-          }
+          "@use": "signing",
+          "ds:KeyInfo": {
+            "ds:X509Data": {
+              "ds:X509Certificate": {
+                "#text": signingCert,
+              },
+            },
+          },
         });
       }
 
       if (this.options.decryptionPvk) {
-
-        decryptionCert = decryptionCert!.replace( /-+BEGIN CERTIFICATE-+\r?\n?/, '' );
-        decryptionCert = decryptionCert.replace( /-+END CERTIFICATE-+\r?\n?/, '' );
-        decryptionCert = decryptionCert.replace( /\r\n/g, '\n' );
+        decryptionCert = decryptionCert!.replace(
+          /-+BEGIN CERTIFICATE-+\r?\n?/,
+          ""
+        );
+        decryptionCert = decryptionCert.replace(
+          /-+END CERTIFICATE-+\r?\n?/,
+          ""
+        );
+        decryptionCert = decryptionCert.replace(/\r\n/g, "\n");
 
         metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor.push({
-          '@use': 'encryption',
-          'ds:KeyInfo' : {
-            'ds:X509Data' : {
-              'ds:X509Certificate': {
-                '#text': decryptionCert
-              }
-            }
+          "@use": "encryption",
+          "ds:KeyInfo": {
+            "ds:X509Data": {
+              "ds:X509Certificate": {
+                "#text": decryptionCert,
+              },
+            },
           },
-          'EncryptionMethod' : [
+          EncryptionMethod: [
             // this should be the set that the xmlenc library supports
-            { '@Algorithm': 'http://www.w3.org/2001/04/xmlenc#aes256-cbc' },
-            { '@Algorithm': 'http://www.w3.org/2001/04/xmlenc#aes128-cbc' },
-            { '@Algorithm': 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc' }
-          ]
+            { "@Algorithm": "http://www.w3.org/2001/04/xmlenc#aes256-cbc" },
+            { "@Algorithm": "http://www.w3.org/2001/04/xmlenc#aes128-cbc" },
+            { "@Algorithm": "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" },
+          ],
         });
       }
     }
 
     if (this.options.logoutCallbackUrl) {
       metadata.EntityDescriptor.SPSSODescriptor.SingleLogoutService = {
-        '@Binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-        '@Location': this.options.logoutCallbackUrl
+        "@Binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+        "@Location": this.options.logoutCallbackUrl,
       };
     }
 
@@ -1347,30 +1715,32 @@ class SAML {
     }
 
     metadata.EntityDescriptor.SPSSODescriptor.AssertionConsumerService = {
-      '@index': '1',
-      '@isDefault': 'true',
-      '@Binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-      '@Location': this.getCallbackUrl({})
+      "@index": "1",
+      "@isDefault": "true",
+      "@Binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+      "@Location": this.getCallbackUrl({}),
     };
-    return xmlbuilder.create(metadata as unknown as Record<string, any>).end({ pretty: true, indent: '  ', newline: '\n' });
+    return xmlbuilder
+      .create((metadata as unknown) as Record<string, any>)
+      .end({ pretty: true, indent: "  ", newline: "\n" });
   }
 
   keyToPEM(key: crypto.KeyLike) {
-    if (!key || typeof key !== 'string') return key;
+    if (!key || typeof key !== "string") return key;
 
     const lines = key.split(/\r?\n/);
     if (lines.length !== 1) return key;
 
     const wrappedKey = [
-      '-----BEGIN PRIVATE KEY-----',
+      "-----BEGIN PRIVATE KEY-----",
       ...(key.match(/.{1,64}/g) ?? []),
-      '-----END PRIVATE KEY-----',
-      ''
-    ].join('\n');
+      "-----END PRIVATE KEY-----",
+      "",
+    ].join("\n");
     return wrappedKey;
   }
 
-  normalizeNewlines(xml : string) : string {
+  normalizeNewlines(xml: string): string {
     // we can use this utility before passing XML to `xml-crypto`
     // we are considered the XML processor and are responsible for newline normalization
     // https://github.com/node-saml/passport-saml/issues/431#issuecomment-718132752
diff --git a/src/passport-saml/strategy.ts b/src/passport-saml/strategy.ts
index f8cb12ba..646bfac5 100644
--- a/src/passport-saml/strategy.ts
+++ b/src/passport-saml/strategy.ts
@@ -1,8 +1,15 @@
-import { Strategy as PassportStrategy } from 'passport-strategy';
-import * as saml from './saml';
-import * as url from 'url';
-import { AuthenticateOptions, AuthorizeOptions, RequestWithUser, SamlConfig, VerifyWithoutRequest, VerifyWithRequest } from './types';
-import { Profile } from './types';
+import { Strategy as PassportStrategy } from "passport-strategy";
+import * as saml from "./saml";
+import * as url from "url";
+import {
+  AuthenticateOptions,
+  AuthorizeOptions,
+  RequestWithUser,
+  SamlConfig,
+  VerifyWithoutRequest,
+  VerifyWithRequest,
+} from "./types";
+import { Profile } from "./types";
 
 class Strategy extends PassportStrategy {
   name: string;
@@ -11,67 +18,85 @@ class Strategy extends PassportStrategy {
   _passReqToCallback?: boolean;
   _authnRequestBinding?: string;
 
-  constructor(options: SamlConfig, verify: VerifyWithRequest | VerifyWithoutRequest) {
+  constructor(
+    options: SamlConfig,
+    verify: VerifyWithRequest | VerifyWithoutRequest
+  ) {
     super();
-    if (typeof options == 'function') {
+    if (typeof options == "function") {
       verify = options;
       options = {};
     }
 
     if (!verify) {
-      throw new Error('SAML authentication strategy requires a verify function');
+      throw new Error(
+        "SAML authentication strategy requires a verify function"
+      );
     }
 
     // Customizing the name can be useful to support multiple SAML configurations at the same time.
     // Unlike other options, this one gets deleted instead of passed along.
-    if  (options.name) {
-      this.name  = options.name;
+    if (options.name) {
+      this.name = options.name;
     } else {
-      this.name = 'saml';
+      this.name = "saml";
     }
 
-
     this._verify = verify;
     this._saml = new saml.SAML(options);
     this._passReqToCallback = !!options.passReqToCallback;
-    this._authnRequestBinding = options.authnRequestBinding || 'HTTP-Redirect';
+    this._authnRequestBinding = options.authnRequestBinding || "HTTP-Redirect";
   }
 
-  authenticate(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions): void {
+  authenticate(
+    req: RequestWithUser,
+    options: AuthenticateOptions & AuthorizeOptions
+  ): void {
+    options.samlFallback = options.samlFallback || "login-request";
+
+    const validateCallback = (
+      err: Error | null,
+      profile?: Profile | null,
+      loggedOut?: boolean
+    ) => {
+      if (err) {
+        return this.error(err);
+      }
 
-    options.samlFallback = options.samlFallback || 'login-request';
+      if (loggedOut) {
+        req.logout();
+        if (profile) {
+          req.samlLogoutRequest = profile;
+          return this._saml.getLogoutResponseUrl(
+            req,
+            options,
+            redirectIfSuccess
+          );
+        }
+        return this.pass();
+      }
 
-    const validateCallback = (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => {
+      const verified = (
+        err: Error | null,
+        user?: Record<string, unknown>,
+        info?: Record<string, unknown>
+      ) => {
         if (err) {
           return this.error(err);
         }
 
-        if (loggedOut) {
-          req.logout();
-          if (profile) {
-            req.samlLogoutRequest = profile;
-            return this._saml.getLogoutResponseUrl(req, options, redirectIfSuccess);
-          }
-          return this.pass();
+        if (!user) {
+          return this.fail(info, 401);
         }
 
-        const verified = (err: Error | null, user?: Record<string, unknown>, info?: Record<string, unknown>) => {
-          if (err) {
-            return this.error(err);
-          }
+        this.success(user, info);
+      };
 
-          if (!user) {
-            return this.fail(info, 401);
-          }
-
-          this.success(user, info);
-        };
-
-        if (this._passReqToCallback) {
-          (this._verify as VerifyWithRequest)(req, profile, verified);
-        } else {
-          (this._verify as VerifyWithoutRequest)(profile, verified);
-        }
+      if (this._passReqToCallback) {
+        (this._verify as VerifyWithRequest)(req, profile, verified);
+      } else {
+        (this._verify as VerifyWithoutRequest)(profile, verified);
+      }
     };
 
     const redirectIfSuccess = (err: Error | null, url?: string | null) => {
@@ -91,26 +116,30 @@ class Strategy extends PassportStrategy {
       this._saml.validatePostRequest(req.body, validateCallback);
     } else {
       const requestHandler = {
-        'login-request': () => {
-          if (this._authnRequestBinding === 'HTTP-POST') {
-            this._saml.getAuthorizeForm(req, (err: Error | null, data?: any) => {
-              if (err) {
-                this.error(err);
-              } else {
-                const res = req.res!;
-                res.send(data);
+        "login-request": () => {
+          if (this._authnRequestBinding === "HTTP-POST") {
+            this._saml.getAuthorizeForm(
+              req,
+              (err: Error | null, data?: any) => {
+                if (err) {
+                  this.error(err);
+                } else {
+                  const res = req.res!;
+                  res.send(data);
+                }
               }
-            });
-          } else { // Defaults to HTTP-Redirect
+            );
+          } else {
+            // Defaults to HTTP-Redirect
             this._saml.getAuthorizeUrl(req, options, redirectIfSuccess);
           }
         },
-        'logout-request': () => {
-            this._saml.getLogoutUrl(req, options, redirectIfSuccess);
-        }
+        "logout-request": () => {
+          this._saml.getLogoutUrl(req, options, redirectIfSuccess);
+        },
       }[options.samlFallback];
 
-      if (typeof requestHandler !== 'function') {
+      if (typeof requestHandler !== "function") {
         return this.fail(401);
       }
 
@@ -118,12 +147,21 @@ class Strategy extends PassportStrategy {
     }
   }
 
-  logout(req: RequestWithUser, callback: (err: Error | null, url?: string | null) => void): void {
+  logout(
+    req: RequestWithUser,
+    callback: (err: Error | null, url?: string | null) => void
+  ): void {
     this._saml.getLogoutUrl(req, {}, callback);
   }
 
-  generateServiceProviderMetadata( decryptionCert: string | null, signingCert?: string | null ): string {
-    return this._saml.generateServiceProviderMetadata( decryptionCert, signingCert );
+  generateServiceProviderMetadata(
+    decryptionCert: string | null,
+    signingCert?: string | null
+  ): string {
+    return this._saml.generateServiceProviderMetadata(
+      decryptionCert,
+      signingCert
+    );
   }
 }
 
diff --git a/src/passport-saml/types.ts b/src/passport-saml/types.ts
index ffe1f4ea..93bb4b05 100644
--- a/src/passport-saml/types.ts
+++ b/src/passport-saml/types.ts
@@ -1,71 +1,73 @@
-import type * as express from 'express';
-import * as passport from 'passport';
-import type { CacheProvider } from './inmemory-cache-provider';
+import type * as express from "express";
+import * as passport from "passport";
+import type { CacheProvider } from "./inmemory-cache-provider";
 
-export type CertCallback = (callback: (err: Error | null, cert?: string | string[]) => void) => void;
+export type CertCallback = (
+  callback: (err: Error | null, cert?: string | string[]) => void
+) => void;
 
 export interface AuthenticateOptions extends passport.AuthenticateOptions {
   additionalParams?: Record<string, any>;
 }
 
 export interface AuthorizeOptions extends AuthenticateOptions {
-  samlFallback?: 'login-request' | 'logout-request';
+  samlFallback?: "login-request" | "logout-request";
 }
 
 export interface SAMLOptions {
-    // Core
-    callbackUrl: string;
-    path: string;
-    protocol: string;
-    host: string;
-    entryPoint: string;
-    issuer: string;
-    /** @deprecated use privateKey field instead */
-    privateCert?: string;
-    privateKey: string;
-    cert: string | string[] | CertCallback;
-    decryptionPvk: string;
-    signatureAlgorithm: 'sha1' | 'sha256' | 'sha512';
-
-    // Additional SAML behaviors
-    additionalParams: Record<string, string>;
-    additionalAuthorizeParams: Record<string, string>;
-    identifierFormat: string;
-    acceptedClockSkewMs: number;
-    attributeConsumingServiceIndex: string | null;
-    disableRequestedAuthnContext: boolean;
-    authnContext: string | string[];
-    forceAuthn: boolean;
-    skipRequestCompression: boolean;
-    RACComparison: 'exact' | 'minimum' | 'maximum' | 'better';
-    providerName: string;
-    passive: boolean;
-    idpIssuer: string;
-    audience: string;
-    scoping : SamlScopingConfig;
-
-    // InResponseTo Validation
-    validateInResponseTo: boolean;
-    requestIdExpirationPeriodMs: number;
-    cacheProvider: CacheProvider;
-
-    // Logout
-    logoutUrl: string;
-    additionalLogoutParams: Record<string, string>;
-    logoutCallbackUrl: string;
-
-    // extras
-    xmlSignatureTransforms: string[];
-    digestAlgorithm: string;
-    disableRequestACSUrl: boolean;
+  // Core
+  callbackUrl: string;
+  path: string;
+  protocol: string;
+  host: string;
+  entryPoint: string;
+  issuer: string;
+  /** @deprecated use privateKey field instead */
+  privateCert?: string;
+  privateKey: string;
+  cert: string | string[] | CertCallback;
+  decryptionPvk: string;
+  signatureAlgorithm: "sha1" | "sha256" | "sha512";
+
+  // Additional SAML behaviors
+  additionalParams: Record<string, string>;
+  additionalAuthorizeParams: Record<string, string>;
+  identifierFormat: string;
+  acceptedClockSkewMs: number;
+  attributeConsumingServiceIndex: string | null;
+  disableRequestedAuthnContext: boolean;
+  authnContext: string | string[];
+  forceAuthn: boolean;
+  skipRequestCompression: boolean;
+  RACComparison: "exact" | "minimum" | "maximum" | "better";
+  providerName: string;
+  passive: boolean;
+  idpIssuer: string;
+  audience: string;
+  scoping: SamlScopingConfig;
+
+  // InResponseTo Validation
+  validateInResponseTo: boolean;
+  requestIdExpirationPeriodMs: number;
+  cacheProvider: CacheProvider;
+
+  // Logout
+  logoutUrl: string;
+  additionalLogoutParams: Record<string, string>;
+  logoutCallbackUrl: string;
+
+  // extras
+  xmlSignatureTransforms: string[];
+  digestAlgorithm: string;
+  disableRequestACSUrl: boolean;
 }
 
-export type SamlConfig = Partial<SAMLOptions> & StrategyOptions
+export type SamlConfig = Partial<SAMLOptions> & StrategyOptions;
 
 interface StrategyOptions {
-    name?: string;
-    passReqToCallback?: boolean;
-    authnRequestBinding?: string;
+  name?: string;
+  passReqToCallback?: boolean;
+  authnRequestBinding?: string;
 }
 
 export interface SamlScopingConfig {
@@ -74,7 +76,13 @@ export interface SamlScopingConfig {
   requesterId?: string[];
 }
 
-export type XMLValue = string | number | boolean | null | XMLObject | XMLValue[];
+export type XMLValue =
+  | string
+  | number
+  | boolean
+  | null
+  | XMLObject
+  | XMLValue[];
 
 export type XMLObject = {
   [key: string]: XMLValue;
@@ -83,12 +91,12 @@ export type XMLObject = {
 export type XMLInput = XMLObject;
 
 export interface AuthorizeRequestXML {
-  'samlp:AuthnRequest': XMLInput;
+  "samlp:AuthnRequest": XMLInput;
 }
 
 export interface LogoutRequestXML {
-  'samlp:LogoutRequest': {
-    'saml:NameID': XMLInput;
+  "samlp:LogoutRequest": {
+    "saml:NameID": XMLInput;
     [key: string]: XMLValue;
   };
 }
@@ -118,35 +126,49 @@ export interface SamlIDPEntryConfig {
 }
 
 export type Profile = {
-    issuer?: string;
-    sessionIndex?: string;
-    nameID?: string;
-    nameIDFormat?: string;
-    nameQualifier?: string;
-    spNameQualifier?: string;
-    ID?: string;
-    mail?: string; // InCommon Attribute urn:oid:0.9.2342.19200300.100.1.3
-    email?: string; // `mail` if not present in the assertion
-    ['urn:oid:0.9.2342.19200300.100.1.3']?: string;
-    getAssertionXml(): string; // get the raw assertion XML
-    getAssertion(): Record<string, unknown>; // get the assertion XML parsed as a JavaScript object
-    getSamlResponseXml(): string; // get the raw SAML response XML
-  } & {
-    [attributeName: string]: unknown; // arbitrary `AttributeValue`s
-  };
+  issuer?: string;
+  sessionIndex?: string;
+  nameID?: string;
+  nameIDFormat?: string;
+  nameQualifier?: string;
+  spNameQualifier?: string;
+  ID?: string;
+  mail?: string; // InCommon Attribute urn:oid:0.9.2342.19200300.100.1.3
+  email?: string; // `mail` if not present in the assertion
+  ["urn:oid:0.9.2342.19200300.100.1.3"]?: string;
+  getAssertionXml(): string; // get the raw assertion XML
+  getAssertion(): Record<string, unknown>; // get the assertion XML parsed as a JavaScript object
+  getSamlResponseXml(): string; // get the raw SAML response XML
+} & {
+  [attributeName: string]: unknown; // arbitrary `AttributeValue`s
+};
 
-  export interface RequestWithUser extends express.Request {
-    samlLogoutRequest: any;
-    user?: Profile
+export interface RequestWithUser extends express.Request {
+  samlLogoutRequest: any;
+  user?: Profile;
 }
 
-export type VerifiedCallback = (err: Error | null, user?: Record<string, unknown>, info?: Record<string, unknown>) => void;
-
-export type VerifyWithRequest = (req: express.Request, profile: Profile | null | undefined, done: VerifiedCallback) => void;
-
-export type VerifyWithoutRequest = (profile: Profile | null | undefined, done: VerifiedCallback) => void;
-
-export type SamlOptionsCallback = (err: Error | null, samlOptions?: SamlConfig) => void;
+export type VerifiedCallback = (
+  err: Error | null,
+  user?: Record<string, unknown>,
+  info?: Record<string, unknown>
+) => void;
+
+export type VerifyWithRequest = (
+  req: express.Request,
+  profile: Profile | null | undefined,
+  done: VerifiedCallback
+) => void;
+
+export type VerifyWithoutRequest = (
+  profile: Profile | null | undefined,
+  done: VerifiedCallback
+) => void;
+
+export type SamlOptionsCallback = (
+  err: Error | null,
+  samlOptions?: SamlConfig
+) => void;
 
 export interface MultiSamlConfig extends SamlConfig {
   getSamlOptions(req: express.Request, callback: SamlOptionsCallback): void;
diff --git a/test/mocha.opts b/test/mocha.opts
index fb5f8242..36c76021 100644
--- a/test/mocha.opts
+++ b/test/mocha.opts
@@ -1 +1,2 @@
---reporter spec
\ No newline at end of file
+--reporter spec
+--require choma
\ No newline at end of file
diff --git a/test/multiSamlStrategy.js b/test/multiSamlStrategy.js
index 95419eee..265226a6 100644
--- a/test/multiSamlStrategy.js
+++ b/test/multiSamlStrategy.js
@@ -1,37 +1,47 @@
-'use strict';
+"use strict";
 
-var sinon = require('sinon');
-var should = require( 'should' );
-var SamlStrategy = require( '../lib/passport-saml/index.js' ).Strategy;
-var MultiSamlStrategy = require( '../multiSamlStrategy' );
+var sinon = require("sinon");
+var should = require("should");
+var SamlStrategy = require("../lib/passport-saml/index.js").Strategy;
+var MultiSamlStrategy = require("../multiSamlStrategy");
 
-function verify () {}
+function verify() {}
 
-describe('Strategy()', function() {
-  it('extends passport Strategy', function() {
-    function getSamlOptions () { return {} }
-    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
+describe("Strategy()", function () {
+  it("extends passport Strategy", function () {
+    function getSamlOptions() {
+      return {};
+    }
+    var strategy = new MultiSamlStrategy(
+      { getSamlOptions: getSamlOptions },
+      verify
+    );
     strategy.should.be.an.instanceOf(SamlStrategy);
   });
 
-  it('throws if wrong finder is provided', function() {
-    function createStrategy (){ return new MultiSamlStrategy({}, verify) };
+  it("throws if wrong finder is provided", function () {
+    function createStrategy() {
+      return new MultiSamlStrategy({}, verify);
+    }
     should.throws(createStrategy);
-   });
+  });
 });
 
-describe('strategy#authenticate', function() {
-  beforeEach(function() {
-    this.superAuthenticateStub = sinon.stub(SamlStrategy.prototype, 'authenticate');
+describe("strategy#authenticate", function () {
+  beforeEach(function () {
+    this.superAuthenticateStub = sinon.stub(
+      SamlStrategy.prototype,
+      "authenticate"
+    );
   });
 
-  afterEach(function() {
+  afterEach(function () {
     this.superAuthenticateStub.restore();
   });
 
-  it('calls super with request and auth options', function(done) {
+  it("calls super with request and auth options", function (done) {
     var superAuthenticateStub = this.superAuthenticateStub;
-    function getSamlOptions (req, fn) {
+    function getSamlOptions(req, fn) {
       try {
         fn();
         sinon.assert.calledOnce(superAuthenticateStub);
@@ -39,58 +49,63 @@ describe('strategy#authenticate', function() {
       } catch (err2) {
         done(err2);
       }
-    };
+    }
 
-    var strategy = new MultiSamlStrategy({
-      getSamlOptions: getSamlOptions
-    }, verify);
+    var strategy = new MultiSamlStrategy(
+      {
+        getSamlOptions: getSamlOptions,
+      },
+      verify
+    );
     strategy.authenticate();
   });
 
-  it('passes options on to saml strategy', function(done) {
+  it("passes options on to saml strategy", function (done) {
     var passportOptions = {
       passReqToCallback: true,
-      authnRequestBinding: 'HTTP-POST',
+      authnRequestBinding: "HTTP-POST",
       getSamlOptions: function (req, fn) {
         try {
           fn();
           strategy._passReqToCallback.should.eql(true);
-          strategy._authnRequestBinding.should.eql('HTTP-POST');
+          strategy._authnRequestBinding.should.eql("HTTP-POST");
           done();
         } catch (err2) {
           done(err2);
         }
-      }
+      },
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
     strategy.authenticate();
   });
 
-  it('uses given options to setup internal saml provider', function(done) {
+  it("uses given options to setup internal saml provider", function (done) {
     var superAuthenticateStub = this.superAuthenticateStub;
     var samlOptions = {
-      issuer: 'http://foo.issuer',
-      callbackUrl: 'http://foo.callback',
-      cert: 'deadbeef',
-      host: 'lvh',
+      issuer: "http://foo.issuer",
+      callbackUrl: "http://foo.callback",
+      cert: "deadbeef",
+      host: "lvh",
       acceptedClockSkewMs: -1,
       identifierFormat:
-        'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-      path: '/saml/callback',
-      logoutUrl: 'http://foo.slo',
-      signatureAlgorithm: 'sha256'
+        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+      path: "/saml/callback",
+      logoutUrl: "http://foo.slo",
+      signatureAlgorithm: "sha256",
     };
 
-    function getSamlOptions (req, fn) {
+    function getSamlOptions(req, fn) {
       try {
         fn(null, samlOptions);
-        sinon.assert.calledOnce(superAuthenticateStub)
-        superAuthenticateStub.calledWith(Object.assign(
-          {},
-          { cacheProvider: 'mock cache provider' },
-          samlOptions
-        ));
+        sinon.assert.calledOnce(superAuthenticateStub);
+        superAuthenticateStub.calledWith(
+          Object.assign(
+            {},
+            { cacheProvider: "mock cache provider" },
+            samlOptions
+          )
+        );
         done();
       } catch (err2) {
         done(err2);
@@ -98,25 +113,25 @@ describe('strategy#authenticate', function() {
     }
 
     var strategy = new MultiSamlStrategy(
-      { getSamlOptions: getSamlOptions, cacheProvider: 'mock cache provider'},
+      { getSamlOptions: getSamlOptions, cacheProvider: "mock cache provider" },
       verify
     );
     strategy.authenticate();
   });
 });
 
-describe('strategy#logout', function() {
-  beforeEach(function() {
-    this.superLogoutMock = sinon.stub(SamlStrategy.prototype, 'logout');
+describe("strategy#logout", function () {
+  beforeEach(function () {
+    this.superLogoutMock = sinon.stub(SamlStrategy.prototype, "logout");
   });
 
-  afterEach(function() {
+  afterEach(function () {
     this.superLogoutMock.restore();
   });
 
-  it('calls super with request and auth options', function(done) {
+  it("calls super with request and auth options", function (done) {
     var superLogoutMock = this.superLogoutMock;
-    function getSamlOptions (req, fn) {
+    function getSamlOptions(req, fn) {
       try {
         fn();
         sinon.assert.calledOnce(superLogoutMock);
@@ -124,55 +139,55 @@ describe('strategy#logout', function() {
       } catch (err2) {
         done(err2);
       }
-    };
+    }
 
-    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
+    var strategy = new MultiSamlStrategy(
+      { getSamlOptions: getSamlOptions },
+      verify
+    );
     strategy.logout();
   });
 
-  it('passes options on to saml strategy', function(done) {
+  it("passes options on to saml strategy", function (done) {
     var passportOptions = {
       passReqToCallback: true,
-      authnRequestBinding: 'HTTP-POST',
+      authnRequestBinding: "HTTP-POST",
       getSamlOptions: function (req, fn) {
         try {
           fn();
           strategy._passReqToCallback.should.eql(true);
-          strategy._authnRequestBinding.should.eql('HTTP-POST');
+          strategy._authnRequestBinding.should.eql("HTTP-POST");
           done();
         } catch (err2) {
           done(err2);
         }
-      }
+      },
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
     strategy.logout();
   });
 
-  it('uses given options to setup internal saml provider', function(done) {
+  it("uses given options to setup internal saml provider", function (done) {
     var superLogoutMock = this.superLogoutMock;
     var samlOptions = {
-      issuer: 'http://foo.issuer',
-      callbackUrl: 'http://foo.callback',
-      cert: 'deadbeef',
-      host: 'lvh',
+      issuer: "http://foo.issuer",
+      callbackUrl: "http://foo.callback",
+      cert: "deadbeef",
+      host: "lvh",
       acceptedClockSkewMs: -1,
       identifierFormat:
-        'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-      path: '/saml/callback',
-      logoutUrl: 'http://foo.slo',
-      signatureAlgorithm: 'sha256'
+        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+      path: "/saml/callback",
+      logoutUrl: "http://foo.slo",
+      signatureAlgorithm: "sha256",
     };
 
-    function getSamlOptions (req, fn) {
+    function getSamlOptions(req, fn) {
       try {
         fn(null, samlOptions);
-        sinon.assert.calledOnce(superLogoutMock)
-        superLogoutMock.calledWith(Object.assign(
-          {},
-          samlOptions
-        ));
+        sinon.assert.calledOnce(superLogoutMock);
+        superLogoutMock.calledWith(Object.assign({}, samlOptions));
         done();
       } catch (err2) {
         done(err2);
@@ -187,87 +202,112 @@ describe('strategy#logout', function() {
   });
 });
 
-describe('strategy#generateServiceProviderMetadata', function() {
-  beforeEach(function() {
-    this.superGenerateServiceProviderMetadata = sinon.stub(SamlStrategy.prototype, 'generateServiceProviderMetadata').returns('My Metadata Result');
+describe("strategy#generateServiceProviderMetadata", function () {
+  beforeEach(function () {
+    this.superGenerateServiceProviderMetadata = sinon
+      .stub(SamlStrategy.prototype, "generateServiceProviderMetadata")
+      .returns("My Metadata Result");
   });
 
-  afterEach(function() {
+  afterEach(function () {
     this.superGenerateServiceProviderMetadata.restore();
   });
 
-  it('calls super with request and generateServiceProviderMetadata options', function(done) {
-    var superGenerateServiceProviderMetadata = this.superGenerateServiceProviderMetadata;
-    function getSamlOptions (req, fn) {
+  it("calls super with request and generateServiceProviderMetadata options", function (done) {
+    var superGenerateServiceProviderMetadata = this
+      .superGenerateServiceProviderMetadata;
+    function getSamlOptions(req, fn) {
       try {
         fn();
         sinon.assert.calledOnce(superGenerateServiceProviderMetadata);
-        superGenerateServiceProviderMetadata.calledWith('bar', 'baz');
-        req.should.eql('foo');
+        superGenerateServiceProviderMetadata.calledWith("bar", "baz");
+        req.should.eql("foo");
         done();
       } catch (err2) {
         done(err2);
       }
-    };
-
+    }
 
-    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
-    strategy.generateServiceProviderMetadata('foo', 'bar', 'baz', function () {});
+    var strategy = new MultiSamlStrategy(
+      { getSamlOptions: getSamlOptions },
+      verify
+    );
+    strategy.generateServiceProviderMetadata(
+      "foo",
+      "bar",
+      "baz",
+      function () {}
+    );
   });
 
-  it('passes options on to saml strategy', function(done) {
+  it("passes options on to saml strategy", function (done) {
     var passportOptions = {
       passReqToCallback: true,
-      authnRequestBinding: 'HTTP-POST',
+      authnRequestBinding: "HTTP-POST",
       getSamlOptions: function (req, fn) {
         try {
           fn();
           strategy._passReqToCallback.should.eql(true);
-          strategy._authnRequestBinding.should.eql('HTTP-POST');
+          strategy._authnRequestBinding.should.eql("HTTP-POST");
           done();
         } catch (err2) {
           done(err2);
         }
-      }
+      },
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata('foo', 'bar', 'baz', function () {});
+    strategy.generateServiceProviderMetadata(
+      "foo",
+      "bar",
+      "baz",
+      function () {}
+    );
   });
 
-  it('should pass error to callback function', function(done) {
+  it("should pass error to callback function", function (done) {
     var passportOptions = {
       getSamlOptions: function (req, fn) {
-        fn('My error');
-      }
+        fn("My error");
+      },
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata('foo', 'bar', 'baz', function (error, result) {
-      try {
-        should(error).equal('My error');
-        done();
-      } catch (err2) {
-        done(err2);
+    strategy.generateServiceProviderMetadata(
+      "foo",
+      "bar",
+      "baz",
+      function (error, result) {
+        try {
+          should(error).equal("My error");
+          done();
+        } catch (err2) {
+          done(err2);
+        }
       }
-    });
+    );
   });
 
-  it('should pass result to callback function', function(done) {
+  it("should pass result to callback function", function (done) {
     var passportOptions = {
       getSamlOptions: function (req, fn) {
         fn();
-      }
+      },
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata('foo', 'bar', 'baz', function (error, result) {
-      try {
-        should(result).equal('My Metadata Result');
-        done();
-      } catch (err2) {
-        done(err2);
+    strategy.generateServiceProviderMetadata(
+      "foo",
+      "bar",
+      "baz",
+      function (error, result) {
+        try {
+          should(result).equal("My Metadata Result");
+          done();
+        } catch (err2) {
+          done(err2);
+        }
       }
-    });
+    );
   });
 });
diff --git a/test/saml-post-signing-tests.js b/test/saml-post-signing-tests.js
index a2145980..40c7b705 100644
--- a/test/saml-post-signing-tests.js
+++ b/test/saml-post-signing-tests.js
@@ -1,80 +1,103 @@
-const fs = require('fs');
-const should = require('should');
-const samlPostSigning = require('../lib/passport-saml/saml-post-signing');
+const fs = require("fs");
+const should = require("should");
+const samlPostSigning = require("../lib/passport-saml/saml-post-signing");
 const signSamlPost = samlPostSigning.signSamlPost;
 const signAuthnRequestPost = samlPostSigning.signAuthnRequestPost;
 
-const signingKey = fs.readFileSync(__dirname + '/static/key.pem');
+const signingKey = fs.readFileSync(__dirname + "/static/key.pem");
 
-describe('SAML POST Signing', function () {
-  it('should sign a simple saml request', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
-    var result = signSamlPost(xml, '/SAMLRequest', { privateCert: signingKey });
+describe("SAML POST Signing", function () {
+  it("should sign a simple saml request", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
+    var result = signSamlPost(xml, "/SAMLRequest", { privateCert: signingKey });
     result.should.match(/<DigestValue>[A-Za-z0-9\/\+\=]+<\/DigestValue>/);
     result.should.match(/<SignatureValue>[A-Za-z0-9\/\+\=]+<\/SignatureValue>/);
   });
 
-  it('should sign a simple saml request when using a privateKey', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
-    var result = signSamlPost(xml, '/SAMLRequest', { privateKey: signingKey });
+  it("should sign a simple saml request when using a privateKey", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
+    var result = signSamlPost(xml, "/SAMLRequest", { privateKey: signingKey });
     result.should.match(/<DigestValue>[A-Za-z0-9\/\+\=]+<\/DigestValue>/);
     result.should.match(/<SignatureValue>[A-Za-z0-9\/\+\=]+<\/SignatureValue>/);
   });
 
-  it('should place the Signature element after the Issuer element', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer><SomeOtherElement /></SAMLRequest>';
-    var result = signSamlPost(xml, '/SAMLRequest', { privateCert: signingKey });
+  it("should place the Signature element after the Issuer element", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer><SomeOtherElement /></SAMLRequest>';
+    var result = signSamlPost(xml, "/SAMLRequest", { privateCert: signingKey });
     result.should.match(/<\/saml2:Issuer><Signature/);
     result.should.match(/<\/Signature><SomeOtherElement/);
   });
 
-  it('should place the Signature element after the Issuer element when using a privateKey', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer><SomeOtherElement /></SAMLRequest>';
-    var result = signSamlPost(xml, '/SAMLRequest', { privateKey: signingKey });
+  it("should place the Signature element after the Issuer element when using a privateKey", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer><SomeOtherElement /></SAMLRequest>';
+    var result = signSamlPost(xml, "/SAMLRequest", { privateKey: signingKey });
     result.should.match(/<\/saml2:Issuer><Signature/);
     result.should.match(/<\/Signature><SomeOtherElement/);
   });
 
-  it('should sign and digest with SHA256 when specified', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
+  it("should sign and digest with SHA256 when specified", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
     var options = {
-      signatureAlgorithm: 'sha256',
-      digestAlgorithm: 'sha256',
-      privateCert: signingKey
+      signatureAlgorithm: "sha256",
+      digestAlgorithm: "sha256",
+      privateCert: signingKey,
     };
-    var result = signSamlPost(xml, '/SAMLRequest', options);
-    result.should.match(/<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/);
-    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/);
-    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/);
-    result.should.match(/<DigestMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmlenc#sha256"\/>/);
+    var result = signSamlPost(xml, "/SAMLRequest", options);
+    result.should.match(
+      /<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/
+    );
+    result.should.match(
+      /<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/
+    );
+    result.should.match(
+      /<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/
+    );
+    result.should.match(
+      /<DigestMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmlenc#sha256"\/>/
+    );
   });
 
-  it('should sign and digest with SHA256 when specified and using privateKey', function () {
-    var xml = '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
+  it("should sign and digest with SHA256 when specified and using privateKey", function () {
+    var xml =
+      '<SAMLRequest><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></SAMLRequest>';
     var options = {
-      signatureAlgorithm: 'sha256',
-      digestAlgorithm: 'sha256',
-      privateKey: signingKey
+      signatureAlgorithm: "sha256",
+      digestAlgorithm: "sha256",
+      privateKey: signingKey,
     };
-    var result = signSamlPost(xml, '/SAMLRequest', options);
-    result.should.match(/<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/);
-    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/);
-    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/);
-    result.should.match(/<DigestMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmlenc#sha256"\/>/);
+    var result = signSamlPost(xml, "/SAMLRequest", options);
+    result.should.match(
+      /<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/
+    );
+    result.should.match(
+      /<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/
+    );
+    result.should.match(
+      /<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/
+    );
+    result.should.match(
+      /<DigestMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmlenc#sha256"\/>/
+    );
   });
 
-  it('should sign an AuthnRequest', function () {
-    var xml = '<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></AuthnRequest>';
+  it("should sign an AuthnRequest", function () {
+    var xml =
+      '<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></AuthnRequest>';
     var result = signAuthnRequestPost(xml, { privateCert: signingKey });
     result.should.match(/<DigestValue>[A-Za-z0-9\/\+\=]+<\/DigestValue>/);
     result.should.match(/<SignatureValue>[A-Za-z0-9\/\+\=]+<\/SignatureValue>/);
   });
 
-  it('should sign an AuthnRequest when using a privateKey', function () {
-    var xml = '<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></AuthnRequest>';
+  it("should sign an AuthnRequest when using a privateKey", function () {
+    var xml =
+      '<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://example.com</saml2:Issuer></AuthnRequest>';
     var result = signAuthnRequestPost(xml, { privateKey: signingKey });
     result.should.match(/<DigestValue>[A-Za-z0-9\/\+\=]+<\/DigestValue>/);
     result.should.match(/<SignatureValue>[A-Za-z0-9\/\+\=]+<\/SignatureValue>/);
   });
-
 });
diff --git a/test/samlTests.js b/test/samlTests.js
index 5fec83bb..86848e89 100644
--- a/test/samlTests.js
+++ b/test/samlTests.js
@@ -1,86 +1,88 @@
-'use strict';
-var fs = require('fs');
-var url = require('url');
-var should = require('should');
+"use strict";
+var fs = require("fs");
+var url = require("url");
+var should = require("should");
 
-var SAML = require('../lib/passport-saml/saml.js').SAML;
+var SAML = require("../lib/passport-saml/saml.js").SAML;
 
-describe('SAML.js', function () {
-  describe('get Urls', function () {
+describe("SAML.js", function () {
+  describe("get Urls", function () {
     var saml, req, options;
     beforeEach(function () {
       saml = new SAML({
-        entryPoint: 'https://exampleidp.com/path?key=value',
-        logoutUrl: 'https://exampleidp.com/path?key=value'
+        entryPoint: "https://exampleidp.com/path?key=value",
+        logoutUrl: "https://exampleidp.com/path?key=value",
       });
       req = {
-        protocol: 'https',
+        protocol: "https",
         headers: {
-          host: 'examplesp.com'
+          host: "examplesp.com",
         },
         user: {
-          nameIDFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
-          nameID: 'nameID'
+          nameIDFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+          nameID: "nameID",
         },
         samlLogoutRequest: {
-          ID: 123
-        }
+          ID: 123,
+        },
       };
       options = {
         additionalParams: {
-          additionalKey: 'additionalValue'
-        }
+          additionalKey: "additionalValue",
+        },
       };
     });
 
-    describe('getAuthorizeUrl', function () {
-      it('calls callback with right host', function (done) {
+    describe("getAuthorizeUrl", function () {
+      it("calls callback with right host", function (done) {
         saml.getAuthorizeUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).host.should.equal('exampleidp.com');
+            url.parse(target).host.should.equal("exampleidp.com");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right protocol', function (done) {
+      it("calls callback with right protocol", function (done) {
         saml.getAuthorizeUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).protocol.should.equal('https:');
+            url.parse(target).protocol.should.equal("https:");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right path', function (done) {
+      it("calls callback with right path", function (done) {
         saml.getAuthorizeUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).pathname.should.equal('/path');
+            url.parse(target).pathname.should.equal("/path");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with original query string', function (done) {
+      it("calls callback with original query string", function (done) {
         saml.getAuthorizeUrl(req, {}, function (err, target) {
           try {
-            url.parse(target, true).query['key'].should.equal('value');
+            url.parse(target, true).query["key"].should.equal("value");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with additional run-time params in query string', function (done) {
+      it("calls callback with additional run-time params in query string", function (done) {
         saml.getAuthorizeUrl(req, options, function (err, target) {
           try {
             Object.keys(url.parse(target, true).query).should.have.length(3);
-            url.parse(target, true).query['key'].should.equal('value');
-            url.parse(target, true).query['SAMLRequest'].should.not.be.empty();
-            url.parse(target, true).query['additionalKey'].should.equal('additionalValue');
+            url.parse(target, true).query["key"].should.equal("value");
+            url.parse(target, true).query["SAMLRequest"].should.not.be.empty();
+            url
+              .parse(target, true)
+              .query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -88,10 +90,10 @@ describe('SAML.js', function () {
         });
       });
       // NOTE: This test only tests existence of the assertion, not the correctness
-      it('calls callback with saml request object', function (done) {
+      it("calls callback with saml request object", function (done) {
         saml.getAuthorizeUrl(req, {}, function (err, target) {
           try {
-            should(url.parse(target, true).query).have.property('SAMLRequest');
+            should(url.parse(target, true).query).have.property("SAMLRequest");
             done();
           } catch (err2) {
             done(err2);
@@ -100,54 +102,56 @@ describe('SAML.js', function () {
       });
     });
 
-    describe('getLogoutUrl', function () {
-      it('calls callback with right host', function (done) {
+    describe("getLogoutUrl", function () {
+      it("calls callback with right host", function (done) {
         saml.getLogoutUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).host.should.equal('exampleidp.com');
+            url.parse(target).host.should.equal("exampleidp.com");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right protocol', function (done) {
+      it("calls callback with right protocol", function (done) {
         saml.getLogoutUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).protocol.should.equal('https:');
+            url.parse(target).protocol.should.equal("https:");
             done();
-          } catch(err2) {
+          } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right path', function (done) {
+      it("calls callback with right path", function (done) {
         saml.getLogoutUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).pathname.should.equal('/path');
+            url.parse(target).pathname.should.equal("/path");
             done();
-          } catch(err2) {
+          } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with original query string', function (done) {
+      it("calls callback with original query string", function (done) {
         saml.getLogoutUrl(req, {}, function (err, target) {
           try {
-            url.parse(target, true).query['key'].should.equal('value');
+            url.parse(target, true).query["key"].should.equal("value");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with additional run-time params in query string', function (done) {
+      it("calls callback with additional run-time params in query string", function (done) {
         saml.getLogoutUrl(req, options, function (err, target) {
           try {
             Object.keys(url.parse(target, true).query).should.have.length(3);
-            url.parse(target, true).query['key'].should.equal('value');
-            url.parse(target, true).query['SAMLRequest'].should.not.be.empty();
-            url.parse(target, true).query['additionalKey'].should.equal('additionalValue');
+            url.parse(target, true).query["key"].should.equal("value");
+            url.parse(target, true).query["SAMLRequest"].should.not.be.empty();
+            url
+              .parse(target, true)
+              .query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -155,10 +159,10 @@ describe('SAML.js', function () {
         });
       });
       // NOTE: This test only tests existence of the assertion, not the correctness
-      it('calls callback with saml request object', function (done) {
+      it("calls callback with saml request object", function (done) {
         saml.getLogoutUrl(req, {}, function (err, target) {
           try {
-            should(url.parse(target, true).query).have.property('SAMLRequest');
+            should(url.parse(target, true).query).have.property("SAMLRequest");
             done();
           } catch (err2) {
             done(err2);
@@ -167,54 +171,56 @@ describe('SAML.js', function () {
       });
     });
 
-    describe('getLogoutResponseUrl', function () {
-      it('calls callback with right host', function (done) {
+    describe("getLogoutResponseUrl", function () {
+      it("calls callback with right host", function (done) {
         saml.getLogoutResponseUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).host.should.equal('exampleidp.com');
+            url.parse(target).host.should.equal("exampleidp.com");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right protocol', function (done) {
+      it("calls callback with right protocol", function (done) {
         saml.getLogoutResponseUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).protocol.should.equal('https:');
+            url.parse(target).protocol.should.equal("https:");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with right path', function (done) {
+      it("calls callback with right path", function (done) {
         saml.getLogoutResponseUrl(req, {}, function (err, target) {
           try {
-            url.parse(target).pathname.should.equal('/path');
+            url.parse(target).pathname.should.equal("/path");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with original query string', function (done) {
+      it("calls callback with original query string", function (done) {
         saml.getLogoutResponseUrl(req, {}, function (err, target) {
           try {
-            url.parse(target, true).query['key'].should.equal('value');
+            url.parse(target, true).query["key"].should.equal("value");
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it('calls callback with additional run-time params in query string', function (done) {
+      it("calls callback with additional run-time params in query string", function (done) {
         saml.getLogoutResponseUrl(req, options, function (err, target) {
           try {
             Object.keys(url.parse(target, true).query).should.have.length(3);
-            url.parse(target, true).query['key'].should.equal('value');
-            url.parse(target, true).query['SAMLResponse'].should.not.be.empty();
-            url.parse(target, true).query['additionalKey'].should.equal('additionalValue');
+            url.parse(target, true).query["key"].should.equal("value");
+            url.parse(target, true).query["SAMLResponse"].should.not.be.empty();
+            url
+              .parse(target, true)
+              .query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -222,10 +228,10 @@ describe('SAML.js', function () {
         });
       });
       // NOTE: This test only tests existence of the assertion, not the correctness
-      it('calls callback with saml response object', function (done) {
+      it("calls callback with saml response object", function (done) {
         saml.getLogoutResponseUrl(req, {}, function (err, target) {
           try {
-            should(url.parse(target, true).query).have.property('SAMLResponse');
+            should(url.parse(target, true).query).have.property("SAMLResponse");
             done();
           } catch (err2) {
             done(err2);
@@ -234,31 +240,29 @@ describe('SAML.js', function () {
       });
     });
 
-    describe('keyToPEM', function () {
+    describe("keyToPEM", function () {
       var [regular, singleline] = [
-        'acme_tools_com.key',
-        'singleline_acme_tools_com.key'
+        "acme_tools_com.key",
+        "singleline_acme_tools_com.key",
       ].map(keyFromFile);
 
-      it('formats singleline keys properly', function (done) {
+      it("formats singleline keys properly", function () {
         var result = saml.keyToPEM(singleline);
         result.should.equal(regular);
-        done();
       });
 
-      it('passes all other multiline keys', function (done) {
+      it("passes all other multiline keys", function () {
         var result = saml.keyToPEM(regular);
         result.should.equal(regular);
-        done();
       });
 
-      it('does nothing to falsy', function (done) {
+      it("does nothing to falsy", function (done) {
         var result = saml.keyToPEM(null);
         should.equal(result, null);
         done();
       });
 
-      it('does nothing to non strings', function (done) {
+      it("does nothing to non strings", function (done) {
         var result = saml.keyToPEM(1);
         should.equal(result, 1);
         done();
@@ -267,6 +271,6 @@ describe('SAML.js', function () {
   });
 });
 
-function keyFromFile (file) {
+function keyFromFile(file) {
   return fs.readFileSync(`./test/static/${file}`).toString();
 }
diff --git a/test/test-signatures.js b/test/test-signatures.js
index 2972a542..75e905ca 100644
--- a/test/test-signatures.js
+++ b/test/test-signatures.js
@@ -1,103 +1,293 @@
-const should = require('should'),
-      SAML   = require('../lib/passport-saml/index.js').SAML,
-      fs     = require('fs'),
-      cert   = fs.readFileSync(__dirname + '/static/cert.pem', 'ascii'),
-      sinon  = require('sinon');
+const should = require("should"),
+  SAML = require("../lib/passport-saml/index.js").SAML,
+  fs = require("fs"),
+  cert = fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
+  sinon = require("sinon");
 
-describe('Signatures', function() {
+describe("Signatures", function () {
+  const INVALID_ROOT_SIGNATURE = "Invalid signature on documentElement",
+    INVALID_SIGNATURE = "Invalid signature",
+    createBody = (pathToXml) => ({
+      SAMLResponse: fs.readFileSync(
+        __dirname + "/static/signatures" + pathToXml,
+        "base64"
+      ),
+    }),
+    tryCatchTest = (done, func) => (...args) => {
+      try {
+        func(...args);
+      } catch (ex) {
+        done(ex);
+      }
+    },
+    testOneResponseBody = (
+      samlResponseBody,
+      shouldErrorWith,
+      amountOfSignatureChecks = 1
+    ) => {
+      return (done) => {
+        //== Instantiate new instance before every test
+        const samlObj = new SAML({ cert });
+        //== Spy on `validateSignature` to be able to count how many times it has been called
+        const validateSignatureSpy = sinon.spy(samlObj, "validateSignature");
 
-  const INVALID_ROOT_SIGNATURE = 'Invalid signature on documentElement',
-        INVALID_SIGNATURE      = 'Invalid signature',
-        createBody             = pathToXml => ({ SAMLResponse: fs.readFileSync(__dirname + '/static/signatures' + pathToXml, 'base64') }),
-        tryCatchTest           = ( done, func ) => ( ...args ) => {
-          try {
-            func(...args);
-          }
-          catch ( ex ) {
-            done(ex);
-          }
-        },
-        testOneResponseBody    = ( samlResponseBody, shouldErrorWith, amountOfSignatureChecks = 1 ) => {
-          return done => {
-            //== Instantiate new instance before every test
-            const samlObj              = new SAML({ cert });
-            //== Spy on `validateSignature` to be able to count how many times it has been called
-            const validateSignatureSpy = sinon.spy(samlObj, 'validateSignature');
+        //== Run the test in `func`
+        samlObj.validatePostResponse(
+          samlResponseBody,
+          tryCatchTest(done, function (error) {
+            //== Assert error. If the error is `SAML assertion expired` we made it past the certificate validation
+            shouldErrorWith
+              ? error.should.eql(new Error(shouldErrorWith))
+              : error.should.eql(new Error("SAML assertion expired"));
+            //== Assert times `validateSignature` was called
+            validateSignatureSpy.callCount.should.eql(amountOfSignatureChecks);
+            done();
+          })
+        );
+      };
+    },
+    testOneResponse = (pathToXml, ...args) => {
+      //== Create a body based on an XML and run the test
+      return testOneResponseBody(createBody(pathToXml), ...args);
+    };
 
-            //== Run the test in `func`
-            samlObj.validatePostResponse(samlResponseBody, tryCatchTest(done, function( error ) {
-              //== Assert error. If the error is `SAML assertion expired` we made it past the certificate validation
-              shouldErrorWith ? error.should.eql(new Error(shouldErrorWith)) : error.should.eql(new Error('SAML assertion expired'));
-              //== Assert times `validateSignature` was called
-              validateSignatureSpy.callCount.should.eql(amountOfSignatureChecks);
-              done();
-            }));
-          };
-        },
-        testOneResponse        = ( pathToXml, ...args ) => {
-          //== Create a body based on an XML and run the test
-          return testOneResponseBody(createBody(pathToXml), ...args);
-        };
-
-  describe('Signatures on saml:Response - Only 1 saml:Assertion', () => {
+  describe("Signatures on saml:Response - Only 1 saml:Assertion", () => {
     //== VALID
-    it('R1A - both signed => valid', testOneResponse('/valid/response.root-signed.assertion-signed.xml', false, 1));
-    it('R1A - root signed => valid', testOneResponse('/valid/response.root-signed.assertion-unsigned.xml', false, 1));
-    it('R1A - asrt signed => valid', testOneResponse('/valid/response.root-unsigned.assertion-signed.xml', false, 2));
+    it(
+      "R1A - both signed => valid",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-signed.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A - root signed => valid",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-unsigned.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A - asrt signed => valid",
+      testOneResponse(
+        "/valid/response.root-unsigned.assertion-signed.xml",
+        false,
+        2
+      )
+    );
 
     //== INVALID
-    it('R1A - none signed => error', testOneResponse('/invalid/response.root-unsigned.assertion-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A - both signed => error', testOneResponse('/invalid/response.root-signed.assertion-signed.xml', INVALID_SIGNATURE, 2));
-    it('R1A - root signed => error', testOneResponse('/invalid/response.root-signed.assertion-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A - asrt signed => error', testOneResponse('/invalid/response.root-unsigned.assertion-signed.xml', INVALID_SIGNATURE, 2));
+    it(
+      "R1A - none signed => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A - both signed => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-signed.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A - root signed => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A - asrt signed => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-signed.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
   });
 
-  describe('Signatures on saml:Response - 1 saml:Assertion + 1 saml:Advice containing 1 saml:Assertion', () => {
+  describe("Signatures on saml:Response - 1 saml:Assertion + 1 saml:Advice containing 1 saml:Assertion", () => {
     //== VALID
-    it('R1A1Ad - signed root+asrt+advi => valid', testOneResponse('/valid/response.root-signed.assertion-signed.1advice-signed.xml', false, 1));
-    it('R1A1Ad - signed root+asrt => valid', testOneResponse('/valid/response.root-signed.assertion-signed.1advice-unsigned.xml', false, 1));
-    it('R1A1Ad - signed asrt+advi => valid', testOneResponse('/valid/response.root-unsigned.assertion-signed.1advice-signed.xml', false, 2));
-    it('R1A1Ad - signed root => valid', testOneResponse('/valid/response.root-signed.assertion-unsigned.1advice-unsigned.xml', false, 1));
-    it('R1A1Ad - signed asrt => valid', testOneResponse('/valid/response.root-unsigned.assertion-signed.1advice-unsigned.xml', false, 2));
+    it(
+      "R1A1Ad - signed root+asrt+advi => valid",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-signed.1advice-signed.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A1Ad - signed root+asrt => valid",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-signed.1advice-unsigned.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A1Ad - signed asrt+advi => valid",
+      testOneResponse(
+        "/valid/response.root-unsigned.assertion-signed.1advice-signed.xml",
+        false,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed root => valid",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-unsigned.1advice-unsigned.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A1Ad - signed asrt => valid",
+      testOneResponse(
+        "/valid/response.root-unsigned.assertion-signed.1advice-unsigned.xml",
+        false,
+        2
+      )
+    );
 
     //== INVALID
-    it('R1A1Ad - signed none => error', testOneResponse('/invalid/response.root-unsigned.assertion-unsigned.1advice-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A1Ad - signed root+asrt+advi => error', testOneResponse('/invalid/response.root-signed.assertion-signed.1advice-signed.xml', INVALID_SIGNATURE, 2));
-    it('R1A1Ad - signed root+asrt => error', testOneResponse('/invalid/response.root-signed.assertion-signed.1advice-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A1Ad - signed asrt+advi => error', testOneResponse('/invalid/response.root-unsigned.assertion-signed.1advice-signed.xml', INVALID_SIGNATURE, 2));
-    it('R1A1Ad - signed root => error', testOneResponse('/invalid/response.root-signed.assertion-unsigned.1advice-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A1Ad - signed asrt => error', testOneResponse('/invalid/response.root-unsigned.assertion-signed.1advice-unsigned.xml', INVALID_SIGNATURE, 2));
-
+    it(
+      "R1A1Ad - signed none => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-unsigned.1advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed root+asrt+advi => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-signed.1advice-signed.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed root+asrt => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-signed.1advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed asrt+advi => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-signed.1advice-signed.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed root => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-unsigned.1advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A1Ad - signed asrt => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-signed.1advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
   });
 
-  describe('Signatures on saml:Response - 1 saml:Assertion + 1 saml:Advice containing 2 saml:Assertion', () => {
+  describe("Signatures on saml:Response - 1 saml:Assertion + 1 saml:Advice containing 2 saml:Assertion", () => {
     //== VALID
-    it('R1A2Ad - signed root+asrt+advi => error', testOneResponse('/valid/response.root-signed.assertion-signed.2advice-signed.xml', false, 1));
-    it('R1A2Ad - signed root+asrt => error', testOneResponse('/valid/response.root-signed.assertion-signed.2advice-unsigned.xml', false, 1));
-    it('R1A2Ad - signed root => error', testOneResponse('/valid/response.root-signed.assertion-unsigned.2advice-unsigned.xml', false, 1));
+    it(
+      "R1A2Ad - signed root+asrt+advi => error",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-signed.2advice-signed.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A2Ad - signed root+asrt => error",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-signed.2advice-unsigned.xml",
+        false,
+        1
+      )
+    );
+    it(
+      "R1A2Ad - signed root => error",
+      testOneResponse(
+        "/valid/response.root-signed.assertion-unsigned.2advice-unsigned.xml",
+        false,
+        1
+      )
+    );
 
     //== INVALID
-    it('R1A2Ad - signed none => error', testOneResponse('/invalid/response.root-unsigned.assertion-unsigned.2advice-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A2Ad - signed root+asrt+advi => error', testOneResponse('/invalid/response.root-signed.assertion-signed.2advice-signed.xml', INVALID_SIGNATURE, 2));
-    it('R1A2Ad - signed root+asrt => error', testOneResponse('/invalid/response.root-signed.assertion-signed.2advice-unsigned.xml', INVALID_SIGNATURE, 2));
-    it('R1A2Ad - signed root => error', testOneResponse('/invalid/response.root-signed.assertion-unsigned.2advice-unsigned.xml', INVALID_SIGNATURE, 2));
-
+    it(
+      "R1A2Ad - signed none => error",
+      testOneResponse(
+        "/invalid/response.root-unsigned.assertion-unsigned.2advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A2Ad - signed root+asrt+advi => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-signed.2advice-signed.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A2Ad - signed root+asrt => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-signed.2advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
+    it(
+      "R1A2Ad - signed root => error",
+      testOneResponse(
+        "/invalid/response.root-signed.assertion-unsigned.2advice-unsigned.xml",
+        INVALID_SIGNATURE,
+        2
+      )
+    );
   });
 
-  describe('Signature on saml:Response with non-LF line endings', () => {
-    const samlResponseXml = fs.readFileSync(__dirname + '/static/signatures/valid/response.root-signed.assertion-signed.xml').toString();
-    const makeBody = str => ({ SAMLResponse: Buffer.from(str).toString('base64') });
+  describe("Signature on saml:Response with non-LF line endings", () => {
+    const samlResponseXml = fs
+      .readFileSync(
+        __dirname +
+          "/static/signatures/valid/response.root-signed.assertion-signed.xml"
+      )
+      .toString();
+    const makeBody = (str) => ({
+      SAMLResponse: Buffer.from(str).toString("base64"),
+    });
 
-    it('CRLF line endings', done => {
-      const body = makeBody(samlResponseXml.replace(/\n/g, '\r\n'));
+    it("CRLF line endings", (done) => {
+      const body = makeBody(samlResponseXml.replace(/\n/g, "\r\n"));
       testOneResponseBody(body, false, 1)(done);
     });
 
-    it('CR line endings', done => {
-      const body = makeBody(samlResponseXml.replace(/\n/g, '\r'));
+    it("CR line endings", (done) => {
+      const body = makeBody(samlResponseXml.replace(/\n/g, "\r"));
       testOneResponseBody(body, false, 1)(done);
     });
-
   });
-
 });
diff --git a/test/tests.js b/test/tests.js
index 045db3c9..6dcc27c5 100644
--- a/test/tests.js
+++ b/test/tests.js
@@ -1,88 +1,113 @@
-'use strict';
-var express      = require( 'express' );
-var bodyParser   = require( 'body-parser' );
-var passport     = require( 'passport' );
-var SamlStrategy = require( '../lib/passport-saml/index.js' ).Strategy;
-var request      = require( 'request' );
-var should       = require( 'should' );
-var zlib         = require( 'zlib' );
-var querystring  = require( 'querystring' );
-var parseString  = require( 'xml2js' ).parseString;
-var SAML         = require( '../lib/passport-saml/index.js' ).SAML;
-var fs           = require( 'fs' );
-var sinon        = require('sinon');
+"use strict";
+var express = require("express");
+var bodyParser = require("body-parser");
+var passport = require("passport");
+var SamlStrategy = require("../lib/passport-saml/index.js").Strategy;
+var request = require("request");
+var should = require("should");
+var zlib = require("zlib");
+var querystring = require("querystring");
+var parseString = require("xml2js").parseString;
+var SAML = require("../lib/passport-saml/index.js").SAML;
+var fs = require("fs");
+var sinon = require("sinon");
 
 // a certificate which is re-used by several tests
-var TEST_CERT = 'MIIEFzCCAv+gAwIBAgIUFJsUjPM7AmWvNtEvULSHlTTMiLQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UEBhMCVVMxETAPBgNVBAoMCFN1YnNwYWNlMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDIzNDkwHhcNMTQwNTEzMTgwNjEyWhcNMTkwNTE0MTgwNjEyWjBYMQswCQYDVQQGEwJVUzERMA8GA1UECgwIU3Vic3BhY2UxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA0MjM0OTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKrAzJdY9FzFLt5blArJfPzgi87EnFGlTfcV5T1TUDwLBlDkY/0ZGKnMOpf3D7ie2C4pPFOImOogcM5kpDDL7qxTXZ1ewXVyjBdMu29NG2C6NzWeQTUMUji01EcHkC8o+Pts8ANiNOYcjxEeyhEyzJKgEizblYzMMKzdrOET6QuqWo3C83K+5+5dsjDn1ooKGRwj3HvgsYcFrQl9NojgQFjoobwsiE/7A+OJhLpBcy/nSVgnoJaMfrO+JsnukZPztbntLvOl56+Vra0N8n5NAYhaSayPiv/ayhjVgjfXd1tjMVTOiDknUOwizZuJ1Y3QH94vUtBgp0WBpBSs/xMyTs8CAwEAAaOB2DCB1TAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRQO4WpM5fWwxib49WTuJkfYDbxODCBlQYDVR0jBIGNMIGKgBRQO4WpM5fWwxib49WTuJkfYDbxOKFcpFowWDELMAkGA1UEBhMCVVMxETAPBgNVBAoMCFN1YnNwYWNlMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDIzNDmCFBSbFIzzOwJlrzbRL1C0h5U0zIi0MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEACdDAAoaZFCEY5pmfwbKuKrXtO5iE8lWtiCPjCZEUuT6bXRNcqrdnuV/EAfX9WQoXjalPi0eM78zKmbvRGSTUHwWw49RHjFfeJUKvHNeNnFgTXDjEPNhMvh69kHm453lFRmB+kk6yjtXRZaQEwS8Uuo2Ot+krgNbl6oTBZJ0AHH1MtZECDloms1Km7zsK8wAi5i8TVIKkVr5b2VlhrLgFMvzZ5ViAxIMGB6w47yY4QGQB/5Q8ya9hBs9vkn+wubA+yr4j14JXZ7blVKDSTYva65Ea+PqHyrp+Wnmnbw2ObS7iWexiTy1jD3G0R2avDBFjM8Fj5DbfufsE1b0U10RTtg==';
-var ALT_TEST_CERT = 'MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6MA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAkFVMREwDwYDVQQIEwhWaWN0b3JpYTESMBAGA1UEBxMJTWVsYm91cm5lMSEwHwYDVQQKExhUYWJjb3JwIEhvbGRpbmdzIExpbWl0ZWQxFzAVBgNVBAMTDnN0cy50YWIuY29tLmF1MB4XDTE3MDUzMDA4NTQwOFoXDTI3MDUyODA4NTQwOFowcDELMAkGA1UEBhMCQVUxETAPBgNVBAgTCFZpY3RvcmlhMRIwEAYDVQQHEwlNZWxib3VybmUxITAfBgNVBAoTGFRhYmNvcnAgSG9sZGluZ3MgTGltaXRlZDEXMBUGA1UEAxMOc3RzLnRhYi5jb20uYXUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD0NuMcflq3rtupKYDf4a7lWmsXy66fYe9n8jB2DuLMakEJBlzn9j6B98IZftrilTq21VR7wUXROxG8BkN8IHY+l8X7lATmD28fFdZJj0c8Qk82eoq48faemth4fBMx2YrpnhU00jeXeP8dIIaJTPCHBTNgZltMMhphklN1YEPlzefJs3YD+Ryczy1JHbwETxt+BzO1JdjBe1fUTyl6KxAwWvtsNBURmQRYlDOk4GRgdkQnfxBuCpOMeOpV8wiBAi3h65Lab9C5avu4AJlA9e4qbOmWt6otQmgy5fiJVy6bH/d8uW7FJmSmePX9sqAWa9szhjdn36HHVQsfHC+IUEX7AgMBAAGjgdUwgdIwHQYDVR0OBBYEFN6z6cuxY7FTkg1S/lIjnS4x5ARWMIGiBgNVHSMEgZowgZeAFN6z6cuxY7FTkg1S/lIjnS4x5ARWoXSkcjBwMQswCQYDVQQGEwJBVTERMA8GA1UECBMIVmljdG9yaWExEjAQBgNVBAcTCU1lbGJvdXJuZTEhMB8GA1UEChMYVGFiY29ycCBIb2xkaW5ncyBMaW1pdGVkMRcwFQYDVQQDEw5zdHMudGFiLmNvbS5hdYIJAKZgJdKdCdL6MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAMi5HyvXgRa4+kKz3dk4SwAEXzeZRcsbeDJWVUxdb6a+JQxIoG7L9rSbd6yZvP/Xel5TrcwpCpl5eikzXB02/C0wZKWicNmDEBlOfw0Pc5ngdoh6ntxHIWm5QMlAfjR0dgTlojN4Msw2qk7cP1QEkV96e2BJUaqaNnM3zMvd7cfRjPNfbsbwl6hCCCAdwrALKYtBnjKVrCGPwO+xiw5mUJhZ1n6ZivTOdQEWbl26UO60J9ItiWP8VK0d0aChn326Ovt7qC4S3AgDlaJwcKe5Ifxl/UOWePGRwXj2UUuDWFhjtVmRntMmNZbe5yE8MkEvU+4/c6LqGwTCgDenRbK53Dg=';
+var TEST_CERT =
+  "MIIEFzCCAv+gAwIBAgIUFJsUjPM7AmWvNtEvULSHlTTMiLQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UEBhMCVVMxETAPBgNVBAoMCFN1YnNwYWNlMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDIzNDkwHhcNMTQwNTEzMTgwNjEyWhcNMTkwNTE0MTgwNjEyWjBYMQswCQYDVQQGEwJVUzERMA8GA1UECgwIU3Vic3BhY2UxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA0MjM0OTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKrAzJdY9FzFLt5blArJfPzgi87EnFGlTfcV5T1TUDwLBlDkY/0ZGKnMOpf3D7ie2C4pPFOImOogcM5kpDDL7qxTXZ1ewXVyjBdMu29NG2C6NzWeQTUMUji01EcHkC8o+Pts8ANiNOYcjxEeyhEyzJKgEizblYzMMKzdrOET6QuqWo3C83K+5+5dsjDn1ooKGRwj3HvgsYcFrQl9NojgQFjoobwsiE/7A+OJhLpBcy/nSVgnoJaMfrO+JsnukZPztbntLvOl56+Vra0N8n5NAYhaSayPiv/ayhjVgjfXd1tjMVTOiDknUOwizZuJ1Y3QH94vUtBgp0WBpBSs/xMyTs8CAwEAAaOB2DCB1TAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRQO4WpM5fWwxib49WTuJkfYDbxODCBlQYDVR0jBIGNMIGKgBRQO4WpM5fWwxib49WTuJkfYDbxOKFcpFowWDELMAkGA1UEBhMCVVMxETAPBgNVBAoMCFN1YnNwYWNlMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDIzNDmCFBSbFIzzOwJlrzbRL1C0h5U0zIi0MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEACdDAAoaZFCEY5pmfwbKuKrXtO5iE8lWtiCPjCZEUuT6bXRNcqrdnuV/EAfX9WQoXjalPi0eM78zKmbvRGSTUHwWw49RHjFfeJUKvHNeNnFgTXDjEPNhMvh69kHm453lFRmB+kk6yjtXRZaQEwS8Uuo2Ot+krgNbl6oTBZJ0AHH1MtZECDloms1Km7zsK8wAi5i8TVIKkVr5b2VlhrLgFMvzZ5ViAxIMGB6w47yY4QGQB/5Q8ya9hBs9vkn+wubA+yr4j14JXZ7blVKDSTYva65Ea+PqHyrp+Wnmnbw2ObS7iWexiTy1jD3G0R2avDBFjM8Fj5DbfufsE1b0U10RTtg==";
+var ALT_TEST_CERT =
+  "MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6MA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAkFVMREwDwYDVQQIEwhWaWN0b3JpYTESMBAGA1UEBxMJTWVsYm91cm5lMSEwHwYDVQQKExhUYWJjb3JwIEhvbGRpbmdzIExpbWl0ZWQxFzAVBgNVBAMTDnN0cy50YWIuY29tLmF1MB4XDTE3MDUzMDA4NTQwOFoXDTI3MDUyODA4NTQwOFowcDELMAkGA1UEBhMCQVUxETAPBgNVBAgTCFZpY3RvcmlhMRIwEAYDVQQHEwlNZWxib3VybmUxITAfBgNVBAoTGFRhYmNvcnAgSG9sZGluZ3MgTGltaXRlZDEXMBUGA1UEAxMOc3RzLnRhYi5jb20uYXUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD0NuMcflq3rtupKYDf4a7lWmsXy66fYe9n8jB2DuLMakEJBlzn9j6B98IZftrilTq21VR7wUXROxG8BkN8IHY+l8X7lATmD28fFdZJj0c8Qk82eoq48faemth4fBMx2YrpnhU00jeXeP8dIIaJTPCHBTNgZltMMhphklN1YEPlzefJs3YD+Ryczy1JHbwETxt+BzO1JdjBe1fUTyl6KxAwWvtsNBURmQRYlDOk4GRgdkQnfxBuCpOMeOpV8wiBAi3h65Lab9C5avu4AJlA9e4qbOmWt6otQmgy5fiJVy6bH/d8uW7FJmSmePX9sqAWa9szhjdn36HHVQsfHC+IUEX7AgMBAAGjgdUwgdIwHQYDVR0OBBYEFN6z6cuxY7FTkg1S/lIjnS4x5ARWMIGiBgNVHSMEgZowgZeAFN6z6cuxY7FTkg1S/lIjnS4x5ARWoXSkcjBwMQswCQYDVQQGEwJBVTERMA8GA1UECBMIVmljdG9yaWExEjAQBgNVBAcTCU1lbGJvdXJuZTEhMB8GA1UEChMYVGFiY29ycCBIb2xkaW5ncyBMaW1pdGVkMRcwFQYDVQQDEw5zdHMudGFiLmNvbS5hdYIJAKZgJdKdCdL6MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAMi5HyvXgRa4+kKz3dk4SwAEXzeZRcsbeDJWVUxdb6a+JQxIoG7L9rSbd6yZvP/Xel5TrcwpCpl5eikzXB02/C0wZKWicNmDEBlOfw0Pc5ngdoh6ntxHIWm5QMlAfjR0dgTlojN4Msw2qk7cP1QEkV96e2BJUaqaNnM3zMvd7cfRjPNfbsbwl6hCCCAdwrALKYtBnjKVrCGPwO+xiw5mUJhZ1n6ZivTOdQEWbl26UO60J9ItiWP8VK0d0aChn326Ovt7qC4S3AgDlaJwcKe5Ifxl/UOWePGRwXj2UUuDWFhjtVmRntMmNZbe5yE8MkEvU+4/c6LqGwTCgDenRbK53Dg=";
 
-describe( 'passport-saml /', function() {
-  describe('captured saml responses /', function () {
+describe("passport-saml /", function () {
+  describe("captured saml responses /", function () {
     var fakeClock;
     var capturedChecks = [
-      { name: 'Okta -- valid config should succeed',
+      {
+        name: "Okta -- valid config should succeed",
         samlResponse: {
-          SAMLResponse: 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cDovL2xvY2FsaG9zdC9icm93c2VyU2FtbExvZ2luIiBJRD0iaWQzMzcxMDA5NzQ3ODg2OTIzMjIwMzA1Njc3ODMiIEluUmVzcG9uc2VUbz0iXzVjMzg1YWJiMTc3MzViN2FhOGQxIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjdUMjM6Mjc6MzUuNDI2WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL3d3dy5va3RhLmNvbS9rdmpqNDZsc0RRRVFZVURCWklZVzwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQzMzcxMDA5NzQ3ODg2OTIzMjIwMzA1Njc3ODMiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPjRSNUNjYUVEQ3dPSCtudnVHSkY3TWRBelpIdz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+TzlycW1TUTJQd1NaZDFBeklRUDUySkY5VHBaSkJUNENpdnAxTUZZN3FzODdrU2RFQ3dNbWFWTDE2NFI4dUlCbzdscXUwOFRaTGZYeGF6ak5uRDhnV05BOWRuK2d5cFc1ZWo4S3EzK1J3cUxZUzM1M3pCeVpWcy9MSUxQZVJCK0tUS2RsbTVJSDcxdWhwbUp4a3k0T0gwNWdDSWExYnRFaXpKV1h3d1lleXpBPTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJQ29UQ0NBZ3FnQXdJQkFnSUdBVVk4elZQWU1BMEdDU3FHU0liM0RRRUJCUVVBTUlHVE1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFRwpBMVVFQ0F3S1EyRnNhV1p2Y201cFlURVdNQlFHQTFVRUJ3d05VMkZ1SUVaeVlXNWphWE5qYnpFTk1Bc0dBMVVFQ2d3RVQydDBZVEVVCk1CSUdBMVVFQ3d3TFUxTlBVSEp2ZG1sa1pYSXhGREFTQmdOVkJBTU1DM04xWW5Od1lXTmxjM2N4TVJ3d0dnWUpLb1pJaHZjTkFRa0IKRmcxcGJtWnZRRzlyZEdFdVkyOXRNQjRYRFRFME1EVXlOekE0TWpreU4xb1hEVFEwTURVeU56QTRNekF5TjFvd2daTXhDekFKQmdOVgpCQVlUQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1RMHdDd1lEClZRUUtEQVJQYTNSaE1SUXdFZ1lEVlFRTERBdFRVMDlRY205MmFXUmxjakVVTUJJR0ExVUVBd3dMYzNWaWMzQmhZMlZ6ZHpFeEhEQWEKQmdrcWhraUc5dzBCQ1FFV0RXbHVabTlBYjJ0MFlTNWpiMjB3Z1o4d0RRWUpLb1pJaHZjTkFRRUJCUUFEZ1kwQU1JR0pBb0dCQUtZWAovVWRWOUhMWGJOS3YweWM2WUpCdHpkV051R1RQSVhXVlBDYjBPc1J2UjU0bHErMFNMUFFHSlMzOWZsV0tpcXRVaUV1c3VpaDZHZExmCk52RkFWTEdQcUJUV1E0TGM3cjUrekQ1cW5INkxpVE0xS0NiYUYzdXUyUCtUK3V0c0dxRlVaYXdBOUZFVk5Ma0lDZTM2WDF5RTQwWCsKL2pNeWd5aWVRUE1lSkFCdkFnTUJBQUV3RFFZSktvWklodmNOQVFFRkJRQURnWUVBSFNXUEc0eTFiTnlKeVNnYkZxRGNTLzZNVU5JcgpTZmtRWUl4eklHUTM3cXk1cUFXMTVZa0JVaVc5VHNHSlJjcmd1c1ZyWklpYTE4ZVl6ODRabjdGeVVaTk1GbzI0TDdsNkJTMFdDaXRJClFTY0JDS0I0UVdBL2Ixc3pxczdFdHBPY1BQMDFUWU5xMnJhcytWcVIzYVdBWExYMm9LZkNsVi9TVXdzelJmNVU4NVk9PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWwycDpTdGF0dXMgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24geG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJpZDMzNzEwMDk3NDc4OTQ5MTAwNjY2NTIyNTEyIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjdUMjM6Mjc6MzUuNDI2WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5IiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cDovL3d3dy5va3RhLmNvbS9rdmpqNDZsc0RRRVFZVURCWklZVzwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQzMzcxMDA5NzQ3ODk0OTEwMDY2NjUyMjUxMiI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+UFM4dE5taVVZUXpRQVFURjh3RDFRT3dMazA0PTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5XM3JiUkNFUmE1ZEtUcy9MSERwY0pEeUhjSzFESjczd2xhT3J2MXZWNmZxQ3FTTUNpclZLRVlLKzR2OG5WaThZNlZwcVJHd0trWFV2cUY0b0hKWjYzOE5YYVRiRVRjU1VXWjVUNXowbzBNVXhBL3RnL01zVzYvRlVRMXBqUWJhVlhJT3Mvc1EwVzluUXpmZkVZLzgrSkVJMldLY0I2UkZlVzVtTlkvdm9oUWM9PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlDb1RDQ0FncWdBd0lCQWdJR0FVWTh6VlBZTUEwR0NTcUdTSWIzRFFFQkJRVUFNSUdUTVFzd0NRWURWUVFHRXdKVlV6RVRNQkVHCkExVUVDQXdLUTJGc2FXWnZjbTVwWVRFV01CUUdBMVVFQnd3TlUyRnVJRVp5WVc1amFYTmpiekVOTUFzR0ExVUVDZ3dFVDJ0MFlURVUKTUJJR0ExVUVDd3dMVTFOUFVISnZkbWxrWlhJeEZEQVNCZ05WQkFNTUMzTjFZbk53WVdObGMzY3hNUnd3R2dZSktvWklodmNOQVFrQgpGZzFwYm1adlFHOXJkR0V1WTI5dE1CNFhEVEUwTURVeU56QTRNamt5TjFvWERUUTBNRFV5TnpBNE16QXlOMW93Z1pNeEN6QUpCZ05WCkJBWVRBbFZUTVJNd0VRWURWUVFJREFwRFlXeHBabTl5Ym1saE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVEwd0N3WUQKVlFRS0RBUlBhM1JoTVJRd0VnWURWUVFMREF0VFUwOVFjbTkyYVdSbGNqRVVNQklHQTFVRUF3d0xjM1ZpYzNCaFkyVnpkekV4SERBYQpCZ2txaGtpRzl3MEJDUUVXRFdsdVptOUFiMnQwWVM1amIyMHdnWjh3RFFZSktvWklodmNOQVFFQkJRQURnWTBBTUlHSkFvR0JBS1lYCi9VZFY5SExYYk5LdjB5YzZZSkJ0emRXTnVHVFBJWFdWUENiME9zUnZSNTRscSswU0xQUUdKUzM5ZmxXS2lxdFVpRXVzdWloNkdkTGYKTnZGQVZMR1BxQlRXUTRMYzdyNSt6RDVxbkg2TGlUTTFLQ2JhRjN1dTJQK1QrdXRzR3FGVVphd0E5RkVWTkxrSUNlMzZYMXlFNDBYKwovak15Z3lpZVFQTWVKQUJ2QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVGQlFBRGdZRUFIU1dQRzR5MWJOeUp5U2diRnFEY1MvNk1VTklyClNma1FZSXh6SUdRMzdxeTVxQVcxNVlrQlVpVzlUc0dKUmNyZ3VzVnJaSWlhMThlWXo4NFpuN0Z5VVpOTUZvMjRMN2w2QlMwV0NpdEkKUVNjQkNLQjRRV0EvYjFzenFzN0V0cE9jUFAwMVRZTnEycmFzK1ZxUjNhV0FYTFgyb0tmQ2xWL1NVd3N6UmY1VTg1WT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDI6U3ViamVjdCB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOk5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWlsQWRkcmVzcyI+YmVuQHN1YnNwYWNlc3cuY29tPC9zYW1sMjpOYW1lSUQ+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgSW5SZXNwb25zZVRvPSJfNWMzODVhYmIxNzczNWI3YWE4ZDEiIE5vdE9uT3JBZnRlcj0iMjAxNC0wNS0yN1QyMzozMjozNS40MjZaIiBSZWNpcGllbnQ9Imh0dHA6Ly9sb2NhbGhvc3QvYnJvd3NlclNhbWxMb2dpbiIvPjwvc2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWwyOlN1YmplY3Q+PHNhbWwyOkNvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE0LTA1LTI3VDIzOjIyOjM1LjQyNloiIE5vdE9uT3JBZnRlcj0iMjAxNC0wNS0yN1QyMzozMjozNS40MjZaIiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWwyOkF1ZGllbmNlPmh0dHBzOi8vYWRtaW4uc3Vic3BhY2Vzdy5jb208L3NhbWwyOkF1ZGllbmNlPjwvc2FtbDI6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWwyOkNvbmRpdGlvbnM+PHNhbWwyOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yN1QyMzoyNzozNS40MjZaIiBTZXNzaW9uSW5kZXg9Il81YzM4NWFiYjE3NzM1YjdhYThkMSIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpBdXRobkNvbnRleHQ+PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlg1MDk8L3NhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDI6QXV0aG5Db250ZXh0Pjwvc2FtbDI6QXV0aG5TdGF0ZW1lbnQ+PC9zYW1sMjpBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+',
-          RelayState: '',
+          SAMLResponse:
+            "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cDovL2xvY2FsaG9zdC9icm93c2VyU2FtbExvZ2luIiBJRD0iaWQzMzcxMDA5NzQ3ODg2OTIzMjIwMzA1Njc3ODMiIEluUmVzcG9uc2VUbz0iXzVjMzg1YWJiMTc3MzViN2FhOGQxIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjdUMjM6Mjc6MzUuNDI2WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL3d3dy5va3RhLmNvbS9rdmpqNDZsc0RRRVFZVURCWklZVzwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQzMzcxMDA5NzQ3ODg2OTIzMjIwMzA1Njc3ODMiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPjRSNUNjYUVEQ3dPSCtudnVHSkY3TWRBelpIdz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+TzlycW1TUTJQd1NaZDFBeklRUDUySkY5VHBaSkJUNENpdnAxTUZZN3FzODdrU2RFQ3dNbWFWTDE2NFI4dUlCbzdscXUwOFRaTGZYeGF6ak5uRDhnV05BOWRuK2d5cFc1ZWo4S3EzK1J3cUxZUzM1M3pCeVpWcy9MSUxQZVJCK0tUS2RsbTVJSDcxdWhwbUp4a3k0T0gwNWdDSWExYnRFaXpKV1h3d1lleXpBPTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJQ29UQ0NBZ3FnQXdJQkFnSUdBVVk4elZQWU1BMEdDU3FHU0liM0RRRUJCUVVBTUlHVE1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFRwpBMVVFQ0F3S1EyRnNhV1p2Y201cFlURVdNQlFHQTFVRUJ3d05VMkZ1SUVaeVlXNWphWE5qYnpFTk1Bc0dBMVVFQ2d3RVQydDBZVEVVCk1CSUdBMVVFQ3d3TFUxTlBVSEp2ZG1sa1pYSXhGREFTQmdOVkJBTU1DM04xWW5Od1lXTmxjM2N4TVJ3d0dnWUpLb1pJaHZjTkFRa0IKRmcxcGJtWnZRRzlyZEdFdVkyOXRNQjRYRFRFME1EVXlOekE0TWpreU4xb1hEVFEwTURVeU56QTRNekF5TjFvd2daTXhDekFKQmdOVgpCQVlUQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1RMHdDd1lEClZRUUtEQVJQYTNSaE1SUXdFZ1lEVlFRTERBdFRVMDlRY205MmFXUmxjakVVTUJJR0ExVUVBd3dMYzNWaWMzQmhZMlZ6ZHpFeEhEQWEKQmdrcWhraUc5dzBCQ1FFV0RXbHVabTlBYjJ0MFlTNWpiMjB3Z1o4d0RRWUpLb1pJaHZjTkFRRUJCUUFEZ1kwQU1JR0pBb0dCQUtZWAovVWRWOUhMWGJOS3YweWM2WUpCdHpkV051R1RQSVhXVlBDYjBPc1J2UjU0bHErMFNMUFFHSlMzOWZsV0tpcXRVaUV1c3VpaDZHZExmCk52RkFWTEdQcUJUV1E0TGM3cjUrekQ1cW5INkxpVE0xS0NiYUYzdXUyUCtUK3V0c0dxRlVaYXdBOUZFVk5Ma0lDZTM2WDF5RTQwWCsKL2pNeWd5aWVRUE1lSkFCdkFnTUJBQUV3RFFZSktvWklodmNOQVFFRkJRQURnWUVBSFNXUEc0eTFiTnlKeVNnYkZxRGNTLzZNVU5JcgpTZmtRWUl4eklHUTM3cXk1cUFXMTVZa0JVaVc5VHNHSlJjcmd1c1ZyWklpYTE4ZVl6ODRabjdGeVVaTk1GbzI0TDdsNkJTMFdDaXRJClFTY0JDS0I0UVdBL2Ixc3pxczdFdHBPY1BQMDFUWU5xMnJhcytWcVIzYVdBWExYMm9LZkNsVi9TVXdzelJmNVU4NVk9PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWwycDpTdGF0dXMgeG1sbnM6c2FtbDJwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24geG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJpZDMzNzEwMDk3NDc4OTQ5MTAwNjY2NTIyNTEyIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjdUMjM6Mjc6MzUuNDI2WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5IiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cDovL3d3dy5va3RhLmNvbS9rdmpqNDZsc0RRRVFZVURCWklZVzwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQzMzcxMDA5NzQ3ODk0OTEwMDY2NjUyMjUxMiI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+UFM4dE5taVVZUXpRQVFURjh3RDFRT3dMazA0PTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5XM3JiUkNFUmE1ZEtUcy9MSERwY0pEeUhjSzFESjczd2xhT3J2MXZWNmZxQ3FTTUNpclZLRVlLKzR2OG5WaThZNlZwcVJHd0trWFV2cUY0b0hKWjYzOE5YYVRiRVRjU1VXWjVUNXowbzBNVXhBL3RnL01zVzYvRlVRMXBqUWJhVlhJT3Mvc1EwVzluUXpmZkVZLzgrSkVJMldLY0I2UkZlVzVtTlkvdm9oUWM9PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlDb1RDQ0FncWdBd0lCQWdJR0FVWTh6VlBZTUEwR0NTcUdTSWIzRFFFQkJRVUFNSUdUTVFzd0NRWURWUVFHRXdKVlV6RVRNQkVHCkExVUVDQXdLUTJGc2FXWnZjbTVwWVRFV01CUUdBMVVFQnd3TlUyRnVJRVp5WVc1amFYTmpiekVOTUFzR0ExVUVDZ3dFVDJ0MFlURVUKTUJJR0ExVUVDd3dMVTFOUFVISnZkbWxrWlhJeEZEQVNCZ05WQkFNTUMzTjFZbk53WVdObGMzY3hNUnd3R2dZSktvWklodmNOQVFrQgpGZzFwYm1adlFHOXJkR0V1WTI5dE1CNFhEVEUwTURVeU56QTRNamt5TjFvWERUUTBNRFV5TnpBNE16QXlOMW93Z1pNeEN6QUpCZ05WCkJBWVRBbFZUTVJNd0VRWURWUVFJREFwRFlXeHBabTl5Ym1saE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVEwd0N3WUQKVlFRS0RBUlBhM1JoTVJRd0VnWURWUVFMREF0VFUwOVFjbTkyYVdSbGNqRVVNQklHQTFVRUF3d0xjM1ZpYzNCaFkyVnpkekV4SERBYQpCZ2txaGtpRzl3MEJDUUVXRFdsdVptOUFiMnQwWVM1amIyMHdnWjh3RFFZSktvWklodmNOQVFFQkJRQURnWTBBTUlHSkFvR0JBS1lYCi9VZFY5SExYYk5LdjB5YzZZSkJ0emRXTnVHVFBJWFdWUENiME9zUnZSNTRscSswU0xQUUdKUzM5ZmxXS2lxdFVpRXVzdWloNkdkTGYKTnZGQVZMR1BxQlRXUTRMYzdyNSt6RDVxbkg2TGlUTTFLQ2JhRjN1dTJQK1QrdXRzR3FGVVphd0E5RkVWTkxrSUNlMzZYMXlFNDBYKwovak15Z3lpZVFQTWVKQUJ2QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVGQlFBRGdZRUFIU1dQRzR5MWJOeUp5U2diRnFEY1MvNk1VTklyClNma1FZSXh6SUdRMzdxeTVxQVcxNVlrQlVpVzlUc0dKUmNyZ3VzVnJaSWlhMThlWXo4NFpuN0Z5VVpOTUZvMjRMN2w2QlMwV0NpdEkKUVNjQkNLQjRRV0EvYjFzenFzN0V0cE9jUFAwMVRZTnEycmFzK1ZxUjNhV0FYTFgyb0tmQ2xWL1NVd3N6UmY1VTg1WT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbDI6U3ViamVjdCB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOk5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWlsQWRkcmVzcyI+YmVuQHN1YnNwYWNlc3cuY29tPC9zYW1sMjpOYW1lSUQ+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgSW5SZXNwb25zZVRvPSJfNWMzODVhYmIxNzczNWI3YWE4ZDEiIE5vdE9uT3JBZnRlcj0iMjAxNC0wNS0yN1QyMzozMjozNS40MjZaIiBSZWNpcGllbnQ9Imh0dHA6Ly9sb2NhbGhvc3QvYnJvd3NlclNhbWxMb2dpbiIvPjwvc2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWwyOlN1YmplY3Q+PHNhbWwyOkNvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE0LTA1LTI3VDIzOjIyOjM1LjQyNloiIE5vdE9uT3JBZnRlcj0iMjAxNC0wNS0yN1QyMzozMjozNS40MjZaIiB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWwyOkF1ZGllbmNlPmh0dHBzOi8vYWRtaW4uc3Vic3BhY2Vzdy5jb208L3NhbWwyOkF1ZGllbmNlPjwvc2FtbDI6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWwyOkNvbmRpdGlvbnM+PHNhbWwyOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yN1QyMzoyNzozNS40MjZaIiBTZXNzaW9uSW5kZXg9Il81YzM4NWFiYjE3NzM1YjdhYThkMSIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpBdXRobkNvbnRleHQ+PHNhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlg1MDk8L3NhbWwyOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDI6QXV0aG5Db250ZXh0Pjwvc2FtbDI6QXV0aG5TdGF0ZW1lbnQ+PC9zYW1sMjpBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+",
+          RelayState: "",
         },
         config: {
-          entryPoint: 'https://subspacesw1.okta.com/app/subspacesw_subspacetest_1/kvjj46lsDQEQYUDBZIYW/sso/saml',
-          cert: 'MIICoTCCAgqgAwIBAgIGAUY8zVPYMA0GCSqGSIb3DQEBBQUAMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFDASBgNVBAMMC3N1YnNwYWNlc3cxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE0MDUyNzA4MjkyN1oXDTQ0MDUyNzA4MzAyN1owgZMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjEUMBIGA1UEAwwLc3Vic3BhY2VzdzExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKYX/UdV9HLXbNKv0yc6YJBtzdWNuGTPIXWVPCb0OsRvR54lq+0SLPQGJS39flWKiqtUiEusuih6GdLfNvFAVLGPqBTWQ4Lc7r5+zD5qnH6LiTM1KCbaF3uu2P+T+utsGqFUZawA9FEVNLkICe36X1yE40X+/jMygyieQPMeJABvAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAHSWPG4y1bNyJySgbFqDcS/6MUNIrSfkQYIxzIGQ37qy5qAW15YkBUiW9TsGJRcrgusVrZIia18eYz84Zn7FyUZNMFo24L7l6BS0WCitIQScBCKB4QWA/b1szqs7EtpOcPP01TYNq2ras+VqR3aWAXLX2oKfClV/SUwszRf5U85Y='
+          entryPoint:
+            "https://subspacesw1.okta.com/app/subspacesw_subspacetest_1/kvjj46lsDQEQYUDBZIYW/sso/saml",
+          cert:
+            "MIICoTCCAgqgAwIBAgIGAUY8zVPYMA0GCSqGSIb3DQEBBQUAMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFDASBgNVBAMMC3N1YnNwYWNlc3cxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE0MDUyNzA4MjkyN1oXDTQ0MDUyNzA4MzAyN1owgZMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjEUMBIGA1UEAwwLc3Vic3BhY2VzdzExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKYX/UdV9HLXbNKv0yc6YJBtzdWNuGTPIXWVPCb0OsRvR54lq+0SLPQGJS39flWKiqtUiEusuih6GdLfNvFAVLGPqBTWQ4Lc7r5+zD5qnH6LiTM1KCbaF3uu2P+T+utsGqFUZawA9FEVNLkICe36X1yE40X+/jMygyieQPMeJABvAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAHSWPG4y1bNyJySgbFqDcS/6MUNIrSfkQYIxzIGQ37qy5qAW15YkBUiW9TsGJRcrgusVrZIia18eYz84Zn7FyUZNMFo24L7l6BS0WCitIQScBCKB4QWA/b1szqs7EtpOcPP01TYNq2ras+VqR3aWAXLX2oKfClV/SUwszRf5U85Y=",
         },
         expectedStatusCode: 200,
-        expectedNameIDStartsWith: 'ben',
-        mockDate: '2014-05-27T23:29:35.426Z'
+        expectedNameIDStartsWith: "ben",
+        mockDate: "2014-05-27T23:29:35.426Z",
       },
-      { name: 'Okta -- valid encrypted response should succeed',
+      {
+        name: "Okta -- valid encrypted response should succeed",
         samlResponse: {
-          SAMLResponse: 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly82NGY0MDk0Zi5uZ3Jvay5pby9zc28vc2FtbC9jYWxsYmFjayIgSUQ9ImlkMTk1MjM4OTMzOTcwNDQ4MjIzOTQwNDk3IiBJblJlc3BvbnNlVG89Il9jNjA1MzdkYWQzNGZhNGVjYjYxMyIgSXNzdWVJbnN0YW50PSIyMDE2LTA4LTE5VDAxOjEzOjM4LjEzOVoiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiPmh0dHA6Ly93d3cub2t0YS5jb20vZXhrN3hkaTZheFBmb21iengwaDc8L3NhbWwyOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjcnNhLXNoYTEiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2lkMTk1MjM4OTMzOTcwNDQ4MjIzOTQwNDk3Ij48ZHM6VHJhbnNmb3Jtcz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz48ZHM6RGlnZXN0VmFsdWU+enQ3eG5yTDB1Vmt6azN1NHhkS3hVR0ZtbHVLamM4eXlDOWZvanJ4NXFDbz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+ZUZlczNUUEIvZVFlUVBtUHBPYlA0UDNRWklKRGMxY1cwMk5UOHJlVEp1MG9lZElDTm8vTkJEeE9rMWJoODFJMzlMdi90MWRFM0Z3azBrZ0kzRUswV0s0UVpsSWZ2WkIrTkpPSlRjZW9CUnptTXRBeHI5cVlORWlHSWxZeGdwS1BDaG95OHQzcllMV3ZCZVpJc2pKOC9iYmRudXhjSFY3bXpveFkyNHdtYXFucXExNG5QSTFBZ0lIY1NnTVRhL1lqaFJwWjJlU0o2TU9FMU0vNDByL3VvRUlPWDVjMFVoSE1Gbzh3Yml2NCtvaTJPK2RPOVdha3BDN1Y5cHVGelU0OVF6MGR6bDFXaFIwYlp4VG1TYXI2WUY2NXMwZk5DUnorSGJ5a1h3eFZ4OFo0TTUxRUJHN1NMdWlQVFVJTjFNWVRXZXVoZll6MS9Pc2YvcGoxbHFLYlZBPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURvRENDQW9pZ0F3SUJBZ0lHQVZhWjA0UE9NQTBHQ1NxR1NJYjNEUUVCQlFVQU1JR1FNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUNBd0tRMkZzYVdadmNtNXBZVEVXTUJRR0ExVUVCd3dOVTJGdUlFWnlZVzVqYVhOamJ6RU5NQXNHQTFVRUNnd0VUMnQwWVRFVQpNQklHQTFVRUN3d0xVMU5QVUhKdmRtbGtaWEl4RVRBUEJnTlZCQU1NQ0daeWIyNTBZWEJ3TVJ3d0dnWUpLb1pJaHZjTkFRa0JGZzFwCmJtWnZRRzlyZEdFdVkyOXRNQjRYRFRFMk1EZ3hOekU0TkRVek1Wb1hEVEkyTURneE56RTRORFl6TVZvd2daQXhDekFKQmdOVkJBWVQKQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1RMHdDd1lEVlFRSwpEQVJQYTNSaE1SUXdFZ1lEVlFRTERBdFRVMDlRY205MmFXUmxjakVSTUE4R0ExVUVBd3dJWm5KdmJuUmhjSEF4SERBYUJna3Foa2lHCjl3MEJDUUVXRFdsdVptOUFiMnQwWVM1amIyMHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDdnBsUU8KTlZ3a25SeTFpQm5hb1p0c096MjhBN1hXMnRScEZXKzBMYTdSSmV4YnppSXdFeTFiUFpFTmhmd2pQWkExb0hIWnFpNWwzMTVCeFhLVwpKcW1tTm1iRENGRG8rL0ZZRkNvSFhsaWlMbTl2cURiUjFicjZCeXFlWTBHZnh5VFBLSFp4YjJGU2VzMzBUZmZEa25wTVFkLzhrQTlZCldhVzV4RGx1Mml2V0pJK3NmY09KT01kNnQrZ2NmWGo1OGE1ZlA4TXdtNlkyMjBLZVpTdnJWcEVWMktEcDlobG43Zmhob3hIWjdLL0IKWWJpZHFkd0x6ZVVRWHBiNkxJcnh0S2R1ZzJGb2ZTK09OczZ5TElRUm1yYkNCN1NWWDFRQThKSW5NbitmenJHdFptRmlIUjBhRmJ5aAppTzc4di91ZkRhNlMrWHBZeXAyYjZENFNuemVnZ25vYkFnTUJBQUV3RFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUoyd2NGVmZmRkhTCmQ5cGo2UmdvTkhYWkJzV3AwSFVack5la2lTYmdvbXI0dFNEZWZXdEtiMDRuRklsUnl0ZlZzL2s3NHdtYk5pUkNFOG5EVkJyQkRGQS8KK1R2LzNQb3daWEhqWEtCb2ZVdVNjVFA0L1R3MU4veXdmN1YrWFk1a1YzVm1MQkw2YXgrVUxKYXVSL1lHSUlNc0ljL3JTMkQwNGFBYwpTY1U5cHFWaDJNTDduVEg3Z0ZxWXJ4eXBhdm1WazZLOTR2TGpzMGdnRjJUR3A3dFhDUmplT2xQUEpTK01PSkhKaFRCV1lGV3ZCTGNsClUzemNyaTN3czdHcUpNcGVpSGE3ck1vSFYwb254V3NaVFpXNTd5YmFJV0tMdDFnb0Fvb0M3aHEwcng3b05sT3ZyeXM1bGxsaEJ5U1kKWUMzeWNxY2EvRDArR3hYTGNFcjlRd1A3VFZ3PTwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1sMnA6U3RhdHVzIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDJwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbDJwOlN0YXR1cz48c2FtbDI6RW5jcnlwdGVkQXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj48eGVuYzpFbmNyeXB0ZWREYXRhIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIgSWQ9Il85ZThmZDJjZTRhZDAyMTJjOThlNzA5MWNhODc2NWZiNCIgVHlwZT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjRWxlbWVudCI+PHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI2FlczI1Ni1jYmMiIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIvPjxkczpLZXlJbmZvIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6UmV0cmlldmFsTWV0aG9kIFR5cGU9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI0VuY3J5cHRlZEtleSIgVVJJPSIjXzJhZWE3YTY1MWRiYjY4NzkwMmM0ODM0MzJlZDg1NzgwIi8+PC9kczpLZXlJbmZvPjx4ZW5jOkNpcGhlckRhdGEgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIj48eGVuYzpDaXBoZXJWYWx1ZT5KQVJJWlJOMnFPRFhKZ2F2TW9xZXFmZng4QTZLaGcwa0xBT3JYSzQzdW1KVWhpTUI2MzM4dE9IbHNYYWlhdjRnSDZHUG9GbzM0Y1VrWEVkY2VEb2dpSXBKSGNwWnJ3YUVaZW9wM1Q3aHpoSGxRUnBISk9aVXQrWWRqVnliQy9JMmVuNmdGMjdwdVpkTFhIU2dvQkd0akprb1Q1dGp2Yko1WWs5WVdYaHp5eXNva3djNHczNmpjdlVRVEtBUE1nQXoraUJ5Tlc0ajBLcXdHU2RCMXpqeEZjOXhvYy9Ua0FxZlcwSjFxWGJlWG5scmh6SFdQNC9kck9YK0tLS1pxM3VtYnBOZkQ2RXo1cVRueWt4ajhwbnIyV2RFZVVDWldkOTZZY3MycWVXbXY5RUlncVdydzVud3JLaE5qNVJmSzA2NXdUZWc2MFdLWjU5MHdXRjlMek0xZ1dFL2l0U0hDZ2N2NmFPSjNhRVRHV1AvU2pESlFVQmFZY2ZMeFlFNU50clF2ak5HcHVIRlkvNVhHdEIzS1dqWElkWlVFMW91ZHRqNjY0T1podVEyUERTQ2ZmSC92aGJKZ1c2Z0szaXYxM3RZeUJTaUJ6bVVzdWVhSE9HdUZJeUtpaDdxUzh3dFRHTGRjWDZuWTJaRkJZSmZQZXZaMTUzb2JKdXVvM3FFNnVndkRRTUgwL0VwZlhZZTRpUFVtbHQ5OXcwWWdTNEt0dTZaMWFZVnpYZGdWY29maVlVQzhzdzJiczBSQUNiQzVMa1Y3a1ROMndYVStuTjBvQ1lLaUxML1oxWmswbGx0c1gvV1BjY09PR3pjWENMUkwyRmxvdjhyM3BOeVNMV1AweGFCUUdodUlZNmMvYVJvRDZZOXphdG9seWFzeTVHbEJSQVJOK3Ixdy9tWW9laEJ5WnVxdnVINmhDWGF5bnU1L2szR3Q4emdoc1FoNjVwVVYvbDRQa0prMThmNGRzbEdyMUh4eWRJVjQ2YldtVzFwTlNsQ01PeXhBcW5IUEhWd1BBTjJHN3ZpRGZQbkpZZEhXOXlZdkZTUTBhczM5OGtyNkNRWnlJMXRWWXJDZHNGdllLRURrcTI2MTNHWmxsMjRPaUpiYnVHV0VJUk52RDR3VzdsSmlmYk1pQnZkSDNNci9PUHNHYStmamNmaWM3MlpGSnU5TUxoZTBSSnQ2aTVsdGxPdXB5ZU4xVjE1QUR0TnRFZ01IdzRFS3ZkUktWUDVnZytmL3FLQVZLdkV0dlVJOTRSV21DYzZEQ29BVmNRSnJzYnkxblhMOEdxcFZ0V0Qyd0VSd1pWWUh6dVlyM0UrTUFJNXl6eEJOcFlwL3kwTEVjeEdIYkZiUFRacXhuWk9WL1FaL1laWDNKK2svZXdseVhpY2RpWFNXN25RMnB2N0Rna2RqYlQ5NmRXa1hwbDlHQ0JmZTVoVGJXTDZscksxcW9oODYzSHA5c2dOcS92RjArYUlMWFZQK3Z5OHRxZ0F0MDZSRFlKaFRZWWVOSHY1c3luTXRiV2hPREh3TEIrdUVHVWtNZW5mUm9zWDl5N21XSkxIWmdMNGNwektwT1A5WlBhbktYT1RvZVcyanM5TmEwdURDUGI0YkdHdkdGTHh6Mm05U05ETmtDTFZFaEI3aC81d0dabHdYbXpVanZhQlprYnhrbGFEb1dYVG5iQU9jT01Sa1RQRks1d0JYYVRaTkFsUkhpOWh5TWQ2WkJ3OVp2RklFczY4K2wxcEhRY0dKT0RYR1JtYUZNUVMrQlVRV1JxcnNoVXpTY0d1cVljdTVsc1FtRExTSFdnaitHRnEycGE0eGQwZGJRSVN0MDdETGo1RUtmRFUzOXNCRGo1bncvd2FUNzhuYmtXMDd6cE9PbFFEd0F5dG5aRWthdEJtMzUyQnBhaEg2SkxRQzFTNG5TWTlKbmhsS09EOHJLRE5NVTR6VFJOU3FxT0JTRmlwMlRJaU0ydXYvSlVPSkNpRUNYSkFaY05vcEhwZ2UvNE5icU5ycDlzYlBTM1c1T0ZpMjdWMktON0htVk9YY1JWY2FNenZsS1YrRDNIdVUxeGxPdnlGTWI4WFhtZGRyRFV1dDBHWEhTVmNpYys1TDBuUWc4UXVKMHBIVzM1MkVPMHJ2NnRTV3cwUUV6NzZJUzNhWnkwZmkxVC82ajQwTVptR1E1NFJPTDBrRlZwU285UWhTWjgrMnE4RnFGOW5DYWJkOVFzcUVSRFQ3VzhqaWo3QklMVjZ3azMra1lkMjZReGhObmlOOHJkYTZvRnpXb25Ddzl2dzUwUHRwWS8vTUpvd3FLWGFhRFNzY2R4K3FDRWVBWm0vNWxYZFdMb2tHaXRhRU56SEtXR05vYlpJTnVyM29lS25lYmVuMVY0amlvb3RiQjA5WkhHR1R6ZGNDSHZhUXZMWjUzSndTTFdYYXM4NXF0L0ZUVHpvM3NPYUlESFBJMWVQNUhrdENQMHFTL0pyeGZFbVhtdkRrQUt4L2x6cGhLY0tpU1cvWmdqMVh1OTViZURqTklIcVBVZzF5M0d3bTBWbzlJcjR5cGhtY1RoMXZtRTV1bHNlVXJ4SlJ6TEVscGZzR2MxeU5QNHhHY1NsL05HODd6SHdMTTFIRlN5MWdCN0FJTFY4VkpCb29XdHJXQ3pqL1Y5YVBBeU9ySTFYaUpOQmlNamk0SnpCc0VvR1pNQXREc0lyNk5kNlZ2ejlvYUlubUZuUXRjWHE2c0wyTE11NjcvUFlzSGhtN3E3UUFrbHQ5WXNOaGpKUWlzcENkbFdHRk9yc0lFdWpTbGJGS0gvUldyRUwzWWJOdUV0bTRqUWY3MnNQUEMyT0M3c0JqMDZoQjVVZlZUcDM5SlJtc3pmNGUzVE52NHo0SEUramIxVlNGQkQrM0tnaHpwQTNjREVnZEphQmE2ajFrbnJ6RjJUOUZudDJrTTBFSmwydUxuS0dCUnBSU2IrZ2FUWVh3NjlaaUtJa2kyY3Q3dS9sd1BpUXFRU2FjSzJ2M3FLNmtWNFUyb09Xd3BNTkI1WXpPeE1JZTBGeEJoZFl0dEJPT0FNM0dGOWlIaFJObWlhMG5GelVRcXc0b2RzTWVRaU84cnhWNDZzRGZ6bmRpVjc3SzNaaWR5anpCalRPMEpBK0R1NU9lZ1dTaUdTZTNzdUx3Rll0U1VKbTZIN3J0am1hbEhKNEMrTisvdEJmNHVVdlRXaFFkejJOUHpiblV2bmZ4c1YyazlFMTRZSkg1UjZTUndTY1czQ1MzV2EyYmZwSnUvSUg4cGZ4RTVzQmRzZlBmMjNYR2FBdVBocmt0TVBRUzdQaEJWeGkzUk5vb3kwd0NGaTZRMWFTT2FxREJyNS9Gc1cxNy9uT2NOL0tDYmt2NFdiZlZ1eGZBSGQrSXl4M1RTbTRqVFlPY0QvZXcxLzRPT2QxQjdVK2g5Qm5kSjIwRWZiQXNxZVpuRlNyWnpFMWJLRjFwK05VaDRaMnBUMlVOYXo0WEQ5MXA1Z3JPZUsvTkdnUEJvSjIxVis4NXpISmpncjNsYWg4NVdMNFV3YUhHL2tuOTAzZGdqMTR5clYzTis2OXFJeW04ckxtWFFCeHRJYmJaaXFJM0RTNXRJaWJkd3ZUQzU3UnNzaUJ0ZFRFWWVnbFI1SGpTOWQ1ZkZpWjhNeGxsMGhaUXJaS3NERHZUZjMrZjBSVzNDV3RLTFZDRDRtaUw5WUkybXl0SXM3Q3JNSDZ0anFVbWNoNjZ2eTJJRFhqUXltVGc3cXMvSGRwQ2J2U0FvdWt2cUJlam9FRVVwSG5scko3K3B6SmJiUm5jQXFpUDVQd1VzWGZNNXpxbjJueGRxT2RUV3VYOTFGc1FUU2JrcUdHMkNEWHRiUjFiK3JiSVZFVWNHdHgvK2c1eVNYNnVFcFdYV2ZnZ1lGQzUvMWJuTUdmZ0VJYUZnVkp3L20wYVg5b3I3dzQ1T1VqNGpnNHdENG5sd3VuR1ZJUE15YUR5d2dxeWZCOWw2S3AwMjZPa2ZldnlVMVNiQkIybTN0bkZtTDhCSEVuSVplbEhyT2luV1dqMXBTc2M1WkxySU9nRWhIMm1TY3Eya3BSOXdjbU9obkRTV3A2d2h1N0RjTTZnRkw3ZGJ3aU1hSGlTMzNYR05TQlVpRWVQYnJUTVl0L0l6TjVjSGpIM0JFZ2JwY3lRMERnNHEzaVhSTElkYUM0eS9nWHkyRU1iZEFYMFRlUzRoVmxscEtFcEJpMmNsVFgwZWJFWk9aTDFpMWhpRHh6aTJGcG5xNk1qd2hrYmhzT0ZPMGtGYzdYWWVndGZFeGFsUEFWRHR1VUNRb3BScjBtM2s1b3dYSksvNUtUUktRaW5sUm1LakttN1RzNGdsRUhycHpWYWhkV1JZSWtuU2hrV3cxMnNHODdlTFJqa1pZbkxuaDZLMkEvNzlXTkpMZXYwQXlpa1VjbjlKaFBRTS9oUjBxWWc3WXQ4ZmxrQWtaOGk5Snp2Z0pWRHkzRzMySWdtY2J1MjVRTWZaUzZJV0hUSmJ1Uk5ndHNGdm1ndjhtQUZ6UnV3bUdvaXVWUmtTVURRS09VRCtObDdUcm12b0NPWDhiZFgvOHNMZnV0bGZ4YU5DcXRVN2gxcEQ5R1JQTHVSUzUvdzZVSkc5Q0JOM3JMZS9Ha20zQTFDMElaY2E3eEYwZnAzQ3JpQlN2NzFpN2VkM3crcGt2cHVMSUZ3NHZsV2thRkplZTZuQkl4WEpVMmZFMmVkTWs4RXFwSXg5SHlaZk9IbVRVY0QzN2tvbGJPTXlUeU9pQ1RNYjFreFFCNHR6bFh2VG5GK3l2Z3JPUm5GZVVYMmUrNk1lQWY4cXc2TUUwQ3NQOTBqbDR4dHpIQUtxZFlLWjNaSFhyUkZmeEJyWXY4bEN2c0ZGWEtOY25hU25WWkJ2bFVQekI2NmZYMG9WWTIxWkxwMHRUMUE2NzF5aU1odktOTHRFckZXQm9COTFTTVI1SWFlMnlidDE2cTVCWWJod214K3ZxYUo5Zjk1QzVRNUZ2ZWt4bGg3Z2gva1ZlMDl2WXI1cStpVFNqdEo1YWpvcXRBTklJejF5dDAwR1o3RVViRnBvN0VSVGk4c0E4V2JTUWFCZnJjTHljRWw0SVdjVGRTdjhYMjVIcytWeGgvM3FDQVlMdDRjam5Pa1ltS21xamc4c2hLN1RSQmdDcnFWZi84RjdqN0ZjaW9PSTBHakZYZ2tHQWExRXl3dk9RM1k5VXhNTFAvOTBIOUVaSElBRGVZckhpbzAxM0FUdlhNaTY2bU9ETUQrWXRCb21sR2YwRFYxU0g3Qi9wR1hxYS9uTFFxQUE1cDFrZEFBa0t1KzQzdStzNnVhOGk2bHRnMnNDdVlnQ0JzYUFhSXQxWXJQOGp3MG8wZEUvYmo4TTF0Y2JXOFo4UFIwb0VFOGNuK004dnVoU3JTZ2l4ZXl6bHVJSWEzR21BcDRWZ0pldHBnNjllS2RpT1ZlVzFNVUNxdit1bit4MnNOWStUNzFjZTZPMzRqM3FmVFpiNEVrS2haTWk2aEdhOS84U3ptM3FZRklUcDcrb0VrN2tzenNrSTZDZDVGSWd4c0UzTVc1elVlUEVoc1hvVzM3V3ZBZ1lpQjlTRGkyNHB0blk3dFg5R3JKb2VURllJZUt5Vi9mNEZSdmlSMVpjR2tTTEU3MmJqSGs4Skw4eTA4NlJvMVB3K2x6cWd2T01xVmV1YXhEd0laQ3lDZGxlbUJEZnNKdkFBNmVXSkhUdG90VDJjNS9Wc20wbEdGU2FxaWtEOWRRcGJoYzlZaG1rUVpEU1g2SU9FODUzalZOUUxuSEVsb0JHVEpLZEVMR0lRQjVOQVM4dzZ1R3kwN0JzbS9sYllsRG1OS0dWRXdnVm42bUVYN0xQTGxmSlJLdTdzR1pJUW9TRS8zUTA0b0thZUJPaTNIMzRFZ3VnNG9qWEl1SmRSU3pNUWU5U2hNQUNiNDAxY1RzYllNS1Y3anFsWFQzL3pGWG1DRkNsNmZuZG9Wb3RYT2xKVUlWQ3phSnlmY3gxUnFjZnBpTWJYUGMvUWR3RzR0MlYwcGRMY1lOaHp3dDFqd0plZHBYU2dCNlhxVWNDbVFDMTB4SFFrYTRxMWJmRFg3VVl3U3dOZVUydzQ1UjB1MHBrdGFhMXZ4SzJDNnVkU0Z2SkZjTTZSbXluOVl3T1VNbzBRRDlaamdncGRzRVhTZ3lUWENCUGFjUHR0YTBtRjhvRjM3NlZYRUpzNEhkdVVBei9VY3pJcUxZU21lMy9SdXk4aitCY1gydVJUVk9WLzM0bWVLTG1OMHNrY1BMWFQ2VlFHTWtjTFQvK0sxUFFsc0t5TWtRYXAyWnZiTHJEVjQ5UzJkY28zK1l0KzZ5V0ljN3BQdyswUVR3S3A1NGdVdVU1OEVia3hxMytuQmNSOW50M212S0pPZmtQaEZqeVE0WVhzeFlRY3dpdUZMeDJjcHZhOFMybnNxdnRKNGxNdEFsQzJaU3ZUMzJEcEs2NWZiaWR3ZXIvYWVyVTFLUjFqdkZxS3JETzN1SjMwRStKQytoVlFqTWpEanhCY2FBZCtFT0pPSFVqck1wYjFCcmRxa0FaaHMxeUhDSGJOekVMang0V2xUSW81WGM2UkpjdkxZcHhzckh3QVA2dzJLSTg3N21rNFhjUm5CRnV2dkZqOW8wT24raGZuei9HbDZzODZYdXVqSy9tWUhJZEhuYzFYRmxEek5aL3hCTWNFLzVZYXpIUEFQck1yZW1wYTVISmQ3UHRtN21ZVm90VllyT2lPc1JoWHUzRDlVU01Cck1mT2t4L21oVU9jTERXODJUaEpzQXV3aUEvTWk1cU54RURRR3dGSy9lbDF3a2Mybk5tZUgzTTVzTlRDcFVLOHllS25RdlV2ZVFyNzBWYThrYi9RcGJDelNPSEM4RTc0T0wyVWljK05qRzNBbkt0U2pvZSt3ZjE3R0FBN09SdkV6TW42ZVg3bndpZHMvR1FtYVhDVDZiQWdpMTQ5cmVWbGNZdXZUSDZpWGVyWHNkYzZKOGY1aU1NMHlpN0lralpXb1NRbTcrTnlpcFZHRUluaz08L3hlbmM6Q2lwaGVyVmFsdWU+PC94ZW5jOkNpcGhlckRhdGE+PC94ZW5jOkVuY3J5cHRlZERhdGE+PHhlbmM6RW5jcnlwdGVkS2V5IHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIgSWQ9Il8yYWVhN2E2NTFkYmI2ODc5MDJjNDgzNDMyZWQ4NTc4MCI+PHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI3JzYS1vYWVwLW1nZjFwIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjxkczpEaWdlc3RNZXRob2QgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48L3hlbmM6RW5jcnlwdGlvbk1ldGhvZD48ZHM6S2V5SW5mbyB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRXNEQ0NBcGlnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFVRkFEQVRNUkV3RHdZRFZRUURFd2d4TUM0d0xqRXVOREFlRncweApOREExTURnd01EVTBNVGxhRncweE5EQTFNRGd3TURVME1UbGFNQk14RVRBUEJnTlZCQU1UQ0RFd0xqQXVNUzQwTUlJQ0lqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBNWhxamFyb0pwQithUjhGTUU3aFE5bk1WMGg3TXBLdG1nRkxjSzN2d1A2N2YKZUFLK3hkdDE3aThSeVVoeGlsOUZDRlI1SzA4V2p3bzNOaUhacUhxRUtpdHcrSUpTbmRqTFNzb05nS0VJYWlGU3VnMmVWMW9ZRWx6MAo2REJYVHhjOGlxL0xhem5kcVRVb201MU9kZTl5STlBR2E4OGNETTVpT3FxOW1odUd1dnd1THRveVU3OExkK3MxRWE2TWdmN0w4TTdmClpWTzdOY3UrRmdJekk2R3QwMzVvaFlDTEJtT29NN28wdWo3RGNNRXZLT01Geml3RjQwd1lteXAzaENMbHEzcXdrTTlwVFZKbHR1ejAKQnQxdnFEZHJxM2tUaGVBOUpITWF5UnozSS9CWnhBVjNpUmQ0aHpMS1RrZWdEOFRvVEdVMTBHbWUrWkFyMXcvZXJjNWhWck0wL1hCbQpIUWxuSTVkMzFHVS9tZklrbTBYUFRHUlNwUHk3RStkVXZqOWRqdm0vVnFEZG9qZjN1dXdpckdlTE1SbE85UC9sQ2VyVGt0VzNnMjdTClY4Z24zRVRtMk1tN3JrTnFmMjRLSnBEdjB0S0Rvc2diZGFIcjJJRVlENFJwcXlTcDhrZDI1Qmh6dXNocUtSa1M4WHU1dDdIQWxWU0gKd2lGaHVMcXJyNGRVZmtCOGtaZU0veWNmWkxDbjdvTlVERmRnakdZU1ZNcGFrTDk3c0M5c2xBVzQvOFV0WFhaeExxY3lxL1l4ZHBDeQpzUFlQMWhzQXArVmdQQzdHSTZDeWlOb2pLUE9wdE1xTFpSWW5WaUt4bE9pV0JKQnpVQlJVVnVhYzhMWHJNaUR3OGJ0V0dhMUdoNXZUCmh1RlVLc3ZtUm9ldWs3ZXlYRU45SjdqNitmVFlqbnNDQXdFQUFhTVBNQTB3Q3dZRFZSMFBCQVFEQWdUd01BMEdDU3FHU0liM0RRRUIKQlFVQUE0SUNBUURBUEZVbzBQZ2E3dkI0SWp5OXUzcXBXTFFTQ2Q0eGZ3OGw5MmlxM0pxTFZYQng4R2Y5WFZ5Nkd6YlhXSWU2cG1RSQp6bW9tL0NXUXZoNm83a2MwRjR5NGZ0c1dmcW5xM2swK0hjWDRIZXUxUE4ySFNuVVVQTnNrNUFkZ2dkMzEyOU1ISWRmYUtiOGJTdUxKCnZTTWVNYXljcm1zYitnRUY2SkZQOGtHV09QNHhRWWpBVk9EY0ZiT3lBZkV1VkFodWp3MGJxbExIVCtFbDR2bGZCcnRkVStNWnp0SXEKUWtHRFc3Y21tODZaR2lCci9nYTk3QkNuT0NyZ1pYbHJnbWlhOFNtRjdSZmE0OC9Yemg3YkRtUGZnbUhnbEw1SnhocFJYMklvUFk1WApJdG1SOElhWUtoT0JPck8vcWVyY0o2WjNyUTZmSXJzOEhyWWdlVE8vdUU5d3c2V1JXQ1dEYUNSNG9XRFZ3akt6R2ZQMW9KdEFJUStVCk5qT2RkSDVvdERhd1hKUmxRV3ByNzJxVDcrV09LL3l6SmhOMHhtWERrbXQ1cHNNWS9DRG40a1hNTTB4YVJwZllPbjVTYzFvZWxRK2gKSW04L3JIVksvMGtyaENET25pcWorTC9uZTJTb3lvWFlnUzZvME5sa05odFRIbWpqb3NFN0hWNkpmQVVncTJEOWRxMDBKTzk2N0kzUAowVkY2RjhsY2RhcTB0b3ZKaEtXUmpycmlnWWQ3NTYvM2FUMkI4M0pXQTFSQTluaVhtclhmbkFQWnJOQ2ZXdmorWDJhbFVOL2l6ZElxClJ0czBVcFdUb1ZVcjBveldnbWJtcDVaT0dZT1FoK2xOY0FwM1Y5bE9yZGJaVlNJVE00N1JZR0JaYVpOREEyUGJEekMxM01TL0VqVEUKdlNrb253dGxDZz09PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PHhlbmM6Q2lwaGVyRGF0YSB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkNpcGhlclZhbHVlPm4wR3IzSWtSSWRjaDZRVHhsTDJRWkNuUVBGM3R4T0hHbXpSLytObzExUlRSZjYrczBYUGxvK0RqYVd1RVdwMkh0MldkRm5UdXM5RmJwSGF0UVdiSVI1SVdUQXFrN3ZXSWlhTW0wV3prRnVPR1hrYi82ckV4cUdOYnY4UTlJUHVMZW85VVNOOWNrZTF5RFlFK2F2NngyU1ZzUjMydHJINXBCV1VyYkNCV0pGNWwyVXRHVlNwWEVwdUFWenppUVhDWTBycXltdmZSVmFGbGhWMVMyb2RXVW1LZU5YL1ZKNXJuME5adE5Zdlo1ZXFhWWJjNnpUQ2sxMEVkUjB6czV6UDFmQmxYMmtDVE8zdlZqNWhHKzV5TUdvRFR3OWxYWXBZUDNtUVpERHFlU2hDcnNKeitPNjNpU0oxZkdqdndhSWZ5QTB4ditON2MrR3I1Zlh1UzR0clozcU9GYkx5TStNS3NWVUNJNG1wTmZsUHRYNjEvSm1NRXFBZFNreFRadFZtY3NDbDZyNlVoSVlVM2ZEOS9JaGFWZDZtSFVvMVJ5WGVnOTlZNTVBMzl6VVVtNWViNzFsVC9qZjduV0p1ZWI1SWZIa1hMQ0ExVldBZGllV2hTbHNtKzBUd1ZKRE5TYTlocUYwb1ZLL0FLcTZEV202ZStVUmVyazF5NFJscDZQa2owb1hBclJ4dkJFTTJXT0VBQWJxdndyeldtSlIwZ2lnQTdVMHB4YnpGcmRoNzdzOVZuRkFQc1Q2aDZ6WmYrbWt1d1JIQUh4Zmk1dURzU1c3RWw3cVdmMjh1dnhKeXUxL0FjbVNHNDRxSk0xelZhSlQyVmU2bXZFYktOWVJ6K2FCZzVNSG1hcWdjQm82VTd3Uk16bHVPNGlSbjVJSVZ1eDlGRTY5eUVhbWliTFNVPTwveGVuYzpDaXBoZXJWYWx1ZT48L3hlbmM6Q2lwaGVyRGF0YT48eGVuYzpSZWZlcmVuY2VMaXN0Pjx4ZW5jOkRhdGFSZWZlcmVuY2UgVVJJPSIjXzllOGZkMmNlNGFkMDIxMmM5OGU3MDkxY2E4NzY1ZmI0Ii8+PC94ZW5jOlJlZmVyZW5jZUxpc3Q+PC94ZW5jOkVuY3J5cHRlZEtleT48L3NhbWwyOkVuY3J5cHRlZEFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=',
-          RelayState: '',
+          SAMLResponse:
+            "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly82NGY0MDk0Zi5uZ3Jvay5pby9zc28vc2FtbC9jYWxsYmFjayIgSUQ9ImlkMTk1MjM4OTMzOTcwNDQ4MjIzOTQwNDk3IiBJblJlc3BvbnNlVG89Il9jNjA1MzdkYWQzNGZhNGVjYjYxMyIgSXNzdWVJbnN0YW50PSIyMDE2LTA4LTE5VDAxOjEzOjM4LjEzOVoiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiPmh0dHA6Ly93d3cub2t0YS5jb20vZXhrN3hkaTZheFBmb21iengwaDc8L3NhbWwyOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjcnNhLXNoYTEiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2lkMTk1MjM4OTMzOTcwNDQ4MjIzOTQwNDk3Ij48ZHM6VHJhbnNmb3Jtcz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz48ZHM6RGlnZXN0VmFsdWU+enQ3eG5yTDB1Vmt6azN1NHhkS3hVR0ZtbHVLamM4eXlDOWZvanJ4NXFDbz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+ZUZlczNUUEIvZVFlUVBtUHBPYlA0UDNRWklKRGMxY1cwMk5UOHJlVEp1MG9lZElDTm8vTkJEeE9rMWJoODFJMzlMdi90MWRFM0Z3azBrZ0kzRUswV0s0UVpsSWZ2WkIrTkpPSlRjZW9CUnptTXRBeHI5cVlORWlHSWxZeGdwS1BDaG95OHQzcllMV3ZCZVpJc2pKOC9iYmRudXhjSFY3bXpveFkyNHdtYXFucXExNG5QSTFBZ0lIY1NnTVRhL1lqaFJwWjJlU0o2TU9FMU0vNDByL3VvRUlPWDVjMFVoSE1Gbzh3Yml2NCtvaTJPK2RPOVdha3BDN1Y5cHVGelU0OVF6MGR6bDFXaFIwYlp4VG1TYXI2WUY2NXMwZk5DUnorSGJ5a1h3eFZ4OFo0TTUxRUJHN1NMdWlQVFVJTjFNWVRXZXVoZll6MS9Pc2YvcGoxbHFLYlZBPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURvRENDQW9pZ0F3SUJBZ0lHQVZhWjA0UE9NQTBHQ1NxR1NJYjNEUUVCQlFVQU1JR1FNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUNBd0tRMkZzYVdadmNtNXBZVEVXTUJRR0ExVUVCd3dOVTJGdUlFWnlZVzVqYVhOamJ6RU5NQXNHQTFVRUNnd0VUMnQwWVRFVQpNQklHQTFVRUN3d0xVMU5QVUhKdmRtbGtaWEl4RVRBUEJnTlZCQU1NQ0daeWIyNTBZWEJ3TVJ3d0dnWUpLb1pJaHZjTkFRa0JGZzFwCmJtWnZRRzlyZEdFdVkyOXRNQjRYRFRFMk1EZ3hOekU0TkRVek1Wb1hEVEkyTURneE56RTRORFl6TVZvd2daQXhDekFKQmdOVkJBWVQKQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1RMHdDd1lEVlFRSwpEQVJQYTNSaE1SUXdFZ1lEVlFRTERBdFRVMDlRY205MmFXUmxjakVSTUE4R0ExVUVBd3dJWm5KdmJuUmhjSEF4SERBYUJna3Foa2lHCjl3MEJDUUVXRFdsdVptOUFiMnQwWVM1amIyMHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDdnBsUU8KTlZ3a25SeTFpQm5hb1p0c096MjhBN1hXMnRScEZXKzBMYTdSSmV4YnppSXdFeTFiUFpFTmhmd2pQWkExb0hIWnFpNWwzMTVCeFhLVwpKcW1tTm1iRENGRG8rL0ZZRkNvSFhsaWlMbTl2cURiUjFicjZCeXFlWTBHZnh5VFBLSFp4YjJGU2VzMzBUZmZEa25wTVFkLzhrQTlZCldhVzV4RGx1Mml2V0pJK3NmY09KT01kNnQrZ2NmWGo1OGE1ZlA4TXdtNlkyMjBLZVpTdnJWcEVWMktEcDlobG43Zmhob3hIWjdLL0IKWWJpZHFkd0x6ZVVRWHBiNkxJcnh0S2R1ZzJGb2ZTK09OczZ5TElRUm1yYkNCN1NWWDFRQThKSW5NbitmenJHdFptRmlIUjBhRmJ5aAppTzc4di91ZkRhNlMrWHBZeXAyYjZENFNuemVnZ25vYkFnTUJBQUV3RFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUoyd2NGVmZmRkhTCmQ5cGo2UmdvTkhYWkJzV3AwSFVack5la2lTYmdvbXI0dFNEZWZXdEtiMDRuRklsUnl0ZlZzL2s3NHdtYk5pUkNFOG5EVkJyQkRGQS8KK1R2LzNQb3daWEhqWEtCb2ZVdVNjVFA0L1R3MU4veXdmN1YrWFk1a1YzVm1MQkw2YXgrVUxKYXVSL1lHSUlNc0ljL3JTMkQwNGFBYwpTY1U5cHFWaDJNTDduVEg3Z0ZxWXJ4eXBhdm1WazZLOTR2TGpzMGdnRjJUR3A3dFhDUmplT2xQUEpTK01PSkhKaFRCV1lGV3ZCTGNsClUzemNyaTN3czdHcUpNcGVpSGE3ck1vSFYwb254V3NaVFpXNTd5YmFJV0tMdDFnb0Fvb0M3aHEwcng3b05sT3ZyeXM1bGxsaEJ5U1kKWUMzeWNxY2EvRDArR3hYTGNFcjlRd1A3VFZ3PTwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1sMnA6U3RhdHVzIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDJwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbDJwOlN0YXR1cz48c2FtbDI6RW5jcnlwdGVkQXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj48eGVuYzpFbmNyeXB0ZWREYXRhIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIgSWQ9Il85ZThmZDJjZTRhZDAyMTJjOThlNzA5MWNhODc2NWZiNCIgVHlwZT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjRWxlbWVudCI+PHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI2FlczI1Ni1jYmMiIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIvPjxkczpLZXlJbmZvIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6UmV0cmlldmFsTWV0aG9kIFR5cGU9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI0VuY3J5cHRlZEtleSIgVVJJPSIjXzJhZWE3YTY1MWRiYjY4NzkwMmM0ODM0MzJlZDg1NzgwIi8+PC9kczpLZXlJbmZvPjx4ZW5jOkNpcGhlckRhdGEgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIj48eGVuYzpDaXBoZXJWYWx1ZT5KQVJJWlJOMnFPRFhKZ2F2TW9xZXFmZng4QTZLaGcwa0xBT3JYSzQzdW1KVWhpTUI2MzM4dE9IbHNYYWlhdjRnSDZHUG9GbzM0Y1VrWEVkY2VEb2dpSXBKSGNwWnJ3YUVaZW9wM1Q3aHpoSGxRUnBISk9aVXQrWWRqVnliQy9JMmVuNmdGMjdwdVpkTFhIU2dvQkd0akprb1Q1dGp2Yko1WWs5WVdYaHp5eXNva3djNHczNmpjdlVRVEtBUE1nQXoraUJ5Tlc0ajBLcXdHU2RCMXpqeEZjOXhvYy9Ua0FxZlcwSjFxWGJlWG5scmh6SFdQNC9kck9YK0tLS1pxM3VtYnBOZkQ2RXo1cVRueWt4ajhwbnIyV2RFZVVDWldkOTZZY3MycWVXbXY5RUlncVdydzVud3JLaE5qNVJmSzA2NXdUZWc2MFdLWjU5MHdXRjlMek0xZ1dFL2l0U0hDZ2N2NmFPSjNhRVRHV1AvU2pESlFVQmFZY2ZMeFlFNU50clF2ak5HcHVIRlkvNVhHdEIzS1dqWElkWlVFMW91ZHRqNjY0T1podVEyUERTQ2ZmSC92aGJKZ1c2Z0szaXYxM3RZeUJTaUJ6bVVzdWVhSE9HdUZJeUtpaDdxUzh3dFRHTGRjWDZuWTJaRkJZSmZQZXZaMTUzb2JKdXVvM3FFNnVndkRRTUgwL0VwZlhZZTRpUFVtbHQ5OXcwWWdTNEt0dTZaMWFZVnpYZGdWY29maVlVQzhzdzJiczBSQUNiQzVMa1Y3a1ROMndYVStuTjBvQ1lLaUxML1oxWmswbGx0c1gvV1BjY09PR3pjWENMUkwyRmxvdjhyM3BOeVNMV1AweGFCUUdodUlZNmMvYVJvRDZZOXphdG9seWFzeTVHbEJSQVJOK3Ixdy9tWW9laEJ5WnVxdnVINmhDWGF5bnU1L2szR3Q4emdoc1FoNjVwVVYvbDRQa0prMThmNGRzbEdyMUh4eWRJVjQ2YldtVzFwTlNsQ01PeXhBcW5IUEhWd1BBTjJHN3ZpRGZQbkpZZEhXOXlZdkZTUTBhczM5OGtyNkNRWnlJMXRWWXJDZHNGdllLRURrcTI2MTNHWmxsMjRPaUpiYnVHV0VJUk52RDR3VzdsSmlmYk1pQnZkSDNNci9PUHNHYStmamNmaWM3MlpGSnU5TUxoZTBSSnQ2aTVsdGxPdXB5ZU4xVjE1QUR0TnRFZ01IdzRFS3ZkUktWUDVnZytmL3FLQVZLdkV0dlVJOTRSV21DYzZEQ29BVmNRSnJzYnkxblhMOEdxcFZ0V0Qyd0VSd1pWWUh6dVlyM0UrTUFJNXl6eEJOcFlwL3kwTEVjeEdIYkZiUFRacXhuWk9WL1FaL1laWDNKK2svZXdseVhpY2RpWFNXN25RMnB2N0Rna2RqYlQ5NmRXa1hwbDlHQ0JmZTVoVGJXTDZscksxcW9oODYzSHA5c2dOcS92RjArYUlMWFZQK3Z5OHRxZ0F0MDZSRFlKaFRZWWVOSHY1c3luTXRiV2hPREh3TEIrdUVHVWtNZW5mUm9zWDl5N21XSkxIWmdMNGNwektwT1A5WlBhbktYT1RvZVcyanM5TmEwdURDUGI0YkdHdkdGTHh6Mm05U05ETmtDTFZFaEI3aC81d0dabHdYbXpVanZhQlprYnhrbGFEb1dYVG5iQU9jT01Sa1RQRks1d0JYYVRaTkFsUkhpOWh5TWQ2WkJ3OVp2RklFczY4K2wxcEhRY0dKT0RYR1JtYUZNUVMrQlVRV1JxcnNoVXpTY0d1cVljdTVsc1FtRExTSFdnaitHRnEycGE0eGQwZGJRSVN0MDdETGo1RUtmRFUzOXNCRGo1bncvd2FUNzhuYmtXMDd6cE9PbFFEd0F5dG5aRWthdEJtMzUyQnBhaEg2SkxRQzFTNG5TWTlKbmhsS09EOHJLRE5NVTR6VFJOU3FxT0JTRmlwMlRJaU0ydXYvSlVPSkNpRUNYSkFaY05vcEhwZ2UvNE5icU5ycDlzYlBTM1c1T0ZpMjdWMktON0htVk9YY1JWY2FNenZsS1YrRDNIdVUxeGxPdnlGTWI4WFhtZGRyRFV1dDBHWEhTVmNpYys1TDBuUWc4UXVKMHBIVzM1MkVPMHJ2NnRTV3cwUUV6NzZJUzNhWnkwZmkxVC82ajQwTVptR1E1NFJPTDBrRlZwU285UWhTWjgrMnE4RnFGOW5DYWJkOVFzcUVSRFQ3VzhqaWo3QklMVjZ3azMra1lkMjZReGhObmlOOHJkYTZvRnpXb25Ddzl2dzUwUHRwWS8vTUpvd3FLWGFhRFNzY2R4K3FDRWVBWm0vNWxYZFdMb2tHaXRhRU56SEtXR05vYlpJTnVyM29lS25lYmVuMVY0amlvb3RiQjA5WkhHR1R6ZGNDSHZhUXZMWjUzSndTTFdYYXM4NXF0L0ZUVHpvM3NPYUlESFBJMWVQNUhrdENQMHFTL0pyeGZFbVhtdkRrQUt4L2x6cGhLY0tpU1cvWmdqMVh1OTViZURqTklIcVBVZzF5M0d3bTBWbzlJcjR5cGhtY1RoMXZtRTV1bHNlVXJ4SlJ6TEVscGZzR2MxeU5QNHhHY1NsL05HODd6SHdMTTFIRlN5MWdCN0FJTFY4VkpCb29XdHJXQ3pqL1Y5YVBBeU9ySTFYaUpOQmlNamk0SnpCc0VvR1pNQXREc0lyNk5kNlZ2ejlvYUlubUZuUXRjWHE2c0wyTE11NjcvUFlzSGhtN3E3UUFrbHQ5WXNOaGpKUWlzcENkbFdHRk9yc0lFdWpTbGJGS0gvUldyRUwzWWJOdUV0bTRqUWY3MnNQUEMyT0M3c0JqMDZoQjVVZlZUcDM5SlJtc3pmNGUzVE52NHo0SEUramIxVlNGQkQrM0tnaHpwQTNjREVnZEphQmE2ajFrbnJ6RjJUOUZudDJrTTBFSmwydUxuS0dCUnBSU2IrZ2FUWVh3NjlaaUtJa2kyY3Q3dS9sd1BpUXFRU2FjSzJ2M3FLNmtWNFUyb09Xd3BNTkI1WXpPeE1JZTBGeEJoZFl0dEJPT0FNM0dGOWlIaFJObWlhMG5GelVRcXc0b2RzTWVRaU84cnhWNDZzRGZ6bmRpVjc3SzNaaWR5anpCalRPMEpBK0R1NU9lZ1dTaUdTZTNzdUx3Rll0U1VKbTZIN3J0am1hbEhKNEMrTisvdEJmNHVVdlRXaFFkejJOUHpiblV2bmZ4c1YyazlFMTRZSkg1UjZTUndTY1czQ1MzV2EyYmZwSnUvSUg4cGZ4RTVzQmRzZlBmMjNYR2FBdVBocmt0TVBRUzdQaEJWeGkzUk5vb3kwd0NGaTZRMWFTT2FxREJyNS9Gc1cxNy9uT2NOL0tDYmt2NFdiZlZ1eGZBSGQrSXl4M1RTbTRqVFlPY0QvZXcxLzRPT2QxQjdVK2g5Qm5kSjIwRWZiQXNxZVpuRlNyWnpFMWJLRjFwK05VaDRaMnBUMlVOYXo0WEQ5MXA1Z3JPZUsvTkdnUEJvSjIxVis4NXpISmpncjNsYWg4NVdMNFV3YUhHL2tuOTAzZGdqMTR5clYzTis2OXFJeW04ckxtWFFCeHRJYmJaaXFJM0RTNXRJaWJkd3ZUQzU3UnNzaUJ0ZFRFWWVnbFI1SGpTOWQ1ZkZpWjhNeGxsMGhaUXJaS3NERHZUZjMrZjBSVzNDV3RLTFZDRDRtaUw5WUkybXl0SXM3Q3JNSDZ0anFVbWNoNjZ2eTJJRFhqUXltVGc3cXMvSGRwQ2J2U0FvdWt2cUJlam9FRVVwSG5scko3K3B6SmJiUm5jQXFpUDVQd1VzWGZNNXpxbjJueGRxT2RUV3VYOTFGc1FUU2JrcUdHMkNEWHRiUjFiK3JiSVZFVWNHdHgvK2c1eVNYNnVFcFdYV2ZnZ1lGQzUvMWJuTUdmZ0VJYUZnVkp3L20wYVg5b3I3dzQ1T1VqNGpnNHdENG5sd3VuR1ZJUE15YUR5d2dxeWZCOWw2S3AwMjZPa2ZldnlVMVNiQkIybTN0bkZtTDhCSEVuSVplbEhyT2luV1dqMXBTc2M1WkxySU9nRWhIMm1TY3Eya3BSOXdjbU9obkRTV3A2d2h1N0RjTTZnRkw3ZGJ3aU1hSGlTMzNYR05TQlVpRWVQYnJUTVl0L0l6TjVjSGpIM0JFZ2JwY3lRMERnNHEzaVhSTElkYUM0eS9nWHkyRU1iZEFYMFRlUzRoVmxscEtFcEJpMmNsVFgwZWJFWk9aTDFpMWhpRHh6aTJGcG5xNk1qd2hrYmhzT0ZPMGtGYzdYWWVndGZFeGFsUEFWRHR1VUNRb3BScjBtM2s1b3dYSksvNUtUUktRaW5sUm1LakttN1RzNGdsRUhycHpWYWhkV1JZSWtuU2hrV3cxMnNHODdlTFJqa1pZbkxuaDZLMkEvNzlXTkpMZXYwQXlpa1VjbjlKaFBRTS9oUjBxWWc3WXQ4ZmxrQWtaOGk5Snp2Z0pWRHkzRzMySWdtY2J1MjVRTWZaUzZJV0hUSmJ1Uk5ndHNGdm1ndjhtQUZ6UnV3bUdvaXVWUmtTVURRS09VRCtObDdUcm12b0NPWDhiZFgvOHNMZnV0bGZ4YU5DcXRVN2gxcEQ5R1JQTHVSUzUvdzZVSkc5Q0JOM3JMZS9Ha20zQTFDMElaY2E3eEYwZnAzQ3JpQlN2NzFpN2VkM3crcGt2cHVMSUZ3NHZsV2thRkplZTZuQkl4WEpVMmZFMmVkTWs4RXFwSXg5SHlaZk9IbVRVY0QzN2tvbGJPTXlUeU9pQ1RNYjFreFFCNHR6bFh2VG5GK3l2Z3JPUm5GZVVYMmUrNk1lQWY4cXc2TUUwQ3NQOTBqbDR4dHpIQUtxZFlLWjNaSFhyUkZmeEJyWXY4bEN2c0ZGWEtOY25hU25WWkJ2bFVQekI2NmZYMG9WWTIxWkxwMHRUMUE2NzF5aU1odktOTHRFckZXQm9COTFTTVI1SWFlMnlidDE2cTVCWWJod214K3ZxYUo5Zjk1QzVRNUZ2ZWt4bGg3Z2gva1ZlMDl2WXI1cStpVFNqdEo1YWpvcXRBTklJejF5dDAwR1o3RVViRnBvN0VSVGk4c0E4V2JTUWFCZnJjTHljRWw0SVdjVGRTdjhYMjVIcytWeGgvM3FDQVlMdDRjam5Pa1ltS21xamc4c2hLN1RSQmdDcnFWZi84RjdqN0ZjaW9PSTBHakZYZ2tHQWExRXl3dk9RM1k5VXhNTFAvOTBIOUVaSElBRGVZckhpbzAxM0FUdlhNaTY2bU9ETUQrWXRCb21sR2YwRFYxU0g3Qi9wR1hxYS9uTFFxQUE1cDFrZEFBa0t1KzQzdStzNnVhOGk2bHRnMnNDdVlnQ0JzYUFhSXQxWXJQOGp3MG8wZEUvYmo4TTF0Y2JXOFo4UFIwb0VFOGNuK004dnVoU3JTZ2l4ZXl6bHVJSWEzR21BcDRWZ0pldHBnNjllS2RpT1ZlVzFNVUNxdit1bit4MnNOWStUNzFjZTZPMzRqM3FmVFpiNEVrS2haTWk2aEdhOS84U3ptM3FZRklUcDcrb0VrN2tzenNrSTZDZDVGSWd4c0UzTVc1elVlUEVoc1hvVzM3V3ZBZ1lpQjlTRGkyNHB0blk3dFg5R3JKb2VURllJZUt5Vi9mNEZSdmlSMVpjR2tTTEU3MmJqSGs4Skw4eTA4NlJvMVB3K2x6cWd2T01xVmV1YXhEd0laQ3lDZGxlbUJEZnNKdkFBNmVXSkhUdG90VDJjNS9Wc20wbEdGU2FxaWtEOWRRcGJoYzlZaG1rUVpEU1g2SU9FODUzalZOUUxuSEVsb0JHVEpLZEVMR0lRQjVOQVM4dzZ1R3kwN0JzbS9sYllsRG1OS0dWRXdnVm42bUVYN0xQTGxmSlJLdTdzR1pJUW9TRS8zUTA0b0thZUJPaTNIMzRFZ3VnNG9qWEl1SmRSU3pNUWU5U2hNQUNiNDAxY1RzYllNS1Y3anFsWFQzL3pGWG1DRkNsNmZuZG9Wb3RYT2xKVUlWQ3phSnlmY3gxUnFjZnBpTWJYUGMvUWR3RzR0MlYwcGRMY1lOaHp3dDFqd0plZHBYU2dCNlhxVWNDbVFDMTB4SFFrYTRxMWJmRFg3VVl3U3dOZVUydzQ1UjB1MHBrdGFhMXZ4SzJDNnVkU0Z2SkZjTTZSbXluOVl3T1VNbzBRRDlaamdncGRzRVhTZ3lUWENCUGFjUHR0YTBtRjhvRjM3NlZYRUpzNEhkdVVBei9VY3pJcUxZU21lMy9SdXk4aitCY1gydVJUVk9WLzM0bWVLTG1OMHNrY1BMWFQ2VlFHTWtjTFQvK0sxUFFsc0t5TWtRYXAyWnZiTHJEVjQ5UzJkY28zK1l0KzZ5V0ljN3BQdyswUVR3S3A1NGdVdVU1OEVia3hxMytuQmNSOW50M212S0pPZmtQaEZqeVE0WVhzeFlRY3dpdUZMeDJjcHZhOFMybnNxdnRKNGxNdEFsQzJaU3ZUMzJEcEs2NWZiaWR3ZXIvYWVyVTFLUjFqdkZxS3JETzN1SjMwRStKQytoVlFqTWpEanhCY2FBZCtFT0pPSFVqck1wYjFCcmRxa0FaaHMxeUhDSGJOekVMang0V2xUSW81WGM2UkpjdkxZcHhzckh3QVA2dzJLSTg3N21rNFhjUm5CRnV2dkZqOW8wT24raGZuei9HbDZzODZYdXVqSy9tWUhJZEhuYzFYRmxEek5aL3hCTWNFLzVZYXpIUEFQck1yZW1wYTVISmQ3UHRtN21ZVm90VllyT2lPc1JoWHUzRDlVU01Cck1mT2t4L21oVU9jTERXODJUaEpzQXV3aUEvTWk1cU54RURRR3dGSy9lbDF3a2Mybk5tZUgzTTVzTlRDcFVLOHllS25RdlV2ZVFyNzBWYThrYi9RcGJDelNPSEM4RTc0T0wyVWljK05qRzNBbkt0U2pvZSt3ZjE3R0FBN09SdkV6TW42ZVg3bndpZHMvR1FtYVhDVDZiQWdpMTQ5cmVWbGNZdXZUSDZpWGVyWHNkYzZKOGY1aU1NMHlpN0lralpXb1NRbTcrTnlpcFZHRUluaz08L3hlbmM6Q2lwaGVyVmFsdWU+PC94ZW5jOkNpcGhlckRhdGE+PC94ZW5jOkVuY3J5cHRlZERhdGE+PHhlbmM6RW5jcnlwdGVkS2V5IHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIgSWQ9Il8yYWVhN2E2NTFkYmI2ODc5MDJjNDgzNDMyZWQ4NTc4MCI+PHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI3JzYS1vYWVwLW1nZjFwIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjxkczpEaWdlc3RNZXRob2QgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48L3hlbmM6RW5jcnlwdGlvbk1ldGhvZD48ZHM6S2V5SW5mbyB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRXNEQ0NBcGlnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFVRkFEQVRNUkV3RHdZRFZRUURFd2d4TUM0d0xqRXVOREFlRncweApOREExTURnd01EVTBNVGxhRncweE5EQTFNRGd3TURVME1UbGFNQk14RVRBUEJnTlZCQU1UQ0RFd0xqQXVNUzQwTUlJQ0lqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBNWhxamFyb0pwQithUjhGTUU3aFE5bk1WMGg3TXBLdG1nRkxjSzN2d1A2N2YKZUFLK3hkdDE3aThSeVVoeGlsOUZDRlI1SzA4V2p3bzNOaUhacUhxRUtpdHcrSUpTbmRqTFNzb05nS0VJYWlGU3VnMmVWMW9ZRWx6MAo2REJYVHhjOGlxL0xhem5kcVRVb201MU9kZTl5STlBR2E4OGNETTVpT3FxOW1odUd1dnd1THRveVU3OExkK3MxRWE2TWdmN0w4TTdmClpWTzdOY3UrRmdJekk2R3QwMzVvaFlDTEJtT29NN28wdWo3RGNNRXZLT01Geml3RjQwd1lteXAzaENMbHEzcXdrTTlwVFZKbHR1ejAKQnQxdnFEZHJxM2tUaGVBOUpITWF5UnozSS9CWnhBVjNpUmQ0aHpMS1RrZWdEOFRvVEdVMTBHbWUrWkFyMXcvZXJjNWhWck0wL1hCbQpIUWxuSTVkMzFHVS9tZklrbTBYUFRHUlNwUHk3RStkVXZqOWRqdm0vVnFEZG9qZjN1dXdpckdlTE1SbE85UC9sQ2VyVGt0VzNnMjdTClY4Z24zRVRtMk1tN3JrTnFmMjRLSnBEdjB0S0Rvc2diZGFIcjJJRVlENFJwcXlTcDhrZDI1Qmh6dXNocUtSa1M4WHU1dDdIQWxWU0gKd2lGaHVMcXJyNGRVZmtCOGtaZU0veWNmWkxDbjdvTlVERmRnakdZU1ZNcGFrTDk3c0M5c2xBVzQvOFV0WFhaeExxY3lxL1l4ZHBDeQpzUFlQMWhzQXArVmdQQzdHSTZDeWlOb2pLUE9wdE1xTFpSWW5WaUt4bE9pV0JKQnpVQlJVVnVhYzhMWHJNaUR3OGJ0V0dhMUdoNXZUCmh1RlVLc3ZtUm9ldWs3ZXlYRU45SjdqNitmVFlqbnNDQXdFQUFhTVBNQTB3Q3dZRFZSMFBCQVFEQWdUd01BMEdDU3FHU0liM0RRRUIKQlFVQUE0SUNBUURBUEZVbzBQZ2E3dkI0SWp5OXUzcXBXTFFTQ2Q0eGZ3OGw5MmlxM0pxTFZYQng4R2Y5WFZ5Nkd6YlhXSWU2cG1RSQp6bW9tL0NXUXZoNm83a2MwRjR5NGZ0c1dmcW5xM2swK0hjWDRIZXUxUE4ySFNuVVVQTnNrNUFkZ2dkMzEyOU1ISWRmYUtiOGJTdUxKCnZTTWVNYXljcm1zYitnRUY2SkZQOGtHV09QNHhRWWpBVk9EY0ZiT3lBZkV1VkFodWp3MGJxbExIVCtFbDR2bGZCcnRkVStNWnp0SXEKUWtHRFc3Y21tODZaR2lCci9nYTk3QkNuT0NyZ1pYbHJnbWlhOFNtRjdSZmE0OC9Yemg3YkRtUGZnbUhnbEw1SnhocFJYMklvUFk1WApJdG1SOElhWUtoT0JPck8vcWVyY0o2WjNyUTZmSXJzOEhyWWdlVE8vdUU5d3c2V1JXQ1dEYUNSNG9XRFZ3akt6R2ZQMW9KdEFJUStVCk5qT2RkSDVvdERhd1hKUmxRV3ByNzJxVDcrV09LL3l6SmhOMHhtWERrbXQ1cHNNWS9DRG40a1hNTTB4YVJwZllPbjVTYzFvZWxRK2gKSW04L3JIVksvMGtyaENET25pcWorTC9uZTJTb3lvWFlnUzZvME5sa05odFRIbWpqb3NFN0hWNkpmQVVncTJEOWRxMDBKTzk2N0kzUAowVkY2RjhsY2RhcTB0b3ZKaEtXUmpycmlnWWQ3NTYvM2FUMkI4M0pXQTFSQTluaVhtclhmbkFQWnJOQ2ZXdmorWDJhbFVOL2l6ZElxClJ0czBVcFdUb1ZVcjBveldnbWJtcDVaT0dZT1FoK2xOY0FwM1Y5bE9yZGJaVlNJVE00N1JZR0JaYVpOREEyUGJEekMxM01TL0VqVEUKdlNrb253dGxDZz09PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PHhlbmM6Q2lwaGVyRGF0YSB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkNpcGhlclZhbHVlPm4wR3IzSWtSSWRjaDZRVHhsTDJRWkNuUVBGM3R4T0hHbXpSLytObzExUlRSZjYrczBYUGxvK0RqYVd1RVdwMkh0MldkRm5UdXM5RmJwSGF0UVdiSVI1SVdUQXFrN3ZXSWlhTW0wV3prRnVPR1hrYi82ckV4cUdOYnY4UTlJUHVMZW85VVNOOWNrZTF5RFlFK2F2NngyU1ZzUjMydHJINXBCV1VyYkNCV0pGNWwyVXRHVlNwWEVwdUFWenppUVhDWTBycXltdmZSVmFGbGhWMVMyb2RXVW1LZU5YL1ZKNXJuME5adE5Zdlo1ZXFhWWJjNnpUQ2sxMEVkUjB6czV6UDFmQmxYMmtDVE8zdlZqNWhHKzV5TUdvRFR3OWxYWXBZUDNtUVpERHFlU2hDcnNKeitPNjNpU0oxZkdqdndhSWZ5QTB4ditON2MrR3I1Zlh1UzR0clozcU9GYkx5TStNS3NWVUNJNG1wTmZsUHRYNjEvSm1NRXFBZFNreFRadFZtY3NDbDZyNlVoSVlVM2ZEOS9JaGFWZDZtSFVvMVJ5WGVnOTlZNTVBMzl6VVVtNWViNzFsVC9qZjduV0p1ZWI1SWZIa1hMQ0ExVldBZGllV2hTbHNtKzBUd1ZKRE5TYTlocUYwb1ZLL0FLcTZEV202ZStVUmVyazF5NFJscDZQa2owb1hBclJ4dkJFTTJXT0VBQWJxdndyeldtSlIwZ2lnQTdVMHB4YnpGcmRoNzdzOVZuRkFQc1Q2aDZ6WmYrbWt1d1JIQUh4Zmk1dURzU1c3RWw3cVdmMjh1dnhKeXUxL0FjbVNHNDRxSk0xelZhSlQyVmU2bXZFYktOWVJ6K2FCZzVNSG1hcWdjQm82VTd3Uk16bHVPNGlSbjVJSVZ1eDlGRTY5eUVhbWliTFNVPTwveGVuYzpDaXBoZXJWYWx1ZT48L3hlbmM6Q2lwaGVyRGF0YT48eGVuYzpSZWZlcmVuY2VMaXN0Pjx4ZW5jOkRhdGFSZWZlcmVuY2UgVVJJPSIjXzllOGZkMmNlNGFkMDIxMmM5OGU3MDkxY2E4NzY1ZmI0Ii8+PC94ZW5jOlJlZmVyZW5jZUxpc3Q+PC94ZW5jOkVuY3J5cHRlZEtleT48L3NhbWwyOkVuY3J5cHRlZEFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=",
+          RelayState: "",
         },
         config: {
-          entryPoint: 'https://frontapp.oktapreview.com/app/frontdev584714_front_1/exk7xdi6axPfombzx0h7/sso/saml',
-          cert: 'MIIDoDCCAoigAwIBAgIGAVaZ04POMA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCGZyb250YXBwMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE2MDgxNzE4NDUzMVoXDTI2MDgxNzE4NDYzMVowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwIZnJvbnRhcHAxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvplQONVwknRy1iBnaoZtsOz28A7XW2tRpFW+0La7RJexbziIwEy1bPZENhfwjPZA1oHHZqi5l315BxXKWJqmmNmbDCFDo+/FYFCoHXliiLm9vqDbR1br6ByqeY0GfxyTPKHZxb2FSes30TffDknpMQd/8kA9YWaW5xDlu2ivWJI+sfcOJOMd6t+gcfXj58a5fP8Mwm6Y220KeZSvrVpEV2KDp9hln7fhhoxHZ7K/BYbidqdwLzeUQXpb6LIrxtKdug2FofS+ONs6yLIQRmrbCB7SVX1QA8JInMn+fzrGtZmFiHR0aFbyhiO78v/ufDa6S+XpYyp2b6D4SnzeggnobAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAJ2wcFVffFHSd9pj6RgoNHXZBsWp0HUZrNekiSbgomr4tSDefWtKb04nFIlRytfVs/k74wmbNiRCE8nDVBrBDFA/+Tv/3PowZXHjXKBofUuScTP4/Tw1N/ywf7V+XY5kV3VmLBL6ax+ULJauR/YGIIMsIc/rS2D04aAcScU9pqVh2ML7nTH7gFqYrxypavmVk6K94vLjs0ggF2TGp7tXCRjeOlPPJS+MOJHJhTBWYFWvBLclU3zcri3ws7GqJMpeiHa7rMoHV0onxWsZTZW57ybaIWKLt1goAooC7hq0rx7oNlOvrys5lllhBySYYC3ycqca/D0+GxXLcEr9QwP7TVw=',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem')
+          entryPoint:
+            "https://frontapp.oktapreview.com/app/frontdev584714_front_1/exk7xdi6axPfombzx0h7/sso/saml",
+          cert:
+            "MIIDoDCCAoigAwIBAgIGAVaZ04POMA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCGZyb250YXBwMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE2MDgxNzE4NDUzMVoXDTI2MDgxNzE4NDYzMVowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwIZnJvbnRhcHAxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvplQONVwknRy1iBnaoZtsOz28A7XW2tRpFW+0La7RJexbziIwEy1bPZENhfwjPZA1oHHZqi5l315BxXKWJqmmNmbDCFDo+/FYFCoHXliiLm9vqDbR1br6ByqeY0GfxyTPKHZxb2FSes30TffDknpMQd/8kA9YWaW5xDlu2ivWJI+sfcOJOMd6t+gcfXj58a5fP8Mwm6Y220KeZSvrVpEV2KDp9hln7fhhoxHZ7K/BYbidqdwLzeUQXpb6LIrxtKdug2FofS+ONs6yLIQRmrbCB7SVX1QA8JInMn+fzrGtZmFiHR0aFbyhiO78v/ufDa6S+XpYyp2b6D4SnzeggnobAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAJ2wcFVffFHSd9pj6RgoNHXZBsWp0HUZrNekiSbgomr4tSDefWtKb04nFIlRytfVs/k74wmbNiRCE8nDVBrBDFA/+Tv/3PowZXHjXKBofUuScTP4/Tw1N/ywf7V+XY5kV3VmLBL6ax+ULJauR/YGIIMsIc/rS2D04aAcScU9pqVh2ML7nTH7gFqYrxypavmVk6K94vLjs0ggF2TGp7tXCRjeOlPPJS+MOJHJhTBWYFWvBLclU3zcri3ws7GqJMpeiHa7rMoHV0onxWsZTZW57ybaIWKLt1goAooC7hq0rx7oNlOvrys5lllhBySYYC3ycqca/D0+GxXLcEr9QwP7TVw=",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
         },
         expectedStatusCode: 200,
-        expectedNameIDStartsWith: 'xavier',
-        mockDate: '2016-08-19T01:15:32.681Z'
+        expectedNameIDStartsWith: "xavier",
+        mockDate: "2016-08-19T01:15:32.681Z",
       },
-      { name: 'Onelogin -- invalid cert (from Okta case) should fail',
+      {
+        name: "Onelogin -- invalid cert (from Okta case) should fail",
         samlResponse: {
-          SAMLResponse: 'PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSNjg5YjA3MzNiY2Nj\r\nYTIyYTEzN2UzNjU0ODMwMzEyMzMyOTQwYjFiZSIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjhUMDA6MTY6MDhaIiBEZXN0aW5hdGlv\r\nbj0ie3JlY2lwaWVudH0iIEluUmVzcG9uc2VUbz0iX2E2ZmM0NmJlODRlMWUz\r\nY2YzYzUwIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9hcHAub25lbG9naW4uY29t\r\nL3NhbWwvbWV0YWRhdGEvMzcxNzU1PC9zYW1sOklzc3Vlcj48c2FtbHA6U3Rh\r\ndHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6\r\ndGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48\r\nc2FtbDpBc3NlcnRpb24geG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hLWluc3RhbmNlIiBWZXJzaW9uPSIyLjAiIElEPSJwZngz\r\nYjYzYzdiZS1mZTg2LTYyZmQtOGNiNS0xNmFiNjI3M2VmYWEiIElzc3VlSW5z\r\ndGFudD0iMjAxNC0wNS0yOFQwMDoxNjowOFoiPjxzYW1sOklzc3Vlcj5odHRw\r\nczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8zNzE3NTU8L3Nh\r\nbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cu\r\ndzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpD\r\nYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53\r\nMy5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjcGZ4M2I2M2M3\r\nYmUtZmU4Ni02MmZkLThjYjUtMTZhYjYyNzNlZmFhIj48ZHM6VHJhbnNmb3Jt\r\ncz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcv\r\nMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJh\r\nbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94\r\nbWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRo\r\nb2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRz\r\naWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5EQ25QVFFZQmIxaEtzcGJlNmZn\r\nMVUzcTh4bjQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2Rz\r\nOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPmUwK2FGb21BMCtKQVkw\r\nZjl0S3F6SXVxSVZTU3c3TGlGVXNuZUVES1BCV2RpVHoxc01kZ3IvMnkxZTkr\r\ncmphUzJtUm1DaS92U1FMWTN6VFl6MGhwNm5KTlUxOStUV29YbzlrSFF5V1Q0\r\nS2tlUUw0WHMvZ1ovQW9LQzIwaUhWS3RwUHBzMElRME1sL3FSb291U2l0dDZT\r\nZi9XRHoyTFYvcFdjSDJoeDV0djN4U3czNmhLMk5RYzdxdzdyMW1FWG52Y2pY\r\nUmVZbzhyclZmN1hIR0d4Tm9SSUVJQ1VJaTExMHV2c1dlbVNYZjBaMGR5YjBG\r\nVllPV3VTc1FNRGx6TnBoZUFEQmlmRk80VVRmU0VoRlp2bjhrVkNHWlVJd3Ji\r\nT2haMmQvK1lFdGd5dVRnK3F0c2xnZnk0ZHdkNFR2RWNmdVJ6UVRhemVlZnBy\r\nU0Z5aVFja0FYT2pjdz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5m\r\nbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFRnpDQ0F2\r\nK2dBd0lCQWdJVUZKc1VqUE03QW1Xdk50RXZVTFNIbFRUTWlMUXdEUVlKS29a\r\nSWh2Y05BUUVGQlFBd1dERUxNQWtHQTFVRUJoTUNWVk14RVRBUEJnTlZCQW9N\r\nQ0ZOMVluTndZV05sTVJVd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhI\r\nekFkQmdOVkJBTU1Gazl1WlV4dloybHVJRUZqWTI5MWJuUWdOREl6TkRrd0ho\r\nY05NVFF3TlRFek1UZ3dOakV5V2hjTk1Ua3dOVEUwTVRnd05qRXlXakJZTVFz\r\nd0NRWURWUVFHRXdKVlV6RVJNQThHQTFVRUNnd0lVM1ZpYzNCaFkyVXhGVEFU\r\nQmdOVkJBc01ERTl1WlV4dloybHVJRWxrVURFZk1CMEdBMVVFQXd3V1QyNWxU\r\nRzluYVc0Z1FXTmpiM1Z1ZENBME1qTTBPVENDQVNJd0RRWUpLb1pJaHZjTkFR\r\nRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLckF6SmRZOUZ6Rkx0NWJsQXJKZlB6\r\nZ2k4N0VuRkdsVGZjVjVUMVRVRHdMQmxEa1kvMFpHS25NT3BmM0Q3aWUyQzRw\r\nUEZPSW1Pb2djTTVrcERETDdxeFRYWjFld1hWeWpCZE11MjlORzJDNk56V2VR\r\nVFVNVWppMDFFY0hrQzhvK1B0czhBTmlOT1ljanhFZXloRXl6SktnRWl6YmxZ\r\nek1NS3pkck9FVDZRdXFXbzNDODNLKzUrNWRzakRuMW9vS0dSd2ozSHZnc1lj\r\nRnJRbDlOb2pnUUZqb29id3NpRS83QStPSmhMcEJjeS9uU1Znbm9KYU1mck8r\r\nSnNudWtaUHp0Ym50THZPbDU2K1ZyYTBOOG41TkFZaGFTYXlQaXYvYXloalZn\r\namZYZDF0ak1WVE9pRGtuVU93aXpadUoxWTNRSDk0dlV0QmdwMFdCcEJTcy94\r\nTXlUczhDQXdFQUFhT0IyRENCMVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFV\r\nZERnUVdCQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0RDQmxRWURWUjBq\r\nQklHTk1JR0tnQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0tGY3BGb3dX\r\nREVMTUFrR0ExVUVCaE1DVlZNeEVUQVBCZ05WQkFvTUNGTjFZbk53WVdObE1S\r\nVXdFd1lEVlFRTERBeFBibVZNYjJkcGJpQkpaRkF4SHpBZEJnTlZCQU1NRms5\r\ndVpVeHZaMmx1SUVGalkyOTFiblFnTkRJek5EbUNGQlNiRkl6ek93SmxyemJS\r\nTDFDMGg1VTB6SWkwTUE0R0ExVWREd0VCL3dRRUF3SUhnREFOQmdrcWhraUc5\r\ndzBCQVFVRkFBT0NBUUVBQ2REQUFvYVpGQ0VZNXBtZndiS3VLclh0TzVpRThs\r\nV3RpQ1BqQ1pFVXVUNmJYUk5jcXJkbnVWL0VBZlg5V1FvWGphbFBpMGVNNzh6\r\nS21idlJHU1RVSHdXdzQ5UkhqRmZlSlVLdkhOZU5uRmdUWERqRVBOaE12aDY5\r\na0htNDUzbEZSbUIra2s2eWp0WFJaYVFFd1M4VXVvMk90K2tyZ05ibDZvVEJa\r\nSjBBSEgxTXRaRUNEbG9tczFLbTd6c0s4d0FpNWk4VFZJS2tWcjViMlZsaHJM\r\nZ0ZNdnpaNVZpQXhJTUdCNnc0N3lZNFFHUUIvNVE4eWE5aEJzOXZrbit3dWJB\r\nK3lyNGoxNEpYWjdibFZLRFNUWXZhNjVFYStQcUh5cnArV25tbmJ3Mk9iUzdp\r\nV2V4aVR5MWpEM0cwUjJhdkRCRmpNOEZqNURiZnVmc0UxYjBVMTBSVHRnPT08\r\nL2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5m\r\nbz48L2RzOlNpZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBG\r\nb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9y\r\nbWF0OnRyYW5zaWVudCI+cGxvZXJAc3Vic3BhY2Vzdy5jb208L3NhbWw6TmFt\r\nZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0\r\nQ29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjhUMDA6\r\nMTk6MDhaIiBSZWNpcGllbnQ9IntyZWNpcGllbnR9IiBJblJlc3BvbnNlVG89\r\nIl9hNmZjNDZiZTg0ZTFlM2NmM2M1MCIvPjwvc2FtbDpTdWJqZWN0Q29uZmly\r\nbWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVm\r\nb3JlPSIyMDE0LTA1LTI4VDAwOjEzOjA4WiIgTm90T25PckFmdGVyPSIyMDE0\r\nLTA1LTI4VDAwOjE5OjA4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48\r\nc2FtbDpBdWRpZW5jZT57YXVkaWVuY2V9PC9zYW1sOkF1ZGllbmNlPjwvc2Ft\r\nbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1s\r\nOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yOFQwMDox\r\nNjowN1oiIFNlc3Npb25Ob3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjlUMDA6MTY6\r\nMDhaIiBTZXNzaW9uSW5kZXg9Il8zMGE0YWY1MC1jODJiLTAxMzEtZjhiNS03\r\nODJiY2I1NmZjYWEiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNv\r\nbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6\r\nY2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRo\r\nbkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpB\r\ndXRoblN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9u\r\nc2U+Cgo=\r\n'
+          SAMLResponse:
+            "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSNjg5YjA3MzNiY2Nj\r\nYTIyYTEzN2UzNjU0ODMwMzEyMzMyOTQwYjFiZSIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjhUMDA6MTY6MDhaIiBEZXN0aW5hdGlv\r\nbj0ie3JlY2lwaWVudH0iIEluUmVzcG9uc2VUbz0iX2E2ZmM0NmJlODRlMWUz\r\nY2YzYzUwIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9hcHAub25lbG9naW4uY29t\r\nL3NhbWwvbWV0YWRhdGEvMzcxNzU1PC9zYW1sOklzc3Vlcj48c2FtbHA6U3Rh\r\ndHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6\r\ndGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48\r\nc2FtbDpBc3NlcnRpb24geG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hLWluc3RhbmNlIiBWZXJzaW9uPSIyLjAiIElEPSJwZngz\r\nYjYzYzdiZS1mZTg2LTYyZmQtOGNiNS0xNmFiNjI3M2VmYWEiIElzc3VlSW5z\r\ndGFudD0iMjAxNC0wNS0yOFQwMDoxNjowOFoiPjxzYW1sOklzc3Vlcj5odHRw\r\nczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8zNzE3NTU8L3Nh\r\nbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cu\r\ndzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpD\r\nYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53\r\nMy5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjcGZ4M2I2M2M3\r\nYmUtZmU4Ni02MmZkLThjYjUtMTZhYjYyNzNlZmFhIj48ZHM6VHJhbnNmb3Jt\r\ncz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcv\r\nMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJh\r\nbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94\r\nbWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRo\r\nb2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRz\r\naWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5EQ25QVFFZQmIxaEtzcGJlNmZn\r\nMVUzcTh4bjQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2Rz\r\nOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPmUwK2FGb21BMCtKQVkw\r\nZjl0S3F6SXVxSVZTU3c3TGlGVXNuZUVES1BCV2RpVHoxc01kZ3IvMnkxZTkr\r\ncmphUzJtUm1DaS92U1FMWTN6VFl6MGhwNm5KTlUxOStUV29YbzlrSFF5V1Q0\r\nS2tlUUw0WHMvZ1ovQW9LQzIwaUhWS3RwUHBzMElRME1sL3FSb291U2l0dDZT\r\nZi9XRHoyTFYvcFdjSDJoeDV0djN4U3czNmhLMk5RYzdxdzdyMW1FWG52Y2pY\r\nUmVZbzhyclZmN1hIR0d4Tm9SSUVJQ1VJaTExMHV2c1dlbVNYZjBaMGR5YjBG\r\nVllPV3VTc1FNRGx6TnBoZUFEQmlmRk80VVRmU0VoRlp2bjhrVkNHWlVJd3Ji\r\nT2haMmQvK1lFdGd5dVRnK3F0c2xnZnk0ZHdkNFR2RWNmdVJ6UVRhemVlZnBy\r\nU0Z5aVFja0FYT2pjdz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5m\r\nbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFRnpDQ0F2\r\nK2dBd0lCQWdJVUZKc1VqUE03QW1Xdk50RXZVTFNIbFRUTWlMUXdEUVlKS29a\r\nSWh2Y05BUUVGQlFBd1dERUxNQWtHQTFVRUJoTUNWVk14RVRBUEJnTlZCQW9N\r\nQ0ZOMVluTndZV05sTVJVd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhI\r\nekFkQmdOVkJBTU1Gazl1WlV4dloybHVJRUZqWTI5MWJuUWdOREl6TkRrd0ho\r\nY05NVFF3TlRFek1UZ3dOakV5V2hjTk1Ua3dOVEUwTVRnd05qRXlXakJZTVFz\r\nd0NRWURWUVFHRXdKVlV6RVJNQThHQTFVRUNnd0lVM1ZpYzNCaFkyVXhGVEFU\r\nQmdOVkJBc01ERTl1WlV4dloybHVJRWxrVURFZk1CMEdBMVVFQXd3V1QyNWxU\r\nRzluYVc0Z1FXTmpiM1Z1ZENBME1qTTBPVENDQVNJd0RRWUpLb1pJaHZjTkFR\r\nRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLckF6SmRZOUZ6Rkx0NWJsQXJKZlB6\r\nZ2k4N0VuRkdsVGZjVjVUMVRVRHdMQmxEa1kvMFpHS25NT3BmM0Q3aWUyQzRw\r\nUEZPSW1Pb2djTTVrcERETDdxeFRYWjFld1hWeWpCZE11MjlORzJDNk56V2VR\r\nVFVNVWppMDFFY0hrQzhvK1B0czhBTmlOT1ljanhFZXloRXl6SktnRWl6YmxZ\r\nek1NS3pkck9FVDZRdXFXbzNDODNLKzUrNWRzakRuMW9vS0dSd2ozSHZnc1lj\r\nRnJRbDlOb2pnUUZqb29id3NpRS83QStPSmhMcEJjeS9uU1Znbm9KYU1mck8r\r\nSnNudWtaUHp0Ym50THZPbDU2K1ZyYTBOOG41TkFZaGFTYXlQaXYvYXloalZn\r\namZYZDF0ak1WVE9pRGtuVU93aXpadUoxWTNRSDk0dlV0QmdwMFdCcEJTcy94\r\nTXlUczhDQXdFQUFhT0IyRENCMVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFV\r\nZERnUVdCQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0RDQmxRWURWUjBq\r\nQklHTk1JR0tnQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0tGY3BGb3dX\r\nREVMTUFrR0ExVUVCaE1DVlZNeEVUQVBCZ05WQkFvTUNGTjFZbk53WVdObE1S\r\nVXdFd1lEVlFRTERBeFBibVZNYjJkcGJpQkpaRkF4SHpBZEJnTlZCQU1NRms5\r\ndVpVeHZaMmx1SUVGalkyOTFiblFnTkRJek5EbUNGQlNiRkl6ek93SmxyemJS\r\nTDFDMGg1VTB6SWkwTUE0R0ExVWREd0VCL3dRRUF3SUhnREFOQmdrcWhraUc5\r\ndzBCQVFVRkFBT0NBUUVBQ2REQUFvYVpGQ0VZNXBtZndiS3VLclh0TzVpRThs\r\nV3RpQ1BqQ1pFVXVUNmJYUk5jcXJkbnVWL0VBZlg5V1FvWGphbFBpMGVNNzh6\r\nS21idlJHU1RVSHdXdzQ5UkhqRmZlSlVLdkhOZU5uRmdUWERqRVBOaE12aDY5\r\na0htNDUzbEZSbUIra2s2eWp0WFJaYVFFd1M4VXVvMk90K2tyZ05ibDZvVEJa\r\nSjBBSEgxTXRaRUNEbG9tczFLbTd6c0s4d0FpNWk4VFZJS2tWcjViMlZsaHJM\r\nZ0ZNdnpaNVZpQXhJTUdCNnc0N3lZNFFHUUIvNVE4eWE5aEJzOXZrbit3dWJB\r\nK3lyNGoxNEpYWjdibFZLRFNUWXZhNjVFYStQcUh5cnArV25tbmJ3Mk9iUzdp\r\nV2V4aVR5MWpEM0cwUjJhdkRCRmpNOEZqNURiZnVmc0UxYjBVMTBSVHRnPT08\r\nL2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5m\r\nbz48L2RzOlNpZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBG\r\nb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9y\r\nbWF0OnRyYW5zaWVudCI+cGxvZXJAc3Vic3BhY2Vzdy5jb208L3NhbWw6TmFt\r\nZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0\r\nQ29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjhUMDA6\r\nMTk6MDhaIiBSZWNpcGllbnQ9IntyZWNpcGllbnR9IiBJblJlc3BvbnNlVG89\r\nIl9hNmZjNDZiZTg0ZTFlM2NmM2M1MCIvPjwvc2FtbDpTdWJqZWN0Q29uZmly\r\nbWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVm\r\nb3JlPSIyMDE0LTA1LTI4VDAwOjEzOjA4WiIgTm90T25PckFmdGVyPSIyMDE0\r\nLTA1LTI4VDAwOjE5OjA4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48\r\nc2FtbDpBdWRpZW5jZT57YXVkaWVuY2V9PC9zYW1sOkF1ZGllbmNlPjwvc2Ft\r\nbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1s\r\nOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yOFQwMDox\r\nNjowN1oiIFNlc3Npb25Ob3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjlUMDA6MTY6\r\nMDhaIiBTZXNzaW9uSW5kZXg9Il8zMGE0YWY1MC1jODJiLTAxMzEtZjhiNS03\r\nODJiY2I1NmZjYWEiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNv\r\nbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6\r\nY2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRo\r\nbkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpB\r\ndXRoblN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9u\r\nc2U+Cgo=\r\n",
         },
         config: {
-          entryPoint: 'https://subspacesw1.okta.com/app/subspacesw_subspacetest_1/kvjj46lsDQEQYUDBZIYW/sso/saml',
-          cert: 'MIICoTCCAgqgAwIBAgIGAUY8zVPYMA0GCSqGSIb3DQEBBQUAMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFDASBgNVBAMMC3N1YnNwYWNlc3cxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE0MDUyNzA4MjkyN1oXDTQ0MDUyNzA4MzAyN1owgZMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjEUMBIGA1UEAwwLc3Vic3BhY2VzdzExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKYX/UdV9HLXbNKv0yc6YJBtzdWNuGTPIXWVPCb0OsRvR54lq+0SLPQGJS39flWKiqtUiEusuih6GdLfNvFAVLGPqBTWQ4Lc7r5+zD5qnH6LiTM1KCbaF3uu2P+T+utsGqFUZawA9FEVNLkICe36X1yE40X+/jMygyieQPMeJABvAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAHSWPG4y1bNyJySgbFqDcS/6MUNIrSfkQYIxzIGQ37qy5qAW15YkBUiW9TsGJRcrgusVrZIia18eYz84Zn7FyUZNMFo24L7l6BS0WCitIQScBCKB4QWA/b1szqs7EtpOcPP01TYNq2ras+VqR3aWAXLX2oKfClV/SUwszRf5U85Y='
+          entryPoint:
+            "https://subspacesw1.okta.com/app/subspacesw_subspacetest_1/kvjj46lsDQEQYUDBZIYW/sso/saml",
+          cert:
+            "MIICoTCCAgqgAwIBAgIGAUY8zVPYMA0GCSqGSIb3DQEBBQUAMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFDASBgNVBAMMC3N1YnNwYWNlc3cxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE0MDUyNzA4MjkyN1oXDTQ0MDUyNzA4MzAyN1owgZMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjEUMBIGA1UEAwwLc3Vic3BhY2VzdzExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKYX/UdV9HLXbNKv0yc6YJBtzdWNuGTPIXWVPCb0OsRvR54lq+0SLPQGJS39flWKiqtUiEusuih6GdLfNvFAVLGPqBTWQ4Lc7r5+zD5qnH6LiTM1KCbaF3uu2P+T+utsGqFUZawA9FEVNLkICe36X1yE40X+/jMygyieQPMeJABvAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAHSWPG4y1bNyJySgbFqDcS/6MUNIrSfkQYIxzIGQ37qy5qAW15YkBUiW9TsGJRcrgusVrZIia18eYz84Zn7FyUZNMFo24L7l6BS0WCitIQScBCKB4QWA/b1szqs7EtpOcPP01TYNq2ras+VqR3aWAXLX2oKfClV/SUwszRf5U85Y=",
         },
         expectedStatusCode: 500,
-        mockDate: '2014-05-28T00:16:08Z'
+        mockDate: "2014-05-28T00:16:08Z",
       },
-      { name: 'Onelogin -- valid config should succeed',
+      {
+        name: "Onelogin -- valid config should succeed",
         samlResponse: {
-          SAMLResponse: 'PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSNjg5YjA3MzNiY2Nj\r\nYTIyYTEzN2UzNjU0ODMwMzEyMzMyOTQwYjFiZSIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjhUMDA6MTY6MDhaIiBEZXN0aW5hdGlv\r\nbj0ie3JlY2lwaWVudH0iIEluUmVzcG9uc2VUbz0iX2E2ZmM0NmJlODRlMWUz\r\nY2YzYzUwIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9hcHAub25lbG9naW4uY29t\r\nL3NhbWwvbWV0YWRhdGEvMzcxNzU1PC9zYW1sOklzc3Vlcj48c2FtbHA6U3Rh\r\ndHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6\r\ndGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48\r\nc2FtbDpBc3NlcnRpb24geG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hLWluc3RhbmNlIiBWZXJzaW9uPSIyLjAiIElEPSJwZngz\r\nYjYzYzdiZS1mZTg2LTYyZmQtOGNiNS0xNmFiNjI3M2VmYWEiIElzc3VlSW5z\r\ndGFudD0iMjAxNC0wNS0yOFQwMDoxNjowOFoiPjxzYW1sOklzc3Vlcj5odHRw\r\nczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8zNzE3NTU8L3Nh\r\nbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cu\r\ndzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpD\r\nYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53\r\nMy5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjcGZ4M2I2M2M3\r\nYmUtZmU4Ni02MmZkLThjYjUtMTZhYjYyNzNlZmFhIj48ZHM6VHJhbnNmb3Jt\r\ncz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcv\r\nMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJh\r\nbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94\r\nbWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRo\r\nb2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRz\r\naWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5EQ25QVFFZQmIxaEtzcGJlNmZn\r\nMVUzcTh4bjQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2Rz\r\nOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPmUwK2FGb21BMCtKQVkw\r\nZjl0S3F6SXVxSVZTU3c3TGlGVXNuZUVES1BCV2RpVHoxc01kZ3IvMnkxZTkr\r\ncmphUzJtUm1DaS92U1FMWTN6VFl6MGhwNm5KTlUxOStUV29YbzlrSFF5V1Q0\r\nS2tlUUw0WHMvZ1ovQW9LQzIwaUhWS3RwUHBzMElRME1sL3FSb291U2l0dDZT\r\nZi9XRHoyTFYvcFdjSDJoeDV0djN4U3czNmhLMk5RYzdxdzdyMW1FWG52Y2pY\r\nUmVZbzhyclZmN1hIR0d4Tm9SSUVJQ1VJaTExMHV2c1dlbVNYZjBaMGR5YjBG\r\nVllPV3VTc1FNRGx6TnBoZUFEQmlmRk80VVRmU0VoRlp2bjhrVkNHWlVJd3Ji\r\nT2haMmQvK1lFdGd5dVRnK3F0c2xnZnk0ZHdkNFR2RWNmdVJ6UVRhemVlZnBy\r\nU0Z5aVFja0FYT2pjdz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5m\r\nbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFRnpDQ0F2\r\nK2dBd0lCQWdJVUZKc1VqUE03QW1Xdk50RXZVTFNIbFRUTWlMUXdEUVlKS29a\r\nSWh2Y05BUUVGQlFBd1dERUxNQWtHQTFVRUJoTUNWVk14RVRBUEJnTlZCQW9N\r\nQ0ZOMVluTndZV05sTVJVd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhI\r\nekFkQmdOVkJBTU1Gazl1WlV4dloybHVJRUZqWTI5MWJuUWdOREl6TkRrd0ho\r\nY05NVFF3TlRFek1UZ3dOakV5V2hjTk1Ua3dOVEUwTVRnd05qRXlXakJZTVFz\r\nd0NRWURWUVFHRXdKVlV6RVJNQThHQTFVRUNnd0lVM1ZpYzNCaFkyVXhGVEFU\r\nQmdOVkJBc01ERTl1WlV4dloybHVJRWxrVURFZk1CMEdBMVVFQXd3V1QyNWxU\r\nRzluYVc0Z1FXTmpiM1Z1ZENBME1qTTBPVENDQVNJd0RRWUpLb1pJaHZjTkFR\r\nRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLckF6SmRZOUZ6Rkx0NWJsQXJKZlB6\r\nZ2k4N0VuRkdsVGZjVjVUMVRVRHdMQmxEa1kvMFpHS25NT3BmM0Q3aWUyQzRw\r\nUEZPSW1Pb2djTTVrcERETDdxeFRYWjFld1hWeWpCZE11MjlORzJDNk56V2VR\r\nVFVNVWppMDFFY0hrQzhvK1B0czhBTmlOT1ljanhFZXloRXl6SktnRWl6YmxZ\r\nek1NS3pkck9FVDZRdXFXbzNDODNLKzUrNWRzakRuMW9vS0dSd2ozSHZnc1lj\r\nRnJRbDlOb2pnUUZqb29id3NpRS83QStPSmhMcEJjeS9uU1Znbm9KYU1mck8r\r\nSnNudWtaUHp0Ym50THZPbDU2K1ZyYTBOOG41TkFZaGFTYXlQaXYvYXloalZn\r\namZYZDF0ak1WVE9pRGtuVU93aXpadUoxWTNRSDk0dlV0QmdwMFdCcEJTcy94\r\nTXlUczhDQXdFQUFhT0IyRENCMVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFV\r\nZERnUVdCQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0RDQmxRWURWUjBq\r\nQklHTk1JR0tnQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0tGY3BGb3dX\r\nREVMTUFrR0ExVUVCaE1DVlZNeEVUQVBCZ05WQkFvTUNGTjFZbk53WVdObE1S\r\nVXdFd1lEVlFRTERBeFBibVZNYjJkcGJpQkpaRkF4SHpBZEJnTlZCQU1NRms5\r\ndVpVeHZaMmx1SUVGalkyOTFiblFnTkRJek5EbUNGQlNiRkl6ek93SmxyemJS\r\nTDFDMGg1VTB6SWkwTUE0R0ExVWREd0VCL3dRRUF3SUhnREFOQmdrcWhraUc5\r\ndzBCQVFVRkFBT0NBUUVBQ2REQUFvYVpGQ0VZNXBtZndiS3VLclh0TzVpRThs\r\nV3RpQ1BqQ1pFVXVUNmJYUk5jcXJkbnVWL0VBZlg5V1FvWGphbFBpMGVNNzh6\r\nS21idlJHU1RVSHdXdzQ5UkhqRmZlSlVLdkhOZU5uRmdUWERqRVBOaE12aDY5\r\na0htNDUzbEZSbUIra2s2eWp0WFJaYVFFd1M4VXVvMk90K2tyZ05ibDZvVEJa\r\nSjBBSEgxTXRaRUNEbG9tczFLbTd6c0s4d0FpNWk4VFZJS2tWcjViMlZsaHJM\r\nZ0ZNdnpaNVZpQXhJTUdCNnc0N3lZNFFHUUIvNVE4eWE5aEJzOXZrbit3dWJB\r\nK3lyNGoxNEpYWjdibFZLRFNUWXZhNjVFYStQcUh5cnArV25tbmJ3Mk9iUzdp\r\nV2V4aVR5MWpEM0cwUjJhdkRCRmpNOEZqNURiZnVmc0UxYjBVMTBSVHRnPT08\r\nL2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5m\r\nbz48L2RzOlNpZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBG\r\nb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9y\r\nbWF0OnRyYW5zaWVudCI+cGxvZXJAc3Vic3BhY2Vzdy5jb208L3NhbWw6TmFt\r\nZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0\r\nQ29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjhUMDA6\r\nMTk6MDhaIiBSZWNpcGllbnQ9IntyZWNpcGllbnR9IiBJblJlc3BvbnNlVG89\r\nIl9hNmZjNDZiZTg0ZTFlM2NmM2M1MCIvPjwvc2FtbDpTdWJqZWN0Q29uZmly\r\nbWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVm\r\nb3JlPSIyMDE0LTA1LTI4VDAwOjEzOjA4WiIgTm90T25PckFmdGVyPSIyMDE0\r\nLTA1LTI4VDAwOjE5OjA4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48\r\nc2FtbDpBdWRpZW5jZT57YXVkaWVuY2V9PC9zYW1sOkF1ZGllbmNlPjwvc2Ft\r\nbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1s\r\nOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yOFQwMDox\r\nNjowN1oiIFNlc3Npb25Ob3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjlUMDA6MTY6\r\nMDhaIiBTZXNzaW9uSW5kZXg9Il8zMGE0YWY1MC1jODJiLTAxMzEtZjhiNS03\r\nODJiY2I1NmZjYWEiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNv\r\nbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6\r\nY2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRo\r\nbkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpB\r\ndXRoblN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9u\r\nc2U+Cgo=\r\n'
+          SAMLResponse:
+            "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSNjg5YjA3MzNiY2Nj\r\nYTIyYTEzN2UzNjU0ODMwMzEyMzMyOTQwYjFiZSIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjhUMDA6MTY6MDhaIiBEZXN0aW5hdGlv\r\nbj0ie3JlY2lwaWVudH0iIEluUmVzcG9uc2VUbz0iX2E2ZmM0NmJlODRlMWUz\r\nY2YzYzUwIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9hcHAub25lbG9naW4uY29t\r\nL3NhbWwvbWV0YWRhdGEvMzcxNzU1PC9zYW1sOklzc3Vlcj48c2FtbHA6U3Rh\r\ndHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6\r\ndGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48\r\nc2FtbDpBc3NlcnRpb24geG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hLWluc3RhbmNlIiBWZXJzaW9uPSIyLjAiIElEPSJwZngz\r\nYjYzYzdiZS1mZTg2LTYyZmQtOGNiNS0xNmFiNjI3M2VmYWEiIElzc3VlSW5z\r\ndGFudD0iMjAxNC0wNS0yOFQwMDoxNjowOFoiPjxzYW1sOklzc3Vlcj5odHRw\r\nczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8zNzE3NTU8L3Nh\r\nbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cu\r\ndzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpD\r\nYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53\r\nMy5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjcGZ4M2I2M2M3\r\nYmUtZmU4Ni02MmZkLThjYjUtMTZhYjYyNzNlZmFhIj48ZHM6VHJhbnNmb3Jt\r\ncz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcv\r\nMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJh\r\nbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94\r\nbWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRo\r\nb2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRz\r\naWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5EQ25QVFFZQmIxaEtzcGJlNmZn\r\nMVUzcTh4bjQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2Rz\r\nOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPmUwK2FGb21BMCtKQVkw\r\nZjl0S3F6SXVxSVZTU3c3TGlGVXNuZUVES1BCV2RpVHoxc01kZ3IvMnkxZTkr\r\ncmphUzJtUm1DaS92U1FMWTN6VFl6MGhwNm5KTlUxOStUV29YbzlrSFF5V1Q0\r\nS2tlUUw0WHMvZ1ovQW9LQzIwaUhWS3RwUHBzMElRME1sL3FSb291U2l0dDZT\r\nZi9XRHoyTFYvcFdjSDJoeDV0djN4U3czNmhLMk5RYzdxdzdyMW1FWG52Y2pY\r\nUmVZbzhyclZmN1hIR0d4Tm9SSUVJQ1VJaTExMHV2c1dlbVNYZjBaMGR5YjBG\r\nVllPV3VTc1FNRGx6TnBoZUFEQmlmRk80VVRmU0VoRlp2bjhrVkNHWlVJd3Ji\r\nT2haMmQvK1lFdGd5dVRnK3F0c2xnZnk0ZHdkNFR2RWNmdVJ6UVRhemVlZnBy\r\nU0Z5aVFja0FYT2pjdz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5m\r\nbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFRnpDQ0F2\r\nK2dBd0lCQWdJVUZKc1VqUE03QW1Xdk50RXZVTFNIbFRUTWlMUXdEUVlKS29a\r\nSWh2Y05BUUVGQlFBd1dERUxNQWtHQTFVRUJoTUNWVk14RVRBUEJnTlZCQW9N\r\nQ0ZOMVluTndZV05sTVJVd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhI\r\nekFkQmdOVkJBTU1Gazl1WlV4dloybHVJRUZqWTI5MWJuUWdOREl6TkRrd0ho\r\nY05NVFF3TlRFek1UZ3dOakV5V2hjTk1Ua3dOVEUwTVRnd05qRXlXakJZTVFz\r\nd0NRWURWUVFHRXdKVlV6RVJNQThHQTFVRUNnd0lVM1ZpYzNCaFkyVXhGVEFU\r\nQmdOVkJBc01ERTl1WlV4dloybHVJRWxrVURFZk1CMEdBMVVFQXd3V1QyNWxU\r\nRzluYVc0Z1FXTmpiM1Z1ZENBME1qTTBPVENDQVNJd0RRWUpLb1pJaHZjTkFR\r\nRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLckF6SmRZOUZ6Rkx0NWJsQXJKZlB6\r\nZ2k4N0VuRkdsVGZjVjVUMVRVRHdMQmxEa1kvMFpHS25NT3BmM0Q3aWUyQzRw\r\nUEZPSW1Pb2djTTVrcERETDdxeFRYWjFld1hWeWpCZE11MjlORzJDNk56V2VR\r\nVFVNVWppMDFFY0hrQzhvK1B0czhBTmlOT1ljanhFZXloRXl6SktnRWl6YmxZ\r\nek1NS3pkck9FVDZRdXFXbzNDODNLKzUrNWRzakRuMW9vS0dSd2ozSHZnc1lj\r\nRnJRbDlOb2pnUUZqb29id3NpRS83QStPSmhMcEJjeS9uU1Znbm9KYU1mck8r\r\nSnNudWtaUHp0Ym50THZPbDU2K1ZyYTBOOG41TkFZaGFTYXlQaXYvYXloalZn\r\namZYZDF0ak1WVE9pRGtuVU93aXpadUoxWTNRSDk0dlV0QmdwMFdCcEJTcy94\r\nTXlUczhDQXdFQUFhT0IyRENCMVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFV\r\nZERnUVdCQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0RDQmxRWURWUjBq\r\nQklHTk1JR0tnQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0tGY3BGb3dX\r\nREVMTUFrR0ExVUVCaE1DVlZNeEVUQVBCZ05WQkFvTUNGTjFZbk53WVdObE1S\r\nVXdFd1lEVlFRTERBeFBibVZNYjJkcGJpQkpaRkF4SHpBZEJnTlZCQU1NRms5\r\ndVpVeHZaMmx1SUVGalkyOTFiblFnTkRJek5EbUNGQlNiRkl6ek93SmxyemJS\r\nTDFDMGg1VTB6SWkwTUE0R0ExVWREd0VCL3dRRUF3SUhnREFOQmdrcWhraUc5\r\ndzBCQVFVRkFBT0NBUUVBQ2REQUFvYVpGQ0VZNXBtZndiS3VLclh0TzVpRThs\r\nV3RpQ1BqQ1pFVXVUNmJYUk5jcXJkbnVWL0VBZlg5V1FvWGphbFBpMGVNNzh6\r\nS21idlJHU1RVSHdXdzQ5UkhqRmZlSlVLdkhOZU5uRmdUWERqRVBOaE12aDY5\r\na0htNDUzbEZSbUIra2s2eWp0WFJaYVFFd1M4VXVvMk90K2tyZ05ibDZvVEJa\r\nSjBBSEgxTXRaRUNEbG9tczFLbTd6c0s4d0FpNWk4VFZJS2tWcjViMlZsaHJM\r\nZ0ZNdnpaNVZpQXhJTUdCNnc0N3lZNFFHUUIvNVE4eWE5aEJzOXZrbit3dWJB\r\nK3lyNGoxNEpYWjdibFZLRFNUWXZhNjVFYStQcUh5cnArV25tbmJ3Mk9iUzdp\r\nV2V4aVR5MWpEM0cwUjJhdkRCRmpNOEZqNURiZnVmc0UxYjBVMTBSVHRnPT08\r\nL2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5m\r\nbz48L2RzOlNpZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBG\r\nb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9y\r\nbWF0OnRyYW5zaWVudCI+cGxvZXJAc3Vic3BhY2Vzdy5jb208L3NhbWw6TmFt\r\nZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0\r\nQ29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjhUMDA6\r\nMTk6MDhaIiBSZWNpcGllbnQ9IntyZWNpcGllbnR9IiBJblJlc3BvbnNlVG89\r\nIl9hNmZjNDZiZTg0ZTFlM2NmM2M1MCIvPjwvc2FtbDpTdWJqZWN0Q29uZmly\r\nbWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVm\r\nb3JlPSIyMDE0LTA1LTI4VDAwOjEzOjA4WiIgTm90T25PckFmdGVyPSIyMDE0\r\nLTA1LTI4VDAwOjE5OjA4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48\r\nc2FtbDpBdWRpZW5jZT57YXVkaWVuY2V9PC9zYW1sOkF1ZGllbmNlPjwvc2Ft\r\nbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1s\r\nOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yOFQwMDox\r\nNjowN1oiIFNlc3Npb25Ob3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjlUMDA6MTY6\r\nMDhaIiBTZXNzaW9uSW5kZXg9Il8zMGE0YWY1MC1jODJiLTAxMzEtZjhiNS03\r\nODJiY2I1NmZjYWEiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNv\r\nbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6\r\nY2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRo\r\nbkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpB\r\ndXRoblN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9u\r\nc2U+Cgo=\r\n",
         },
         config: {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
         },
         expectedStatusCode: 200,
-        expectedNameIDStartsWith: 'ploer',
-        mockDate: '2014-05-28T00:16:08Z'
+        expectedNameIDStartsWith: "ploer",
+        mockDate: "2014-05-28T00:16:08Z",
       },
-      { name: 'Testshib -- valid encrypted response should succeed',
+      {
+        name: "Testshib -- valid encrypted response should succeed",
         samlResponse: {
-          SAMLResponse: 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cDovL2xvY2FsaG9zdC9icm93c2VyU2FtbExvZ2luIiBJRD0iXzdmOWU5NWM3MTE2NTRhYTQxYjMyNmY4Yjg0N2Y3YTEzIiBJblJlc3BvbnNlVG89Il8zMTM4ZDY3NWQ2ZWQ0MTZkNDNkNiIgSXNzdWVJbnN0YW50PSIyMDE0LTA2LTAyVDE3OjQ4OjU2LjgyMFoiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiPmh0dHBzOi8vaWRwLnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDwvc2FtbDI6SXNzdWVyPjxzYW1sMnA6U3RhdHVzPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpFbmNyeXB0ZWRBc3NlcnRpb24geG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjx4ZW5jOkVuY3J5cHRlZERhdGEgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIiBJZD0iX2ZiYjE0NzQzNTEwYTYyOTJmODc1MGVmZGUzOWJhNzI2IiBUeXBlPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNFbGVtZW50Ij48eGVuYzpFbmNyeXB0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjYWVzMTI4LWNiYyIgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIi8+PGRzOktleUluZm8geG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjx4ZW5jOkVuY3J5cHRlZEtleSBJZD0iXzQ0YTEwOTk0MDVkYzgxMDJlYTFmZmM3Zjk0YzJhZjkyIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkVuY3J5cHRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNyc2Etb2FlcC1tZ2YxcCIgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIj48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIi8+PC94ZW5jOkVuY3J5cHRpb25NZXRob2Q+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRXNEQ0NBcGlnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFVRkFEQVRNUkV3RHdZRFZRUURFd2d4TUM0d0xqRXVOREFlRncweApOREExTURnd01EVTBNVGxhRncweE5EQTFNRGd3TURVME1UbGFNQk14RVRBUEJnTlZCQU1UQ0RFd0xqQXVNUzQwTUlJQ0lqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBNWhxamFyb0pwQithUjhGTUU3aFE5bk1WMGg3TXBLdG1nRkxjSzN2d1A2N2YKZUFLK3hkdDE3aThSeVVoeGlsOUZDRlI1SzA4V2p3bzNOaUhacUhxRUtpdHcrSUpTbmRqTFNzb05nS0VJYWlGU3VnMmVWMW9ZRWx6MAo2REJYVHhjOGlxL0xhem5kcVRVb201MU9kZTl5STlBR2E4OGNETTVpT3FxOW1odUd1dnd1THRveVU3OExkK3MxRWE2TWdmN0w4TTdmClpWTzdOY3UrRmdJekk2R3QwMzVvaFlDTEJtT29NN28wdWo3RGNNRXZLT01Geml3RjQwd1lteXAzaENMbHEzcXdrTTlwVFZKbHR1ejAKQnQxdnFEZHJxM2tUaGVBOUpITWF5UnozSS9CWnhBVjNpUmQ0aHpMS1RrZWdEOFRvVEdVMTBHbWUrWkFyMXcvZXJjNWhWck0wL1hCbQpIUWxuSTVkMzFHVS9tZklrbTBYUFRHUlNwUHk3RStkVXZqOWRqdm0vVnFEZG9qZjN1dXdpckdlTE1SbE85UC9sQ2VyVGt0VzNnMjdTClY4Z24zRVRtMk1tN3JrTnFmMjRLSnBEdjB0S0Rvc2diZGFIcjJJRVlENFJwcXlTcDhrZDI1Qmh6dXNocUtSa1M4WHU1dDdIQWxWU0gKd2lGaHVMcXJyNGRVZmtCOGtaZU0veWNmWkxDbjdvTlVERmRnakdZU1ZNcGFrTDk3c0M5c2xBVzQvOFV0WFhaeExxY3lxL1l4ZHBDeQpzUFlQMWhzQXArVmdQQzdHSTZDeWlOb2pLUE9wdE1xTFpSWW5WaUt4bE9pV0JKQnpVQlJVVnVhYzhMWHJNaUR3OGJ0V0dhMUdoNXZUCmh1RlVLc3ZtUm9ldWs3ZXlYRU45SjdqNitmVFlqbnNDQXdFQUFhTVBNQTB3Q3dZRFZSMFBCQVFEQWdUd01BMEdDU3FHU0liM0RRRUIKQlFVQUE0SUNBUURBUEZVbzBQZ2E3dkI0SWp5OXUzcXBXTFFTQ2Q0eGZ3OGw5MmlxM0pxTFZYQng4R2Y5WFZ5Nkd6YlhXSWU2cG1RSQp6bW9tL0NXUXZoNm83a2MwRjR5NGZ0c1dmcW5xM2swK0hjWDRIZXUxUE4ySFNuVVVQTnNrNUFkZ2dkMzEyOU1ISWRmYUtiOGJTdUxKCnZTTWVNYXljcm1zYitnRUY2SkZQOGtHV09QNHhRWWpBVk9EY0ZiT3lBZkV1VkFodWp3MGJxbExIVCtFbDR2bGZCcnRkVStNWnp0SXEKUWtHRFc3Y21tODZaR2lCci9nYTk3QkNuT0NyZ1pYbHJnbWlhOFNtRjdSZmE0OC9Yemg3YkRtUGZnbUhnbEw1SnhocFJYMklvUFk1WApJdG1SOElhWUtoT0JPck8vcWVyY0o2WjNyUTZmSXJzOEhyWWdlVE8vdUU5d3c2V1JXQ1dEYUNSNG9XRFZ3akt6R2ZQMW9KdEFJUStVCk5qT2RkSDVvdERhd1hKUmxRV3ByNzJxVDcrV09LL3l6SmhOMHhtWERrbXQ1cHNNWS9DRG40a1hNTTB4YVJwZllPbjVTYzFvZWxRK2gKSW04L3JIVksvMGtyaENET25pcWorTC9uZTJTb3lvWFlnUzZvME5sa05odFRIbWpqb3NFN0hWNkpmQVVncTJEOWRxMDBKTzk2N0kzUAowVkY2RjhsY2RhcTB0b3ZKaEtXUmpycmlnWWQ3NTYvM2FUMkI4M0pXQTFSQTluaVhtclhmbkFQWnJOQ2ZXdmorWDJhbFVOL2l6ZElxClJ0czBVcFdUb1ZVcjBveldnbWJtcDVaT0dZT1FoK2xOY0FwM1Y5bE9yZGJaVlNJVE00N1JZR0JaYVpOREEyUGJEekMxM01TL0VqVEUKdlNrb253dGxDZz09PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PHhlbmM6Q2lwaGVyRGF0YSB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkNpcGhlclZhbHVlPlFPVExoZmlOQ1NoNkduNWRQWmQ1QjB3SEJFUE1nSGxpV3h6TEp2eDlRTWxjelNXdWpnaUp3d2x3N2M4UHZTTUtNZXUxaDhhbTd0ZEUwcnAyd1JpSUJjenpHTlhUbm5xaFM1NzFzMFBLb2hRN0h4ZVRXZ0YxSTJidFcyWTBzSUJsNlYvanV4blBVQjF3SUhQcXdMYVlvdkN6enlWeWVrQnlZamI2WUp1eENPR0xGL3U5MTA1L1NjSXQxd1hja0NrTUlOcWY0dUdaT0FNOGZKQTFzQW9ldzZDcnJ1UG5OakVDWmNhcVNBZjZFUC94MGIwaXUvelZRT09ZMHRZMVRRQmpMRDFROVFoS282TWhCL2dYTS9waW54SnUzeFFxQTVIWEtzVGdWSml3SVlCQldwcHFzb1ZWUWRGUXErYlkyOVpHWDlzTSswc2tnbGJWQm50czhDQnFNdHRISkxTNTRNRnJ4aTJ0Y0x1OHVzek5rNGF6ajVOdmxZMlFmaTJTTGdvbDNaTS9DNGIwRERGS0xXc2Y4K1lkaEZoNnlPb1lkN2NmZ3hkZTlqK0YrVHI2U3pzeXlybjczTnVPd0hJWHV2N2ExZHduS3pIM29oV2ZBSjN1a3JTbWZqRWNrRURkNmkxQWRiajBYZUhYMENsZmlNK0IrRzl3aENhV0VIeFRiL3RjeHVXMTdJY3B4cTJIakZCUmM0bkVIaFRLOVRwcHJKOFFPYkJTZ2puZWxINjN6MmxSSVFWc3lYUDZmV2Q4Z3FhNG1kQ3VaUGs3YWppdDU2dlBxclBZUk1yRzU1N0VaUjkyVm42ZWZya2dDbGtoUnE0VmpPbE1GTWZYNkNKVXBzSW5HVHlISnRqdFgvR1U1NWRib1dqVEt0bmRxeEMyNTZLbTJlM3NWT2ZUOUpzPTwveGVuYzpDaXBoZXJWYWx1ZT48L3hlbmM6Q2lwaGVyRGF0YT48L3hlbmM6RW5jcnlwdGVkS2V5PjwvZHM6S2V5SW5mbz48eGVuYzpDaXBoZXJEYXRhIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyI+PHhlbmM6Q2lwaGVyVmFsdWU+dytwQjNXTlcxcUV1YmhDQ0tPUmtkc1ZNYTUzOVB5czJMSmR1dGlzN1RuMlhwdm5xREdZUG9YblZqSCtTdTQrTVRQdi9nZ0FnUlJnUW84NE1SUVJHZUs2OE1pcDhMLzRhQ3Y2ZmZUM0czVEpPdGc5Y3BhQVI4RkpyMXp6NFZhbi9UWGtScmpVRWRIUVlJTmhkR3ZUYVdSWUx3dDA2SExRckVoNlgxekJLbHFHanNEenk3Zm5LT1E5SEJqY01INnNGSTNENVZnOUtoc085QmFTNG9aL1J1LytUdC84SWg2VUhDcURTM0VUcnVqTUdCdDNRMFhaMWxCOHpWSUVIVXhoemlhZkF4aGlzZ1B3QWxYcTR6T0hteSt6YnJxekFQVjhhQ3JBT2RtbkZwYlA1VUV4MnRNcWJ5aU9jZVJ0R3doaUV5R3ozT1pyM0dtMXR3ZTJtNW05S05OZmt4eW56N0hVQndqS3hkcTNQTmFiMFNhOWVmNWRESHhiNHdFVDVJYUtSRGF6TDVlQWVkUnljL1FlbG1aNFhUQWljVGtySGRpR1VxeUhQdm9Jd2VmU3hhK3pyQTNoRjl1ODlLMmdQQTlGTHljWUJMc3AzVU5HMC90RkxkRnFhK01CVGNRZTRYSWJodlJsTVI1TU1zUHNPbm9Fclp4ckVXNjdvUzBpakJsaUlrY2VCcE1HaWJ6VUZtUDJsRFcxeDRjTEprTFlxWmVua1hSVURvbmVicXVjdXNIdFNOenNTK0g2MU8rNTI3NFhOM3FvRzZpdEZLVEUybjVQRTU0M0hMOG5Ib1dmWjdBTG1VeUdZSzAxTnVjWjF0L3B5SytCNkFhT3RSY1lvMWlwcTVWNzU5cmNUTGFVdFoxeVdCNVlZSVdtMUkvNGt4WEw0bGpPcng5V1BiMUJGTnJVZ0FBQTV5Qzd1T2s1MXh4S1RiaGZoakpra3AwcEU5WWF3cTdBY2lrb2VadDRJcDFpQ0JoZjZCdjB6RCs3c0tyeE5XQUxzNXVYOU40ZDgxekZBamU0eGlHMDFZUzBjOWtEWk5zU1E3ZDI2alE5ait0YVBYa2Z6aFVRZithdnczMXVDbk0vNFBHckc1UGlPeFhrVmcrUnVrZGVaUjU1VEEzZXBmamhSbEM1UmFnWGlGeURLOEcrK0dDSEJvVUtBN0pNcmtacmlZczdDNE9SNVdDQVNrOUhTTEIrc0VicnJTcnF1aGpKZUNTR0ZyQmpGckw3OGx3QnI2QWxhN2Z6bzhmNnNmL25nSUNxNDNmL1FzYXpwWHpyZzlYN3NTWTBONDJJaUtIN2FiSzhSTXpvbmpETzhFb1p1U0tLT00vN3VVSGxMalVXbjh1V0dBa21zV01qN2lUa3hQRkxRNVFKM3VzZHl6U1FndUZRMERVVmF3ZmJlb2NtMk90cjNTdC8wT3VVOHBzdHZodHdTWnVJc2s2NFk5MGFGZ01kRHcvdWJNS3lzQUh0aXowdUhGenpDMW9iTmFaY3BLS0tVUml5ZkYvNkY0dmhNbDErRC9ubWpUQTdRVm9yQURDS0lpUnFlNXRzdG1tcHJIbWRibFpmaGI5cGcxcDJBMVZPTStzRldoRG9QWXk4dWRaKzBQSGRmTkh6bDNLVHNIVjhUSmR4bTBXTTJiWURsYi9TSTBsZVBRUytSWUlsODJ0V2ZqUzIwT2VuZ1RoZjdHWUFLUGJUaUtnWHdJazMzbE5pa2cxSWdRMGhPcnFlZUV1MHBvb05NV1pOMlJBVkZpY1hmUkRhQ21lOFFFWUdWY0ZaOTFGWkY5MWRPZ3Z1cXY5NHVCcUlsUWtVWWl0SUh2cEFWc2RuU1VjQk4xN3JPMWFQVUcvemlUNFc5K1RsWFVTMmxjcXRKR2xwTjFCejd4Wm5GOXZBQjRDNy9xRC9XcFhZUlJUQ2VuUTJZbStMeHcxNXJMQThadURaTU1qdWxyMXErN016K0h0dXBtalV1eVJJRjNMZmtRVkFMa1YwUTl1bGw3djgyOVRHN2ZhSE00ZjJOR20xVHdXTkw0aXVJVHBsTy9LTHJBR08ydHRQdE1rZ1RXdzV5WWVTd0pSQ1B4SFhTa0pVQ01EblcxU05KZHZSNUJ6RXNZakpTQ0Q0dkpqTVJTM015ZHJldzBzdFNHZkwzajdScjgvUlVXbDlXTWlQOEFyU1d4S3JFRCtBNzJua3hlNnFtRFZtNm91YWpiSk9rYVY4cDZMNW1XWUZ3MnBobVpQRElvTndCUzY3K1lGc28yOXJTL1dOZUJRQ1RTVWR1VW9tbk4yRFNib0x5eTVzM0o3M2xyNXBrZktQODgvL2dDQUxQbG0zQ1E3VktiK0RIUDd0VUxpaFVkTmJYV29YL2IzZXk0QzdDRmhtclhYRTViQ25sWnQ2TFlIZlhNSjJvRmxDOHJyOTBSY0VZWjlnNjVRdktOVDFabVJVR3JveVBYbjdHTThhU1N5RGZLeDhCQ0V1d3FYL1VzN2tWWkxDczhyMW1xQUl1eTlMb09oVlIrMEJ4TDZhTTRLMEpvLzhIUy9mNE80c1BRd2JGMWp4UU1ZYVlabHBLdzBzL0o4UGtLSnBBUzlyM1RtajZFVlNqb3dscmtmT1hpUVhaWkY3dXVwdlNvOUwrVnVXZ1Vuckg4dXpmMUhlQVhUMXlYRDAyT0dTR2JyUnF2alJZWFhTVFFpTnZxQXo3UzBKOHJSNTE5WUFiQk5KdzlwUExXRjVMZWZ2VVc0NnpYcDVZdE9LTWlENnk5dmJMaTlJbHRzM0MydUxJY0ZIbXRRMmZ1RlBwbzIzeTI5YXV4U2IxdXQ2Si9BK2tyTFRKWWFjNEczS3B3ZVFnVEs2dXBHeGdZM2p3c2FzTjMyWGs3eC9rUzZsVThBM0FjNElmQTh3VlMyVFF4S0FaZnNJNHFrZVJqNVkvUWlkTmM0TTlWWUZCeXo1aHNJdmxObjFtMy9oV1dvdDRDVzhlNzFENGN4UnUvQTJjVGwwSHBybWZ2cVFmTVhmMU5kZ0Fya0kwSVIydkMwUWZCYm9FS0tDYno3RThJTWJJbjdWK1BmdGdoOG4zOXMvU2F5c21TMXMzdzRHdFFvZHdRMTdmK2gyRVR0RVZOMkh2VWZMRENoQy82dGVhaU9hd3dJWXFvUGlaczlOZDFrZUZ3YlFOSGpkbUE4ZW43UHYzdXhIRTFLcmduUXNqci9yZ3c1ZEdwNjdmSFpkcUpuZHgyVVNPV2tnZmdLRHZ0SlNXSWZtT2I3WnluUGpxZ3ZLYzV5RWFQUXQ2TUNXVXF0WEEvVTJ5WG9wWGhDYVN3cXFIZlYzVGRrb3JkcURucW9jYTJKdDRGaUdTQWhEclY0VVNSblVvUWoxblArS1F3RktDVDcvME5Rb3Q0VWhWWndVNlAxUFRUSExBNkEva1JoMkFsaGZZMTlzOUh0SVl0SHpMTm9nbWFkT3pxR3NCNHFSQko2blZ2N3lXVER2ejhtVVdMTjNmVlBzdnUxZS9YYTlKUWQzK3pKUXRVSXhQWjBPaW9jbWh2M0U1TzFRSzNodVgvdTdWaXAwbFBEcHNvMkRmTDNqNU50blBhQWt4TUEzVDN2ek56WFcyV3ZyeE5HYjkvRDdESEpuZ3NqdUF4OWw4VTl1RHJPNzVmaDJiREc3RzhFUUNBRktQMkJjZWxybkREY1B3d0wwQS9wSW1zaEdwUlFzMzgzeERDZGxVa0toTUJnbDI1cXJmWGJCQVJOQmFtV0hFNGZQem1iYk9MYWtRUVg3VFJJRFNWTGNiTTQrdU1idlROL0R2TUFXZlA2ZW9YU1pHWGQxME9ET2FPVzZJVzNITG9seUg4QzU0cUwxN2dVeFJRMElNdjNGc2tHYmZ5enBvWi9GRmdBa2I2Qjg4eW9EOW5SbTB2czJmYlRrd1ZLNDNENE5iN1JuOHZtL1lCZGkwVytXTUdMdU9lb1d5RGl6NVk2YnZNR3kySjI5V2pwaFgwaGphWGVySlVKdFpRT0tLclAybUdCWjVNSHlmMUtFSVdraFdtemlOYTZXbmFzSU8xM2o2TkRqYnptbkF1QTU1VzBFQlhVMHRYTE1pckJvd29iR3lzVXZMOVBvTTV0TDBuOUVYTGtwbHhCS0gxVmZtNG1MR2M2cGNVVU5sK0dWc3daaHdZVVNtV3hNQU10M25YemkrSlFWOUIwRGhCU3gweGZ2bEZkSmUvSkcrTmM1ZmprcTlSbkFWMHNweXlwTnZacnZ4NXZ3T3d3Q3hCc0VNSWV3RDlNOHQzM2VGRnRYRnRBeDF2Zlo0SzlQV2VRblV0Rm9yR05ZYjF5cVFnbHIxMGxGeVpXWWdpMHJSUXlqTHFmdWxSODRmTkpUYjNabnNIeWNuK1I3WXBsM3k2WWlvRUF1bThtYlRmRVZCNUVoTXptaVB1Tjc1V2NxY1JTZDdlYnprY0JBL2JYNGZYMEVRWSs5cE41dUt6WE1USzU0OTZPM09KV2R4ZXllQXQrN0cwZVNkREo4OXEvbGp6T1g5OVFZU01zQ0NISWwrdElYdG9aMjFqb2dZVnEzc1RtUGhscThHVHZmeElPSTI2WnM3cm1FOWJFTGs2U1NYeFFoNy9KSUEyZXVSY0RUWDlSM1FXalMrUFRnTUJObEZXYTlEOERycVJPVWVyT0V6eFMwYS9oTXJyUHZub1o3US9mTDgzQ1JhanM4RTBwYndGZnNuSVF6MVoxNWlXeklBVlFFRnBOZXZ3eVkzSmlYSndkRTM1dVIzbVRYdXRkNzRrLzNuTXYrQmszVjZYRnpkMVp5dDg2Nkd2Vmd1alMrSWFqNllRNmZGckc0NW1lekU3d3VJWDBWMlZVU1Rjam9tcndaNThXclhvM2M1MHdRNHNlV0tkNnV2WCt5dlNBWnlxclhTbkdhWDNZUHlBemVhMFFWa2JLWGhCWHVLYUpGMzNMS1RFWGt6eVJvOThLRko2Z1dPSExWQm5mRTdrWlFKUEkzNEpTSnZzZTExbmlmYkMzZ1lpK3MzSlVSOGQwSmI1c1JkcU5Fc1l2d1lIM0xQcGRYRkxOUXBNM2ViYm1UUGdKR2J5bFJTUDFWelJVRURsbXgwbjRVUGs5SGFZNksvZkZWSEt0ek0vVnpJUm5IK1VRRnFXN1RSMkxFdXI5dmNKcytGaGFieG8xUHc3VlV0R1lZVkJMMjVZbC9aQmR2THFBY3hLN0xVTFk4Yk80V2lCKzcwMlUxZERQRENaQWNYWnlid0duNDQxRE1rcHJrck5DOHVxbkFQRHA0ekNMTnBENWM4NXg2Q2pDMDlJei9TYnorbkxLcXgyRnY3MVBCcmh6RXlvbHNVNWpEZVVtSGcrTFplVzk0dlVNQ2lZalY5b09ma0ZIa2RHbk10NGl6dmJPd3FETG5JSFhCWU9MYUNuNmUwd005Ums4NjhtRWpoYXRBUXRvRm1lKzMxL0M2clJ1cW1NbSszNVNKY0ROejZuWEFVWWVVOFZjVkorNU5IWE56MUF1UXh3cWo2VlNsMHRmSmZUaDk0V1gxNHlzSXlBZnlTeTlDTXNHMW9aNDZ2djJkNEZETjFyMWwvN3hEYWtBYmZLUGNPK0F3U0dGWkxCQ09DaFR4dkVlQTdvWlhJVFRLTVdPUlJZVXVkb3JOQ2FOKy9IMktzcHo4eTMzUm54OHJaTUd2cnlPUm5nME5LSnBrT1oyOGlDczVGQmJPa2UvZWROeVFibm90b3hCUjJIbHcydVY0SWRsd1c1NVZkcHNtaWJ5alArS0NaSFNGOWV2WTFHci9VdDVYL0l1S21NbTBiWGQ2UFp0VjcyWWxkbDg3NHB2YSt3Y0NsOTBwcTRIU2x1T0JFQm9haUt1cXQyUCtHY1BZa2tRSitEUVBYdktYYlFWanZWbCtXS3FPL1VZbmRTMlR4b3dINk5ZMWNuVE5INGtWR3RmaHNSc3FCQzlSRjRsSGxRK2w4UnZaTmZMcHliWjJ0T3RwSmZaUXQyNTNnZE4zZGdzUEsxVTVISEZKd2RwYzA2QlY4YTNueWZvNWh4aEorOXVaTisxdDdGYUtpdng5QWhscE8xTytMcGIxenovM1VucVBRR3FwbEJVemtINko0VmVSTFdHNDd0SkVZNVRZbmxrZHpvTGF3dUdjM3ZwMWhZUjZZVEg0Y0I5bGlsMUs5cHgvUFI5UGRhM2R4T25zelZ5ZG13RWw3QjZHb3VrK3hXMWF5NG1iT0hDa3JwdEVoa3NEcjY4WWE3b05GUXVZMnNEUmdla0VidHo2RFZFako1b0hkUmVvSFZMRm1TM3pSZ3lwNFJRZ3YxMG9wUWNpTU1hNER1OGh4dVpVN3JYMVNGYm5uQ2owaWZoZDUyd2JyOVEyWisyYnNKaTEvczZkV05JS3ZDaDhxUE9YU21IL21YMFpETkFDbDV4K0phTTNOTGl4dEFlZFVxcjV6dDlza0t4Qzd5cURUbVhMRkIzRjJNRm15UzBtMFVRcDdDb2daUVI0MjI4TlR5WFpSK3FYZExhMUlaU1owOC9BOGUwMzRJZ0FzS0YvQXhJdFNuNllZZXhHOXFYeU5aU2x2OGpPS3FiWGdidWZnZHorVjY2OHVGMnpzRk5RY2pBUUxydGxqWnRFR0g4WEIwMFozT3ptb1ZmcWFqWFhMSlN6UjcwSFJHUWpYK2d6SFVBUlF3Z2ZxUVFtVWcwZmtBMStyNmZPWTVYMDVRdkxNaFprWmJwN0RuUmczQUZKMU9hYnRPYndJek9WRmhsN0p2SzZlTk9kK0NTNkttZUZSS3BwSExCNSt4Z3NpNGRSQ1VYL3VGZkVFZ2FxNm0xems5OXprSWpTZDdRWFhXQUpIWE52K1NuUjcwTzVkdkRTam1ZTSt2MnVVOGZNMlBiZzU1OWJ1LzIvYW5VQkxEMWJxZG9pTC9GSHFlb1B2am1zRktkcFdnRjFHRGVkam9sVmRzUWNTeUxoYlN0eXUzSWE5RU1OK0h6V3ZmVXd4M1hSOGQxMHpSS2lBL1J0Qjc1cUVFZm5UQTREa1grVUxCVGd1WkxkWklJYVVFTG5XN1UwZldnVEFuaEdqTVp1Tmdkdk5qb1BGRmRlcmxmRFplazM0aDVGQUJvM2srTlJuUk9USmhZaUhHOHE2MDF0NEVsaklCVnoyYkw4UW9vL055ejE4VFF5NkRGMUVhK08rVXkwUlhlMk51QXZBekpUVlAwU3prMGE4WTU3d0xZVElPdW55UUtKY3JxemVaSkUyZVFKNVM4bUtlR25ZOE5MRVFaNlpXZS9CK0UvOU9ORVFCSGhPUzVkMUtVV2NvakV4SE53b2p4VUF2cTZYOThmM3orRzYrakorcEl1aFNlaEdjcFFOVFVxYjIvSjdsbU9vSHF2dy9lbG9MRk96b3pya21wQURUVERDV1FsMCs0QllkbmRPN0FOZFVhRlBYMmtlUk1YaUQzZ3lxWDlzcmdTVHBzSlRuTHZWR2I0KzhrT1kzcSt5aUd0T3ZxMFpCZmZ5aDcyd3E2alVuNjZPR0hXS2oxM3RNM29GcnR3WmZXK3FnMDhCSGg1amlFVjFBbUhUSm1CaHUvSWtZMWl1YnpCZm0xdm4xMGhSYllnb2N6UkFNV3dkVWhIWnBmMUdjVUV2NUQ5djMrL1g5SjUxRWFwVGdaQlhtaUZqdUVtQ3lQK3hXWmRnTTFLRlZpTWhObWhiYjJwNmZSaEt3d2VwUGhrR1VKbnR1aTNuZDh3SFNlSVpQR3d4bDNpcFBJSmMzLzR6UTdmMk9tTFByNTNoMzRqRGhrTUhCcW1acURCV3VQelZQdFd3cEZCb01yZWpKTThCUGcxUmZtUEJxUEw2NnFBWFJJQnRnTmdIaHhLRm00dTVMd1o1Y1J0UGZkVXUrcTlvZ215WDNnU00zSDVYeXo3K0lSaWIySGErRmpHMmNGU2hvbXJTS0RaZFpGaEJOYVdnd21rU0Z1TDlpdTF5QmlLZ1p1aERCUkZMNVZOb08wd1hLWGJBeC90OG9hdElyTjRHRDlWYk4ycWdwMFBvRUw5dXVyUDZFU2prcTFJa3Q5UGtBOVNrMkRhMTZFdEJsM0ovRG9DSUczdDNvbFRjZ2RMakJ0N0R6S0EyWVlmMTRiZGI1ZStVOHBkbzMxemVWbkZTUXBTdmZUVU5KNHVuTlVkbEtIcFoxb1BDQnAyQy9wTVppMkJxVk1QdGNDeWZsb1Z5UlZFQ0RsZlBvLytQMzYvTy9aUEJKZ3pqcWdxOXdRUnliaW9FKzE4RDh0UXM3RGNaYnZ1VGlSbFlCNUkrRkd6YTk4QUZ1YTlCZklYR2d5b0pPNXNVVnVVYWh1VEYvYjZWc2ZSNmlRVlFXWVNvWlNTRnlMaFFTQncvM0FXUDRld0xOd0ZSZFFqUWM0NWpkdkdibmliY20ySVBVQjdzN0xhb1UvV2l2MWY0ZEoyMUlpSFlKQU1jeGo1cW9mNVNxNUdCVElDV0c3TVA4SHFFOHFmcElIVUsybTZRRVBMenFWNEkyTjlMRUxZTWE5OWZubzcxaDc4cDJhd20wR2VWSmZUd3k4V2NkYTJuQXlhMEFwd20wUGhIdFJoeDBrRTlQTDM0VWd4NUEzR3gxbDdiZjkxa3BqeE9QT2NoSjREUGFaSER3MmIvYk9HcnNDcTBJZms4dkluM2JxcFk5U3VYbmZpOHpHenNTb05SanhHZWdKOVZiYkh6MFpCK0p4b2JzdldDK2Z2MEpSb2FQM2ZDSkZ1bGdsazdOVk5EK05hTEgvR1JqVDJTbCtjS3ByV0R5THlqK0UzcE1yY2ZLWFNKck0xZHIyaVl6RDBPb3BRVWpnR2IxOFIzczdKVXZ0QVBSOUp5MU1KcmlIbjNjV2xZSXZCWXRmQ3lXQ1pIdUc5NTF1c3dYMWt1WURYaGVDUmM1ek9Td2o3SDVWR295eWZSdzBMdnNVZmdhUXNhT2dibTZLTFJRcGtQZkl5ajdiMWE2M3RrQ0lOSTI5cHNyTUdVei8zT0JYbkNBR0d2Q3BxZkFwL3hHZzByaDdwMWVLaE93alUrN2NVbWlUS0lsUFR6TVBITWtJMytFTDlLc1JzV2J5OGoyWVdmUWNCUHAwNGQ2QzVNdHJYeCtFMWhoamNTSEE3RklpSkh2V0V6RVpxRkpXTDFCdHp1UFEwNlVZcVRDb3ZxTjlnZFFkZ2NUQ1lub2FpN2QvZ2M1alJ1TGowa2QwdjVxbHlyQzdsYjJ5eGVLQmFuamVxVXloQ1FXdGc4MmlZVWJOMkVhSVZiVXBRaUlOT0YxTTZ2TmFtZUFGL3I2QjZRSy94VUxEalMvWms4WExhMG82ekYySWh4VjExUTkrRUZ4d2h1MVVZZkltbkx5OU5MODJtRFNQTUZxS3FsT1NvQWRxcTU3cUxvZmpGMndwY3kyTTdvWGNrQ2tPaVp6T0U5QkMzeGNsVjhoRVB4T2JKQTNjSk96emc4UUl2RjNrSmxaNTJMcDlMSnQ5Q0g2ZThyZEM5clZNZ1BneDU5YWlLTm1iMkFsOXBaN0hpUWZWRUZ6QkM5SEhDVjRPZzVKZmt1VzY1UjM0QUI5SUt3WEFyTmNDTWFWajcyL2ZPbnRhdVNDa0NIZ3RKdVdDNlphcmFzaVpIYWc2NG1kOFVWbWtwRUJ2WE1OYTZJN3Rtdm1YL1lmUE0rR3Y2MzcvR1U1MmhGRTRIRVVsK2l3eWlJQ2JxSndHNDNQenRkcVpuWTRvYmNydVlJMGJKSFdSSzhhZ1Y1aTkxbGx2Qm14WDVtelB1Y3Aza0JJSkkyWDNFVEZ6SDlRam8xbktrYzhtY3FlSWtmZWl3ekpyL1ZmeEY4UXg2VmJWSjJhN1o2VEVNd2NiVDRJUVZjaUlyKzYxUEdlV0svT3F5bGdZODIzMTczNHhpSG4rcGFnWGpCc2lObHcxQm1ublhKeHZucTJWRGw5Z0h0czJqMy9mcjYrbEgvaDUvY25CK3czRElVQzlGTmI5UFZtb1B6dkdJZ2ZiV2puSDI3SFRZOFBjaDRpZkVHV0tRMG51a2s2TytpbW4yUTdkZC9LYnNYTW5IdXZETDRHNmxlVWZpTnFvMUQ2OGJJT0IyQ3dkeHVvbk5yenF6ZVBZb0VPdHZQSE9iRmhuVUlXaGJXUG84Skx3ZU80UFNIYjh4U3dOa1JVOVNZaHZ1bWwyZWZMWi9maFo3ZzdGb2lIeS90ak1sK3R6am9JL0tKNEh2YWdINTYySEg4VFlNYUtCekpzVjdJdkVEV2J2Um9HOU1FWnlBdlJ0amw5WmZUMjlTdkgvRk9zejgrQ0lzZUJWSlVpbitDK3pZZDhKTDNIMzdkSDNLVVZxN0xKYXBESEZrRmtSU09tNllHKzVicnAxTXV0a3FaSUpaMWxOd00xTW15L1pmSnFWMUl6SHdPWE0rVm5xa25WZVk5SytUNzNiRlRWOUhmR0VQMVduVEczNWxjbUoyUHZ1TmdhVTIyejNWUVdmalNndG1JMWthVUxtd3lHMytlcmF4Nk1yWFJsZFBXYXJlZi9BTFJGUURhOWdXSTQzT3czVFE2SXpFRkVsS0czaDdHdE5Ba1NFU003MCtsWnNjMURUYnNrMjdNRUlha25MdUhjMkJXYmYra213eUIxZEozVENmd1RMR0VQZFNBa3BCa0ZtaXphMVFVeVhib3lsQnpZcEpucFYxV0dWWDU0R1hjb0p1cnR2RzNwN2lPeTlBcEpZcUl6U1pMYVJIazhCRHpXdDJjekhsMWJaN1VZMGNtbUxQUzlBc05SYnJWdm9LY2htUVNUZTJMcG9rTWpaaXltVGp0TG1OM2wxRE5VNHgxQXhTT1FhTVptNHlvUm94YUY2ckNBUlI4MFdsbHRvY0ZDK0lYTVJHMzlBSklwUGlRRTNwQmVHNHcrWTBGVUFLTDZHUmtqL01YbnQ0ckw5M1BkRldTZjN6MjU4V3VsQjRIcmVoaHl3UEh2dk5NUUJQYUtVb3VKc3BRZmpKYWpnMmZUbDVDMGVxZVh6UEM0YXM5M25uczY0ME5kQk95T3dRTnpXbEdsL3FrekUwS203WXBjRk43UjM2YnRqczF2dWtoQ0p4Z2hqTk5QUHdvei9xWE9oNDVYN2h4djQ1eHA5M0h6TE1Eam81ZjNEWXVsSkRNVXhONitySmdGdDJwbTV1VklkSXVNdFQ5eTBqcXdJS0dEaDR6elQ0MDloVzFZY204ZTVjRkdKWjRNeWR3dHNOT0l1Q0J0d2NFdDUxdG9kVWRYVDBrcTJ1WmR4TGorNGhZYk52OXVhMEFYLy9JNTdydVZhTTdkdVZDZU9oR1BVWU1UQWgzSnk5UktXOUxUbG9vVDJQM1JRQXJ1SFNGajlzSFBhQ2RodXNFbnY1V1VNWWd2SVAybU9YRUdhbCtVeTh6M3FZRStyU0Q5N0tRUkUvOEJlRkM5b3pNUUlEVXhQOW0veXVFMUlKdHBrVzRNaHdtM3MvUzVpK3kyeG1pQ1JlT3d3ZVV6Y3dMcjBNR08raHhtSDM2anVMQU5ZdEVWZm80aHlUY1FSdU83MVRMOE1NbWhITEJnVi85ZGN0Qkx4WC9CRmxRQW9SNVh3UHhWYktNMENMNE13RnNwUE1SYno3NXRzajJVZDQ2TkxoRHVBRjZVVGpNdDVxclBYT1pMSUNNQVFsbGlUK1lMZzhMamdTYWdKdkFSamEwczlWUnVOaHJIRjVXMU1LY0haRThLQklWR0orYktjLzFLWGJFT3dmUHUrZUxmSS9QR0pScnZlL2NWbTBhUXRMZ1VFcmNwRUpUd1FhMWUrRE1aUHJQS0h5VU9WZ1FkMTBEbTNTMElrL2NNWGx3d3RUSDVFR2YvZXY3R1pOL3EwYWRyY1l3OHVhZXRTVENzOXlhdnpuMTQ4M1RsRUQ1WE82eWZHOE9MdDA3TjFDNmxMTElpajdVb0xrRUlKTGpGY2VCTWU3amhOK1BmN2M3MXVzYUVCMjgrdDRSOEsvbGV6bzc4MEYzNS9ZZklKeGErVHZxbGVxdGhGempzSnpYOHZHSXNlWHpQaU1acHpwbUlxVHhNbzhPTUtlcFlPN3hnRzZZakUvZGtvdFFhUTIwUTRiOWpPaVdYNW9KSDAzcGY3eW9Sc0ZyamE3ZTBFeU1haGNsRlR1TE5lc3dXNkgyTDVhTzlzU3hjUG50a2JNbXpJMFcva1g1eUNMdlQ5WGIrVFM2cUdCV3pSNGFQdzVNQVpuWGxFcStUYm5RWTkrOW9xSTZoclMyQ1VUaUNFMWIzVjBOQ2w2bW1RK2NzV0tRSllBdVM1cDdqRzRDelcyVFQ5QXpGczNteE1TTnk3cVUzQ21sdlhNcDB0UDdnNEovWE91UXdBWCtMNDlidmVxZ2VWRUs4VVFkNDZZS2lRVkdsUHluNGF2T0k0a0dXNjF6NjVJUVBOOVVPcjZFRnhPVXhJWnIyb0ZEdEdVUnFuSzNVZEt3Nzdtdjkxd1NkZGRESlIvTHRkN0c3Wlpmb2lHR3hHZ0lLYzNCQUxleHhUOE5aMGNReHVFL0ZTMlR4dWVzSEJ6Y3lSNXkvVGZOeHVGdlRENzFrZElEeEk4eXVsYzZoUXNjMktudnZXTmNSMEREU3FmeFhDUjJ4OGp1WmxBWkkxbXUzcDBNRTJiV0lpUXgzaEFwdmljSkorN0JoRGhZLzh4R2U0WEVrVXhEMnJ3NWFremRWSkdWSTdEQnAwazhHMEV2YWw2cmUvQnpjRlVFNFJhZW94T1U2bDVRRjNZYjY2NnpvTnEzNzhnTzd1cDY2TmoxZGdFZ1lwOVhJUVN2WEo3Uk9FcEFscUxMRC82NWdOWE5wYmlWNXZ1bG1iMC9nQ3ZqcThRZ2ozTU0xNjAzNUhFZGlTdEpoanMydFJKRGhJQ1lHR09PVWdpTmlmKzYyOWlSajBGWHdNcXhncE9nTytLalo0R24vQU5YSFhGK0U5TlVLVk95c0ZkWkpQUGNpYU1kVXEva2F5TzFNSVluTktRQWZWRHgrME5qMVN5S0Yxc3dLVmxxY3NsaUVzaXVRaS9nL1NFaU9Gam9UcEcxSFdxdkdTYXJpU2VubXc5eE9ZZy9uU0F0c0FrMlF4S0g5Sk91TUh1L0N5c3REUXdOMHV0ZmpjNHNUQnFXdkRONUY1a3JXa1J1eWxLRkQvK0M4MjBCd2R2d3VobU0wQlplZklmTlJmQzd3cHF6dlRUWE1Dc1I0anFaeElsSW9Tc2swWjhtcGN4bGF5ZGx4RWVhdXYrYytYZ2xRV05QVFhMcEEwWm5WaW5uUS8wQXNPcm9Lb2ZnaGphcENneTFCL0FrMnk3Z0NXV1RrRkp6ZmZWQzY5QnJnOEYrYzJJMkRKa3JkT056aGcyVFB1YzduM0dFZXJHdWIxMkZybFRMODdzM2UwNk45QUl6TFlGa3M0MmVEWnN1QUlwM0ZmSzU0MlkzT0U3dkR2eFd5UEhFd1ZuanNyWndZaGdBUXV4Tjc2cUVRTkh6bkl3TzQyRzQwRTRFYlRTRUFTbDAyR2VQMUZ0TEVsZ1hZUEJXSGFtNnZhd0t2M0lMTmNNZmRBdnJJOThFZmx6K3Vma0pRL29JZFdnYU90Ly9BeXpPRFE1Zm94ZzhCNE5IQ3F4MTVWQ1dTWk9EV0RkOFlnTzNBcUNDSlpzMGxzdTN1TGpWcjZ0Z0thND08L3hlbmM6Q2lwaGVyVmFsdWU+PC94ZW5jOkNpcGhlckRhdGE+PC94ZW5jOkVuY3J5cHRlZERhdGE+PC9zYW1sMjpFbmNyeXB0ZWRBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+'
+          SAMLResponse:
+            "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cDovL2xvY2FsaG9zdC9icm93c2VyU2FtbExvZ2luIiBJRD0iXzdmOWU5NWM3MTE2NTRhYTQxYjMyNmY4Yjg0N2Y3YTEzIiBJblJlc3BvbnNlVG89Il8zMTM4ZDY3NWQ2ZWQ0MTZkNDNkNiIgSXNzdWVJbnN0YW50PSIyMDE0LTA2LTAyVDE3OjQ4OjU2LjgyMFoiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDplbnRpdHkiPmh0dHBzOi8vaWRwLnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDwvc2FtbDI6SXNzdWVyPjxzYW1sMnA6U3RhdHVzPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpFbmNyeXB0ZWRBc3NlcnRpb24geG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjx4ZW5jOkVuY3J5cHRlZERhdGEgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIiBJZD0iX2ZiYjE0NzQzNTEwYTYyOTJmODc1MGVmZGUzOWJhNzI2IiBUeXBlPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNFbGVtZW50Ij48eGVuYzpFbmNyeXB0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjYWVzMTI4LWNiYyIgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIi8+PGRzOktleUluZm8geG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjx4ZW5jOkVuY3J5cHRlZEtleSBJZD0iXzQ0YTEwOTk0MDVkYzgxMDJlYTFmZmM3Zjk0YzJhZjkyIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkVuY3J5cHRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNyc2Etb2FlcC1tZ2YxcCIgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIj48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIi8+PC94ZW5jOkVuY3J5cHRpb25NZXRob2Q+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRXNEQ0NBcGlnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFVRkFEQVRNUkV3RHdZRFZRUURFd2d4TUM0d0xqRXVOREFlRncweApOREExTURnd01EVTBNVGxhRncweE5EQTFNRGd3TURVME1UbGFNQk14RVRBUEJnTlZCQU1UQ0RFd0xqQXVNUzQwTUlJQ0lqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBNWhxamFyb0pwQithUjhGTUU3aFE5bk1WMGg3TXBLdG1nRkxjSzN2d1A2N2YKZUFLK3hkdDE3aThSeVVoeGlsOUZDRlI1SzA4V2p3bzNOaUhacUhxRUtpdHcrSUpTbmRqTFNzb05nS0VJYWlGU3VnMmVWMW9ZRWx6MAo2REJYVHhjOGlxL0xhem5kcVRVb201MU9kZTl5STlBR2E4OGNETTVpT3FxOW1odUd1dnd1THRveVU3OExkK3MxRWE2TWdmN0w4TTdmClpWTzdOY3UrRmdJekk2R3QwMzVvaFlDTEJtT29NN28wdWo3RGNNRXZLT01Geml3RjQwd1lteXAzaENMbHEzcXdrTTlwVFZKbHR1ejAKQnQxdnFEZHJxM2tUaGVBOUpITWF5UnozSS9CWnhBVjNpUmQ0aHpMS1RrZWdEOFRvVEdVMTBHbWUrWkFyMXcvZXJjNWhWck0wL1hCbQpIUWxuSTVkMzFHVS9tZklrbTBYUFRHUlNwUHk3RStkVXZqOWRqdm0vVnFEZG9qZjN1dXdpckdlTE1SbE85UC9sQ2VyVGt0VzNnMjdTClY4Z24zRVRtMk1tN3JrTnFmMjRLSnBEdjB0S0Rvc2diZGFIcjJJRVlENFJwcXlTcDhrZDI1Qmh6dXNocUtSa1M4WHU1dDdIQWxWU0gKd2lGaHVMcXJyNGRVZmtCOGtaZU0veWNmWkxDbjdvTlVERmRnakdZU1ZNcGFrTDk3c0M5c2xBVzQvOFV0WFhaeExxY3lxL1l4ZHBDeQpzUFlQMWhzQXArVmdQQzdHSTZDeWlOb2pLUE9wdE1xTFpSWW5WaUt4bE9pV0JKQnpVQlJVVnVhYzhMWHJNaUR3OGJ0V0dhMUdoNXZUCmh1RlVLc3ZtUm9ldWs3ZXlYRU45SjdqNitmVFlqbnNDQXdFQUFhTVBNQTB3Q3dZRFZSMFBCQVFEQWdUd01BMEdDU3FHU0liM0RRRUIKQlFVQUE0SUNBUURBUEZVbzBQZ2E3dkI0SWp5OXUzcXBXTFFTQ2Q0eGZ3OGw5MmlxM0pxTFZYQng4R2Y5WFZ5Nkd6YlhXSWU2cG1RSQp6bW9tL0NXUXZoNm83a2MwRjR5NGZ0c1dmcW5xM2swK0hjWDRIZXUxUE4ySFNuVVVQTnNrNUFkZ2dkMzEyOU1ISWRmYUtiOGJTdUxKCnZTTWVNYXljcm1zYitnRUY2SkZQOGtHV09QNHhRWWpBVk9EY0ZiT3lBZkV1VkFodWp3MGJxbExIVCtFbDR2bGZCcnRkVStNWnp0SXEKUWtHRFc3Y21tODZaR2lCci9nYTk3QkNuT0NyZ1pYbHJnbWlhOFNtRjdSZmE0OC9Yemg3YkRtUGZnbUhnbEw1SnhocFJYMklvUFk1WApJdG1SOElhWUtoT0JPck8vcWVyY0o2WjNyUTZmSXJzOEhyWWdlVE8vdUU5d3c2V1JXQ1dEYUNSNG9XRFZ3akt6R2ZQMW9KdEFJUStVCk5qT2RkSDVvdERhd1hKUmxRV3ByNzJxVDcrV09LL3l6SmhOMHhtWERrbXQ1cHNNWS9DRG40a1hNTTB4YVJwZllPbjVTYzFvZWxRK2gKSW04L3JIVksvMGtyaENET25pcWorTC9uZTJTb3lvWFlnUzZvME5sa05odFRIbWpqb3NFN0hWNkpmQVVncTJEOWRxMDBKTzk2N0kzUAowVkY2RjhsY2RhcTB0b3ZKaEtXUmpycmlnWWQ3NTYvM2FUMkI4M0pXQTFSQTluaVhtclhmbkFQWnJOQ2ZXdmorWDJhbFVOL2l6ZElxClJ0czBVcFdUb1ZVcjBveldnbWJtcDVaT0dZT1FoK2xOY0FwM1Y5bE9yZGJaVlNJVE00N1JZR0JaYVpOREEyUGJEekMxM01TL0VqVEUKdlNrb253dGxDZz09PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PHhlbmM6Q2lwaGVyRGF0YSB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiPjx4ZW5jOkNpcGhlclZhbHVlPlFPVExoZmlOQ1NoNkduNWRQWmQ1QjB3SEJFUE1nSGxpV3h6TEp2eDlRTWxjelNXdWpnaUp3d2x3N2M4UHZTTUtNZXUxaDhhbTd0ZEUwcnAyd1JpSUJjenpHTlhUbm5xaFM1NzFzMFBLb2hRN0h4ZVRXZ0YxSTJidFcyWTBzSUJsNlYvanV4blBVQjF3SUhQcXdMYVlvdkN6enlWeWVrQnlZamI2WUp1eENPR0xGL3U5MTA1L1NjSXQxd1hja0NrTUlOcWY0dUdaT0FNOGZKQTFzQW9ldzZDcnJ1UG5OakVDWmNhcVNBZjZFUC94MGIwaXUvelZRT09ZMHRZMVRRQmpMRDFROVFoS282TWhCL2dYTS9waW54SnUzeFFxQTVIWEtzVGdWSml3SVlCQldwcHFzb1ZWUWRGUXErYlkyOVpHWDlzTSswc2tnbGJWQm50czhDQnFNdHRISkxTNTRNRnJ4aTJ0Y0x1OHVzek5rNGF6ajVOdmxZMlFmaTJTTGdvbDNaTS9DNGIwRERGS0xXc2Y4K1lkaEZoNnlPb1lkN2NmZ3hkZTlqK0YrVHI2U3pzeXlybjczTnVPd0hJWHV2N2ExZHduS3pIM29oV2ZBSjN1a3JTbWZqRWNrRURkNmkxQWRiajBYZUhYMENsZmlNK0IrRzl3aENhV0VIeFRiL3RjeHVXMTdJY3B4cTJIakZCUmM0bkVIaFRLOVRwcHJKOFFPYkJTZ2puZWxINjN6MmxSSVFWc3lYUDZmV2Q4Z3FhNG1kQ3VaUGs3YWppdDU2dlBxclBZUk1yRzU1N0VaUjkyVm42ZWZya2dDbGtoUnE0VmpPbE1GTWZYNkNKVXBzSW5HVHlISnRqdFgvR1U1NWRib1dqVEt0bmRxeEMyNTZLbTJlM3NWT2ZUOUpzPTwveGVuYzpDaXBoZXJWYWx1ZT48L3hlbmM6Q2lwaGVyRGF0YT48L3hlbmM6RW5jcnlwdGVkS2V5PjwvZHM6S2V5SW5mbz48eGVuYzpDaXBoZXJEYXRhIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyI+PHhlbmM6Q2lwaGVyVmFsdWU+dytwQjNXTlcxcUV1YmhDQ0tPUmtkc1ZNYTUzOVB5czJMSmR1dGlzN1RuMlhwdm5xREdZUG9YblZqSCtTdTQrTVRQdi9nZ0FnUlJnUW84NE1SUVJHZUs2OE1pcDhMLzRhQ3Y2ZmZUM0czVEpPdGc5Y3BhQVI4RkpyMXp6NFZhbi9UWGtScmpVRWRIUVlJTmhkR3ZUYVdSWUx3dDA2SExRckVoNlgxekJLbHFHanNEenk3Zm5LT1E5SEJqY01INnNGSTNENVZnOUtoc085QmFTNG9aL1J1LytUdC84SWg2VUhDcURTM0VUcnVqTUdCdDNRMFhaMWxCOHpWSUVIVXhoemlhZkF4aGlzZ1B3QWxYcTR6T0hteSt6YnJxekFQVjhhQ3JBT2RtbkZwYlA1VUV4MnRNcWJ5aU9jZVJ0R3doaUV5R3ozT1pyM0dtMXR3ZTJtNW05S05OZmt4eW56N0hVQndqS3hkcTNQTmFiMFNhOWVmNWRESHhiNHdFVDVJYUtSRGF6TDVlQWVkUnljL1FlbG1aNFhUQWljVGtySGRpR1VxeUhQdm9Jd2VmU3hhK3pyQTNoRjl1ODlLMmdQQTlGTHljWUJMc3AzVU5HMC90RkxkRnFhK01CVGNRZTRYSWJodlJsTVI1TU1zUHNPbm9Fclp4ckVXNjdvUzBpakJsaUlrY2VCcE1HaWJ6VUZtUDJsRFcxeDRjTEprTFlxWmVua1hSVURvbmVicXVjdXNIdFNOenNTK0g2MU8rNTI3NFhOM3FvRzZpdEZLVEUybjVQRTU0M0hMOG5Ib1dmWjdBTG1VeUdZSzAxTnVjWjF0L3B5SytCNkFhT3RSY1lvMWlwcTVWNzU5cmNUTGFVdFoxeVdCNVlZSVdtMUkvNGt4WEw0bGpPcng5V1BiMUJGTnJVZ0FBQTV5Qzd1T2s1MXh4S1RiaGZoakpra3AwcEU5WWF3cTdBY2lrb2VadDRJcDFpQ0JoZjZCdjB6RCs3c0tyeE5XQUxzNXVYOU40ZDgxekZBamU0eGlHMDFZUzBjOWtEWk5zU1E3ZDI2alE5ait0YVBYa2Z6aFVRZithdnczMXVDbk0vNFBHckc1UGlPeFhrVmcrUnVrZGVaUjU1VEEzZXBmamhSbEM1UmFnWGlGeURLOEcrK0dDSEJvVUtBN0pNcmtacmlZczdDNE9SNVdDQVNrOUhTTEIrc0VicnJTcnF1aGpKZUNTR0ZyQmpGckw3OGx3QnI2QWxhN2Z6bzhmNnNmL25nSUNxNDNmL1FzYXpwWHpyZzlYN3NTWTBONDJJaUtIN2FiSzhSTXpvbmpETzhFb1p1U0tLT00vN3VVSGxMalVXbjh1V0dBa21zV01qN2lUa3hQRkxRNVFKM3VzZHl6U1FndUZRMERVVmF3ZmJlb2NtMk90cjNTdC8wT3VVOHBzdHZodHdTWnVJc2s2NFk5MGFGZ01kRHcvdWJNS3lzQUh0aXowdUhGenpDMW9iTmFaY3BLS0tVUml5ZkYvNkY0dmhNbDErRC9ubWpUQTdRVm9yQURDS0lpUnFlNXRzdG1tcHJIbWRibFpmaGI5cGcxcDJBMVZPTStzRldoRG9QWXk4dWRaKzBQSGRmTkh6bDNLVHNIVjhUSmR4bTBXTTJiWURsYi9TSTBsZVBRUytSWUlsODJ0V2ZqUzIwT2VuZ1RoZjdHWUFLUGJUaUtnWHdJazMzbE5pa2cxSWdRMGhPcnFlZUV1MHBvb05NV1pOMlJBVkZpY1hmUkRhQ21lOFFFWUdWY0ZaOTFGWkY5MWRPZ3Z1cXY5NHVCcUlsUWtVWWl0SUh2cEFWc2RuU1VjQk4xN3JPMWFQVUcvemlUNFc5K1RsWFVTMmxjcXRKR2xwTjFCejd4Wm5GOXZBQjRDNy9xRC9XcFhZUlJUQ2VuUTJZbStMeHcxNXJMQThadURaTU1qdWxyMXErN016K0h0dXBtalV1eVJJRjNMZmtRVkFMa1YwUTl1bGw3djgyOVRHN2ZhSE00ZjJOR20xVHdXTkw0aXVJVHBsTy9LTHJBR08ydHRQdE1rZ1RXdzV5WWVTd0pSQ1B4SFhTa0pVQ01EblcxU05KZHZSNUJ6RXNZakpTQ0Q0dkpqTVJTM015ZHJldzBzdFNHZkwzajdScjgvUlVXbDlXTWlQOEFyU1d4S3JFRCtBNzJua3hlNnFtRFZtNm91YWpiSk9rYVY4cDZMNW1XWUZ3MnBobVpQRElvTndCUzY3K1lGc28yOXJTL1dOZUJRQ1RTVWR1VW9tbk4yRFNib0x5eTVzM0o3M2xyNXBrZktQODgvL2dDQUxQbG0zQ1E3VktiK0RIUDd0VUxpaFVkTmJYV29YL2IzZXk0QzdDRmhtclhYRTViQ25sWnQ2TFlIZlhNSjJvRmxDOHJyOTBSY0VZWjlnNjVRdktOVDFabVJVR3JveVBYbjdHTThhU1N5RGZLeDhCQ0V1d3FYL1VzN2tWWkxDczhyMW1xQUl1eTlMb09oVlIrMEJ4TDZhTTRLMEpvLzhIUy9mNE80c1BRd2JGMWp4UU1ZYVlabHBLdzBzL0o4UGtLSnBBUzlyM1RtajZFVlNqb3dscmtmT1hpUVhaWkY3dXVwdlNvOUwrVnVXZ1Vuckg4dXpmMUhlQVhUMXlYRDAyT0dTR2JyUnF2alJZWFhTVFFpTnZxQXo3UzBKOHJSNTE5WUFiQk5KdzlwUExXRjVMZWZ2VVc0NnpYcDVZdE9LTWlENnk5dmJMaTlJbHRzM0MydUxJY0ZIbXRRMmZ1RlBwbzIzeTI5YXV4U2IxdXQ2Si9BK2tyTFRKWWFjNEczS3B3ZVFnVEs2dXBHeGdZM2p3c2FzTjMyWGs3eC9rUzZsVThBM0FjNElmQTh3VlMyVFF4S0FaZnNJNHFrZVJqNVkvUWlkTmM0TTlWWUZCeXo1aHNJdmxObjFtMy9oV1dvdDRDVzhlNzFENGN4UnUvQTJjVGwwSHBybWZ2cVFmTVhmMU5kZ0Fya0kwSVIydkMwUWZCYm9FS0tDYno3RThJTWJJbjdWK1BmdGdoOG4zOXMvU2F5c21TMXMzdzRHdFFvZHdRMTdmK2gyRVR0RVZOMkh2VWZMRENoQy82dGVhaU9hd3dJWXFvUGlaczlOZDFrZUZ3YlFOSGpkbUE4ZW43UHYzdXhIRTFLcmduUXNqci9yZ3c1ZEdwNjdmSFpkcUpuZHgyVVNPV2tnZmdLRHZ0SlNXSWZtT2I3WnluUGpxZ3ZLYzV5RWFQUXQ2TUNXVXF0WEEvVTJ5WG9wWGhDYVN3cXFIZlYzVGRrb3JkcURucW9jYTJKdDRGaUdTQWhEclY0VVNSblVvUWoxblArS1F3RktDVDcvME5Rb3Q0VWhWWndVNlAxUFRUSExBNkEva1JoMkFsaGZZMTlzOUh0SVl0SHpMTm9nbWFkT3pxR3NCNHFSQko2blZ2N3lXVER2ejhtVVdMTjNmVlBzdnUxZS9YYTlKUWQzK3pKUXRVSXhQWjBPaW9jbWh2M0U1TzFRSzNodVgvdTdWaXAwbFBEcHNvMkRmTDNqNU50blBhQWt4TUEzVDN2ek56WFcyV3ZyeE5HYjkvRDdESEpuZ3NqdUF4OWw4VTl1RHJPNzVmaDJiREc3RzhFUUNBRktQMkJjZWxybkREY1B3d0wwQS9wSW1zaEdwUlFzMzgzeERDZGxVa0toTUJnbDI1cXJmWGJCQVJOQmFtV0hFNGZQem1iYk9MYWtRUVg3VFJJRFNWTGNiTTQrdU1idlROL0R2TUFXZlA2ZW9YU1pHWGQxME9ET2FPVzZJVzNITG9seUg4QzU0cUwxN2dVeFJRMElNdjNGc2tHYmZ5enBvWi9GRmdBa2I2Qjg4eW9EOW5SbTB2czJmYlRrd1ZLNDNENE5iN1JuOHZtL1lCZGkwVytXTUdMdU9lb1d5RGl6NVk2YnZNR3kySjI5V2pwaFgwaGphWGVySlVKdFpRT0tLclAybUdCWjVNSHlmMUtFSVdraFdtemlOYTZXbmFzSU8xM2o2TkRqYnptbkF1QTU1VzBFQlhVMHRYTE1pckJvd29iR3lzVXZMOVBvTTV0TDBuOUVYTGtwbHhCS0gxVmZtNG1MR2M2cGNVVU5sK0dWc3daaHdZVVNtV3hNQU10M25YemkrSlFWOUIwRGhCU3gweGZ2bEZkSmUvSkcrTmM1ZmprcTlSbkFWMHNweXlwTnZacnZ4NXZ3T3d3Q3hCc0VNSWV3RDlNOHQzM2VGRnRYRnRBeDF2Zlo0SzlQV2VRblV0Rm9yR05ZYjF5cVFnbHIxMGxGeVpXWWdpMHJSUXlqTHFmdWxSODRmTkpUYjNabnNIeWNuK1I3WXBsM3k2WWlvRUF1bThtYlRmRVZCNUVoTXptaVB1Tjc1V2NxY1JTZDdlYnprY0JBL2JYNGZYMEVRWSs5cE41dUt6WE1USzU0OTZPM09KV2R4ZXllQXQrN0cwZVNkREo4OXEvbGp6T1g5OVFZU01zQ0NISWwrdElYdG9aMjFqb2dZVnEzc1RtUGhscThHVHZmeElPSTI2WnM3cm1FOWJFTGs2U1NYeFFoNy9KSUEyZXVSY0RUWDlSM1FXalMrUFRnTUJObEZXYTlEOERycVJPVWVyT0V6eFMwYS9oTXJyUHZub1o3US9mTDgzQ1JhanM4RTBwYndGZnNuSVF6MVoxNWlXeklBVlFFRnBOZXZ3eVkzSmlYSndkRTM1dVIzbVRYdXRkNzRrLzNuTXYrQmszVjZYRnpkMVp5dDg2Nkd2Vmd1alMrSWFqNllRNmZGckc0NW1lekU3d3VJWDBWMlZVU1Rjam9tcndaNThXclhvM2M1MHdRNHNlV0tkNnV2WCt5dlNBWnlxclhTbkdhWDNZUHlBemVhMFFWa2JLWGhCWHVLYUpGMzNMS1RFWGt6eVJvOThLRko2Z1dPSExWQm5mRTdrWlFKUEkzNEpTSnZzZTExbmlmYkMzZ1lpK3MzSlVSOGQwSmI1c1JkcU5Fc1l2d1lIM0xQcGRYRkxOUXBNM2ViYm1UUGdKR2J5bFJTUDFWelJVRURsbXgwbjRVUGs5SGFZNksvZkZWSEt0ek0vVnpJUm5IK1VRRnFXN1RSMkxFdXI5dmNKcytGaGFieG8xUHc3VlV0R1lZVkJMMjVZbC9aQmR2THFBY3hLN0xVTFk4Yk80V2lCKzcwMlUxZERQRENaQWNYWnlid0duNDQxRE1rcHJrck5DOHVxbkFQRHA0ekNMTnBENWM4NXg2Q2pDMDlJei9TYnorbkxLcXgyRnY3MVBCcmh6RXlvbHNVNWpEZVVtSGcrTFplVzk0dlVNQ2lZalY5b09ma0ZIa2RHbk10NGl6dmJPd3FETG5JSFhCWU9MYUNuNmUwd005Ums4NjhtRWpoYXRBUXRvRm1lKzMxL0M2clJ1cW1NbSszNVNKY0ROejZuWEFVWWVVOFZjVkorNU5IWE56MUF1UXh3cWo2VlNsMHRmSmZUaDk0V1gxNHlzSXlBZnlTeTlDTXNHMW9aNDZ2djJkNEZETjFyMWwvN3hEYWtBYmZLUGNPK0F3U0dGWkxCQ09DaFR4dkVlQTdvWlhJVFRLTVdPUlJZVXVkb3JOQ2FOKy9IMktzcHo4eTMzUm54OHJaTUd2cnlPUm5nME5LSnBrT1oyOGlDczVGQmJPa2UvZWROeVFibm90b3hCUjJIbHcydVY0SWRsd1c1NVZkcHNtaWJ5alArS0NaSFNGOWV2WTFHci9VdDVYL0l1S21NbTBiWGQ2UFp0VjcyWWxkbDg3NHB2YSt3Y0NsOTBwcTRIU2x1T0JFQm9haUt1cXQyUCtHY1BZa2tRSitEUVBYdktYYlFWanZWbCtXS3FPL1VZbmRTMlR4b3dINk5ZMWNuVE5INGtWR3RmaHNSc3FCQzlSRjRsSGxRK2w4UnZaTmZMcHliWjJ0T3RwSmZaUXQyNTNnZE4zZGdzUEsxVTVISEZKd2RwYzA2QlY4YTNueWZvNWh4aEorOXVaTisxdDdGYUtpdng5QWhscE8xTytMcGIxenovM1VucVBRR3FwbEJVemtINko0VmVSTFdHNDd0SkVZNVRZbmxrZHpvTGF3dUdjM3ZwMWhZUjZZVEg0Y0I5bGlsMUs5cHgvUFI5UGRhM2R4T25zelZ5ZG13RWw3QjZHb3VrK3hXMWF5NG1iT0hDa3JwdEVoa3NEcjY4WWE3b05GUXVZMnNEUmdla0VidHo2RFZFako1b0hkUmVvSFZMRm1TM3pSZ3lwNFJRZ3YxMG9wUWNpTU1hNER1OGh4dVpVN3JYMVNGYm5uQ2owaWZoZDUyd2JyOVEyWisyYnNKaTEvczZkV05JS3ZDaDhxUE9YU21IL21YMFpETkFDbDV4K0phTTNOTGl4dEFlZFVxcjV6dDlza0t4Qzd5cURUbVhMRkIzRjJNRm15UzBtMFVRcDdDb2daUVI0MjI4TlR5WFpSK3FYZExhMUlaU1owOC9BOGUwMzRJZ0FzS0YvQXhJdFNuNllZZXhHOXFYeU5aU2x2OGpPS3FiWGdidWZnZHorVjY2OHVGMnpzRk5RY2pBUUxydGxqWnRFR0g4WEIwMFozT3ptb1ZmcWFqWFhMSlN6UjcwSFJHUWpYK2d6SFVBUlF3Z2ZxUVFtVWcwZmtBMStyNmZPWTVYMDVRdkxNaFprWmJwN0RuUmczQUZKMU9hYnRPYndJek9WRmhsN0p2SzZlTk9kK0NTNkttZUZSS3BwSExCNSt4Z3NpNGRSQ1VYL3VGZkVFZ2FxNm0xems5OXprSWpTZDdRWFhXQUpIWE52K1NuUjcwTzVkdkRTam1ZTSt2MnVVOGZNMlBiZzU1OWJ1LzIvYW5VQkxEMWJxZG9pTC9GSHFlb1B2am1zRktkcFdnRjFHRGVkam9sVmRzUWNTeUxoYlN0eXUzSWE5RU1OK0h6V3ZmVXd4M1hSOGQxMHpSS2lBL1J0Qjc1cUVFZm5UQTREa1grVUxCVGd1WkxkWklJYVVFTG5XN1UwZldnVEFuaEdqTVp1Tmdkdk5qb1BGRmRlcmxmRFplazM0aDVGQUJvM2srTlJuUk9USmhZaUhHOHE2MDF0NEVsaklCVnoyYkw4UW9vL055ejE4VFF5NkRGMUVhK08rVXkwUlhlMk51QXZBekpUVlAwU3prMGE4WTU3d0xZVElPdW55UUtKY3JxemVaSkUyZVFKNVM4bUtlR25ZOE5MRVFaNlpXZS9CK0UvOU9ORVFCSGhPUzVkMUtVV2NvakV4SE53b2p4VUF2cTZYOThmM3orRzYrakorcEl1aFNlaEdjcFFOVFVxYjIvSjdsbU9vSHF2dy9lbG9MRk96b3pya21wQURUVERDV1FsMCs0QllkbmRPN0FOZFVhRlBYMmtlUk1YaUQzZ3lxWDlzcmdTVHBzSlRuTHZWR2I0KzhrT1kzcSt5aUd0T3ZxMFpCZmZ5aDcyd3E2alVuNjZPR0hXS2oxM3RNM29GcnR3WmZXK3FnMDhCSGg1amlFVjFBbUhUSm1CaHUvSWtZMWl1YnpCZm0xdm4xMGhSYllnb2N6UkFNV3dkVWhIWnBmMUdjVUV2NUQ5djMrL1g5SjUxRWFwVGdaQlhtaUZqdUVtQ3lQK3hXWmRnTTFLRlZpTWhObWhiYjJwNmZSaEt3d2VwUGhrR1VKbnR1aTNuZDh3SFNlSVpQR3d4bDNpcFBJSmMzLzR6UTdmMk9tTFByNTNoMzRqRGhrTUhCcW1acURCV3VQelZQdFd3cEZCb01yZWpKTThCUGcxUmZtUEJxUEw2NnFBWFJJQnRnTmdIaHhLRm00dTVMd1o1Y1J0UGZkVXUrcTlvZ215WDNnU00zSDVYeXo3K0lSaWIySGErRmpHMmNGU2hvbXJTS0RaZFpGaEJOYVdnd21rU0Z1TDlpdTF5QmlLZ1p1aERCUkZMNVZOb08wd1hLWGJBeC90OG9hdElyTjRHRDlWYk4ycWdwMFBvRUw5dXVyUDZFU2prcTFJa3Q5UGtBOVNrMkRhMTZFdEJsM0ovRG9DSUczdDNvbFRjZ2RMakJ0N0R6S0EyWVlmMTRiZGI1ZStVOHBkbzMxemVWbkZTUXBTdmZUVU5KNHVuTlVkbEtIcFoxb1BDQnAyQy9wTVppMkJxVk1QdGNDeWZsb1Z5UlZFQ0RsZlBvLytQMzYvTy9aUEJKZ3pqcWdxOXdRUnliaW9FKzE4RDh0UXM3RGNaYnZ1VGlSbFlCNUkrRkd6YTk4QUZ1YTlCZklYR2d5b0pPNXNVVnVVYWh1VEYvYjZWc2ZSNmlRVlFXWVNvWlNTRnlMaFFTQncvM0FXUDRld0xOd0ZSZFFqUWM0NWpkdkdibmliY20ySVBVQjdzN0xhb1UvV2l2MWY0ZEoyMUlpSFlKQU1jeGo1cW9mNVNxNUdCVElDV0c3TVA4SHFFOHFmcElIVUsybTZRRVBMenFWNEkyTjlMRUxZTWE5OWZubzcxaDc4cDJhd20wR2VWSmZUd3k4V2NkYTJuQXlhMEFwd20wUGhIdFJoeDBrRTlQTDM0VWd4NUEzR3gxbDdiZjkxa3BqeE9QT2NoSjREUGFaSER3MmIvYk9HcnNDcTBJZms4dkluM2JxcFk5U3VYbmZpOHpHenNTb05SanhHZWdKOVZiYkh6MFpCK0p4b2JzdldDK2Z2MEpSb2FQM2ZDSkZ1bGdsazdOVk5EK05hTEgvR1JqVDJTbCtjS3ByV0R5THlqK0UzcE1yY2ZLWFNKck0xZHIyaVl6RDBPb3BRVWpnR2IxOFIzczdKVXZ0QVBSOUp5MU1KcmlIbjNjV2xZSXZCWXRmQ3lXQ1pIdUc5NTF1c3dYMWt1WURYaGVDUmM1ek9Td2o3SDVWR295eWZSdzBMdnNVZmdhUXNhT2dibTZLTFJRcGtQZkl5ajdiMWE2M3RrQ0lOSTI5cHNyTUdVei8zT0JYbkNBR0d2Q3BxZkFwL3hHZzByaDdwMWVLaE93alUrN2NVbWlUS0lsUFR6TVBITWtJMytFTDlLc1JzV2J5OGoyWVdmUWNCUHAwNGQ2QzVNdHJYeCtFMWhoamNTSEE3RklpSkh2V0V6RVpxRkpXTDFCdHp1UFEwNlVZcVRDb3ZxTjlnZFFkZ2NUQ1lub2FpN2QvZ2M1alJ1TGowa2QwdjVxbHlyQzdsYjJ5eGVLQmFuamVxVXloQ1FXdGc4MmlZVWJOMkVhSVZiVXBRaUlOT0YxTTZ2TmFtZUFGL3I2QjZRSy94VUxEalMvWms4WExhMG82ekYySWh4VjExUTkrRUZ4d2h1MVVZZkltbkx5OU5MODJtRFNQTUZxS3FsT1NvQWRxcTU3cUxvZmpGMndwY3kyTTdvWGNrQ2tPaVp6T0U5QkMzeGNsVjhoRVB4T2JKQTNjSk96emc4UUl2RjNrSmxaNTJMcDlMSnQ5Q0g2ZThyZEM5clZNZ1BneDU5YWlLTm1iMkFsOXBaN0hpUWZWRUZ6QkM5SEhDVjRPZzVKZmt1VzY1UjM0QUI5SUt3WEFyTmNDTWFWajcyL2ZPbnRhdVNDa0NIZ3RKdVdDNlphcmFzaVpIYWc2NG1kOFVWbWtwRUJ2WE1OYTZJN3Rtdm1YL1lmUE0rR3Y2MzcvR1U1MmhGRTRIRVVsK2l3eWlJQ2JxSndHNDNQenRkcVpuWTRvYmNydVlJMGJKSFdSSzhhZ1Y1aTkxbGx2Qm14WDVtelB1Y3Aza0JJSkkyWDNFVEZ6SDlRam8xbktrYzhtY3FlSWtmZWl3ekpyL1ZmeEY4UXg2VmJWSjJhN1o2VEVNd2NiVDRJUVZjaUlyKzYxUEdlV0svT3F5bGdZODIzMTczNHhpSG4rcGFnWGpCc2lObHcxQm1ublhKeHZucTJWRGw5Z0h0czJqMy9mcjYrbEgvaDUvY25CK3czRElVQzlGTmI5UFZtb1B6dkdJZ2ZiV2puSDI3SFRZOFBjaDRpZkVHV0tRMG51a2s2TytpbW4yUTdkZC9LYnNYTW5IdXZETDRHNmxlVWZpTnFvMUQ2OGJJT0IyQ3dkeHVvbk5yenF6ZVBZb0VPdHZQSE9iRmhuVUlXaGJXUG84Skx3ZU80UFNIYjh4U3dOa1JVOVNZaHZ1bWwyZWZMWi9maFo3ZzdGb2lIeS90ak1sK3R6am9JL0tKNEh2YWdINTYySEg4VFlNYUtCekpzVjdJdkVEV2J2Um9HOU1FWnlBdlJ0amw5WmZUMjlTdkgvRk9zejgrQ0lzZUJWSlVpbitDK3pZZDhKTDNIMzdkSDNLVVZxN0xKYXBESEZrRmtSU09tNllHKzVicnAxTXV0a3FaSUpaMWxOd00xTW15L1pmSnFWMUl6SHdPWE0rVm5xa25WZVk5SytUNzNiRlRWOUhmR0VQMVduVEczNWxjbUoyUHZ1TmdhVTIyejNWUVdmalNndG1JMWthVUxtd3lHMytlcmF4Nk1yWFJsZFBXYXJlZi9BTFJGUURhOWdXSTQzT3czVFE2SXpFRkVsS0czaDdHdE5Ba1NFU003MCtsWnNjMURUYnNrMjdNRUlha25MdUhjMkJXYmYra213eUIxZEozVENmd1RMR0VQZFNBa3BCa0ZtaXphMVFVeVhib3lsQnpZcEpucFYxV0dWWDU0R1hjb0p1cnR2RzNwN2lPeTlBcEpZcUl6U1pMYVJIazhCRHpXdDJjekhsMWJaN1VZMGNtbUxQUzlBc05SYnJWdm9LY2htUVNUZTJMcG9rTWpaaXltVGp0TG1OM2wxRE5VNHgxQXhTT1FhTVptNHlvUm94YUY2ckNBUlI4MFdsbHRvY0ZDK0lYTVJHMzlBSklwUGlRRTNwQmVHNHcrWTBGVUFLTDZHUmtqL01YbnQ0ckw5M1BkRldTZjN6MjU4V3VsQjRIcmVoaHl3UEh2dk5NUUJQYUtVb3VKc3BRZmpKYWpnMmZUbDVDMGVxZVh6UEM0YXM5M25uczY0ME5kQk95T3dRTnpXbEdsL3FrekUwS203WXBjRk43UjM2YnRqczF2dWtoQ0p4Z2hqTk5QUHdvei9xWE9oNDVYN2h4djQ1eHA5M0h6TE1Eam81ZjNEWXVsSkRNVXhONitySmdGdDJwbTV1VklkSXVNdFQ5eTBqcXdJS0dEaDR6elQ0MDloVzFZY204ZTVjRkdKWjRNeWR3dHNOT0l1Q0J0d2NFdDUxdG9kVWRYVDBrcTJ1WmR4TGorNGhZYk52OXVhMEFYLy9JNTdydVZhTTdkdVZDZU9oR1BVWU1UQWgzSnk5UktXOUxUbG9vVDJQM1JRQXJ1SFNGajlzSFBhQ2RodXNFbnY1V1VNWWd2SVAybU9YRUdhbCtVeTh6M3FZRStyU0Q5N0tRUkUvOEJlRkM5b3pNUUlEVXhQOW0veXVFMUlKdHBrVzRNaHdtM3MvUzVpK3kyeG1pQ1JlT3d3ZVV6Y3dMcjBNR08raHhtSDM2anVMQU5ZdEVWZm80aHlUY1FSdU83MVRMOE1NbWhITEJnVi85ZGN0Qkx4WC9CRmxRQW9SNVh3UHhWYktNMENMNE13RnNwUE1SYno3NXRzajJVZDQ2TkxoRHVBRjZVVGpNdDVxclBYT1pMSUNNQVFsbGlUK1lMZzhMamdTYWdKdkFSamEwczlWUnVOaHJIRjVXMU1LY0haRThLQklWR0orYktjLzFLWGJFT3dmUHUrZUxmSS9QR0pScnZlL2NWbTBhUXRMZ1VFcmNwRUpUd1FhMWUrRE1aUHJQS0h5VU9WZ1FkMTBEbTNTMElrL2NNWGx3d3RUSDVFR2YvZXY3R1pOL3EwYWRyY1l3OHVhZXRTVENzOXlhdnpuMTQ4M1RsRUQ1WE82eWZHOE9MdDA3TjFDNmxMTElpajdVb0xrRUlKTGpGY2VCTWU3amhOK1BmN2M3MXVzYUVCMjgrdDRSOEsvbGV6bzc4MEYzNS9ZZklKeGErVHZxbGVxdGhGempzSnpYOHZHSXNlWHpQaU1acHpwbUlxVHhNbzhPTUtlcFlPN3hnRzZZakUvZGtvdFFhUTIwUTRiOWpPaVdYNW9KSDAzcGY3eW9Sc0ZyamE3ZTBFeU1haGNsRlR1TE5lc3dXNkgyTDVhTzlzU3hjUG50a2JNbXpJMFcva1g1eUNMdlQ5WGIrVFM2cUdCV3pSNGFQdzVNQVpuWGxFcStUYm5RWTkrOW9xSTZoclMyQ1VUaUNFMWIzVjBOQ2w2bW1RK2NzV0tRSllBdVM1cDdqRzRDelcyVFQ5QXpGczNteE1TTnk3cVUzQ21sdlhNcDB0UDdnNEovWE91UXdBWCtMNDlidmVxZ2VWRUs4VVFkNDZZS2lRVkdsUHluNGF2T0k0a0dXNjF6NjVJUVBOOVVPcjZFRnhPVXhJWnIyb0ZEdEdVUnFuSzNVZEt3Nzdtdjkxd1NkZGRESlIvTHRkN0c3Wlpmb2lHR3hHZ0lLYzNCQUxleHhUOE5aMGNReHVFL0ZTMlR4dWVzSEJ6Y3lSNXkvVGZOeHVGdlRENzFrZElEeEk4eXVsYzZoUXNjMktudnZXTmNSMEREU3FmeFhDUjJ4OGp1WmxBWkkxbXUzcDBNRTJiV0lpUXgzaEFwdmljSkorN0JoRGhZLzh4R2U0WEVrVXhEMnJ3NWFremRWSkdWSTdEQnAwazhHMEV2YWw2cmUvQnpjRlVFNFJhZW94T1U2bDVRRjNZYjY2NnpvTnEzNzhnTzd1cDY2TmoxZGdFZ1lwOVhJUVN2WEo3Uk9FcEFscUxMRC82NWdOWE5wYmlWNXZ1bG1iMC9nQ3ZqcThRZ2ozTU0xNjAzNUhFZGlTdEpoanMydFJKRGhJQ1lHR09PVWdpTmlmKzYyOWlSajBGWHdNcXhncE9nTytLalo0R24vQU5YSFhGK0U5TlVLVk95c0ZkWkpQUGNpYU1kVXEva2F5TzFNSVluTktRQWZWRHgrME5qMVN5S0Yxc3dLVmxxY3NsaUVzaXVRaS9nL1NFaU9Gam9UcEcxSFdxdkdTYXJpU2VubXc5eE9ZZy9uU0F0c0FrMlF4S0g5Sk91TUh1L0N5c3REUXdOMHV0ZmpjNHNUQnFXdkRONUY1a3JXa1J1eWxLRkQvK0M4MjBCd2R2d3VobU0wQlplZklmTlJmQzd3cHF6dlRUWE1Dc1I0anFaeElsSW9Tc2swWjhtcGN4bGF5ZGx4RWVhdXYrYytYZ2xRV05QVFhMcEEwWm5WaW5uUS8wQXNPcm9Lb2ZnaGphcENneTFCL0FrMnk3Z0NXV1RrRkp6ZmZWQzY5QnJnOEYrYzJJMkRKa3JkT056aGcyVFB1YzduM0dFZXJHdWIxMkZybFRMODdzM2UwNk45QUl6TFlGa3M0MmVEWnN1QUlwM0ZmSzU0MlkzT0U3dkR2eFd5UEhFd1ZuanNyWndZaGdBUXV4Tjc2cUVRTkh6bkl3TzQyRzQwRTRFYlRTRUFTbDAyR2VQMUZ0TEVsZ1hZUEJXSGFtNnZhd0t2M0lMTmNNZmRBdnJJOThFZmx6K3Vma0pRL29JZFdnYU90Ly9BeXpPRFE1Zm94ZzhCNE5IQ3F4MTVWQ1dTWk9EV0RkOFlnTzNBcUNDSlpzMGxzdTN1TGpWcjZ0Z0thND08L3hlbmM6Q2lwaGVyVmFsdWU+PC94ZW5jOkNpcGhlckRhdGE+PC94ZW5jOkVuY3J5cHRlZERhdGE+PC9zYW1sMjpFbmNyeXB0ZWRBc3NlcnRpb24+PC9zYW1sMnA6UmVzcG9uc2U+",
         },
         config: {
-          entryPoint: 'https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO',
-          cert: 'MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem')
+          entryPoint: "https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO",
+          cert:
+            "MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
         },
         expectedStatusCode: 200,
-        mockDate: '2014-06-02T17:48:56.820Z'
-      }
+        mockDate: "2014-06-02T17:48:56.820Z",
+      },
     ];
 
     var server;
@@ -91,41 +116,40 @@ describe( 'passport-saml /', function() {
       return function (done) {
         var pp = new passport.Authenticator();
         var app = express();
-        app.use(bodyParser.urlencoded({extended: false}));
+        app.use(bodyParser.urlencoded({ extended: false }));
         app.use(pp.initialize());
         var config = check.config;
-        config.callbackUrl = 'http://localhost:3033/login';
+        config.callbackUrl = "http://localhost:3033/login";
         var profile = null;
-        pp.use(new SamlStrategy(config, function (_profile, done) {
+        pp.use(
+          new SamlStrategy(config, function (_profile, done) {
             profile = _profile;
             done(null, { id: profile.nameID });
           })
         );
 
         var userSerialized = false;
-        pp.serializeUser(function(user, done) {
+        pp.serializeUser(function (user, done) {
           userSerialized = true;
           done(null, user);
         });
 
         fakeClock = sinon.useFakeTimers(Date.parse(check.mockDate));
 
-        app.post('/login',
-          pp.authenticate("saml"),
-          function (req, res) {
-            res.status(200).send("200 OK");
-          });
+        app.post("/login", pp.authenticate("saml"), function (req, res) {
+          res.status(200).send("200 OK");
+        });
 
         app.use(function (err, req, res, next) {
           // console.log( err.stack );
-          res.status(500).send('500 Internal Server Error');
+          res.status(500).send("500 Internal Server Error");
         });
 
         server = app.listen(3033, function () {
           var requestOpts = {
-            url: 'http://localhost:3033/login',
-            method: 'POST',
-            form: check.samlResponse
+            url: "http://localhost:3033/login",
+            method: "POST",
+            form: check.samlResponse,
           };
 
           request(requestOpts, function (err, response, body) {
@@ -135,7 +159,9 @@ describe( 'passport-saml /', function() {
               if (response.statusCode == 200) {
                 userSerialized.should.be.true;
                 if (check.expectedNameIDStartsWith)
-                  profile.nameID.should.startWith(check.expectedNameIDStartsWith);
+                  profile.nameID.should.startWith(
+                    check.expectedNameIDStartsWith
+                  );
               }
               done();
             } catch (err2) {
@@ -150,35 +176,34 @@ describe( 'passport-saml /', function() {
       return function (done) {
         var pp = new passport.Authenticator();
         var app = express();
-        app.use(bodyParser.urlencoded({extended: false}));
+        app.use(bodyParser.urlencoded({ extended: false }));
         app.use(pp.initialize());
         var config = check.config;
-        config.callbackUrl = 'http://localhost:3033/login';
+        config.callbackUrl = "http://localhost:3033/login";
         config.passReqToCallback = true;
         var passedRequest = null;
-        pp.use(new SamlStrategy(config, function (req, _profile, done) {
+        pp.use(
+          new SamlStrategy(config, function (req, _profile, done) {
             passedRequest = req;
             done(null, { id: _profile.nameID });
           })
         );
-        pp.serializeUser(function(user, done) {
+        pp.serializeUser(function (user, done) {
           done(null, user);
         });
         fakeClock = sinon.useFakeTimers(Date.parse(check.mockDate));
-        app.post('/login',
-          pp.authenticate("saml"),
-          function (req, res) {
-            res.status(200).send("200 OK");
-          });
+        app.post("/login", pp.authenticate("saml"), function (req, res) {
+          res.status(200).send("200 OK");
+        });
         app.use(function (err, req, res, next) {
           // console.log( err.stack );
-          res.status(500).send('500 Internal Server Error');
+          res.status(500).send("500 Internal Server Error");
         });
         server = app.listen(3033, function () {
           var requestOpts = {
-            url: 'http://localhost:3033/login',
-            method: 'POST',
-            form: check.samlResponse
+            url: "http://localhost:3033/login",
+            method: "POST",
+            form: check.samlResponse,
           };
           request(requestOpts, function (err, response, body) {
             try {
@@ -186,8 +211,8 @@ describe( 'passport-saml /', function() {
               response.statusCode.should.equal(check.expectedStatusCode);
               if (response.statusCode == 200) {
                 should.exist(passedRequest);
-                passedRequest.url.should.eql('/login');
-                passedRequest.method.should.eql('POST');
+                passedRequest.url.should.eql("/login");
+                passedRequest.method.should.eql("POST");
                 should(passedRequest.body).match(check.samlResponse);
               } else {
                 should.not.exist(passedRequest);
@@ -201,10 +226,10 @@ describe( 'passport-saml /', function() {
       };
     }
 
-    for( var i = 0; i < capturedChecks.length; i++ ) {
+    for (var i = 0; i < capturedChecks.length; i++) {
       var check = capturedChecks[i];
       it(check.name, testForCheck(check));
-      it(check.name + ' passReqToCallback', testPassReqToCallback(check));
+      it(check.name + " passReqToCallback", testPassReqToCallback(check));
     }
 
     afterEach(function (done) {
@@ -213,841 +238,1029 @@ describe( 'passport-saml /', function() {
     });
   });
 
-
-  describe( 'captured SAML requests /', function() {
+  describe("captured SAML requests /", function () {
     var logoutChecks = [
-      { name: "Logout",
+      {
+        name: "Logout",
         config: {
           skipRequestCompression: true,
-          entryPoint: 'https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO',
-          cert: fs.readFileSync(__dirname + '/static/cert.pem', 'ascii'),
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
+          entryPoint: "https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO",
+          cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         },
         samlRequest: {
-          SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_good_signature.xml', 'base64'),
+          SAMLRequest: fs.readFileSync(
+            __dirname + "/static/logout_request_with_good_signature.xml",
+            "base64"
+          ),
         },
         expectedStatusCode: 200,
-        mockDate: '2014-06-02T17:48:56.820Z',
+        mockDate: "2014-06-02T17:48:56.820Z",
         result: {
           "samlp:LogoutResponse": {
-            "$": {
+            $: {
               "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
               "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-              "Version": "2.0",
-              "Destination": "https://wwwexampleIdp.com/saml",
-              "InResponseTo": "pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1",
+              Version: "2.0",
+              Destination: "https://wwwexampleIdp.com/saml",
+              InResponseTo: "pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1",
             },
-            "saml:Issuer": [
-              "onelogin_saml"
-            ],
+            "saml:Issuer": ["onelogin_saml"],
             "samlp:Status": [
               {
                 "samlp:StatusCode": [
                   {
-                    "$": {
-                      "Value": "urn:oasis:names:tc:SAML:2.0:status:Success"
-                    }
-                  }
-                ]
-              }
-            ]
-          }
+                    $: {
+                      Value: "urn:oasis:names:tc:SAML:2.0:status:Success",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
         },
       },
     ];
 
     var capturedChecks = [
-      { name: "Empty Config",
+      {
+        name: "Empty Config",
         config: {},
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                Destination: 'https://wwwexampleIdp.com/saml'},
-             'saml:Issuer':
-              [ { _: 'onelogin_saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+            },
+            "saml:Issuer": [
+              {
+                _: "onelogin_saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format:
+                    "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
+        },
       },
-      { name: "Empty Config w/ HTTP-POST binding",
-        config: { authnRequestBinding: 'HTTP-POST' },
+      {
+        name: "Empty Config w/ HTTP-POST binding",
+        config: { authnRequestBinding: "HTTP-POST" },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                Destination: 'https://wwwexampleIdp.com/saml'},
-             'saml:Issuer':
-              [ { _: 'onelogin_saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+            },
+            "saml:Issuer": [
+              {
+                _: "onelogin_saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format:
+                    "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
+        },
       },
-      { name: "Config #2",
+      {
+        name: "Config #2",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           passive: true,
           attributeConsumingServiceIndex: 123,
-          forceAuthn: false
+          forceAuthn: false,
         },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                AttributeConsumingServiceIndex: '123',
-                Destination: 'https://wwwexampleIdp.com/saml',
-                IsPassive: 'true'},
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              AttributeConsumingServiceIndex: "123",
+              Destination: "https://wwwexampleIdp.com/saml",
+              IsPassive: "true",
+            },
+            "saml:Issuer": [
+              {
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
+        },
       },
-      { name: "Uncompressed config #2",
+      {
+        name: "Uncompressed config #2",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           passive: true,
           attributeConsumingServiceIndex: 123,
-          skipRequestCompression: true
+          skipRequestCompression: true,
         },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                AttributeConsumingServiceIndex: '123',
-                Destination: 'https://wwwexampleIdp.com/saml',
-                IsPassive: 'true' },
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              AttributeConsumingServiceIndex: "123",
+              Destination: "https://wwwexampleIdp.com/saml",
+              IsPassive: "true",
+            },
+            "saml:Issuer": [
+              {
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
+        },
       },
-      { name: "Config #3",
+      {
+        name: "Config #3",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           passive: true,
           attributeConsumingServiceIndex: 123,
           skipRequestCompression: true,
           disableRequestedAuthnContext: true,
-          forceAuthn: true
+          forceAuthn: true,
         },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                AttributeConsumingServiceIndex: '123',
-                Destination: 'https://wwwexampleIdp.com/saml',
-                IsPassive: 'true',
-                ForceAuthn: 'true' },
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              AttributeConsumingServiceIndex: "123",
+              Destination: "https://wwwexampleIdp.com/saml",
+              IsPassive: "true",
+              ForceAuthn: "true",
+            },
+            "saml:Issuer": [
+              {
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+          },
+        },
       },
-      { name: "Config with AuthnContext",
+      {
+        name: "Config with AuthnContext",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           passive: true,
           attributeConsumingServiceIndex: 123,
-          authnContext: 'myAuthnContext'
+          authnContext: "myAuthnContext",
         },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                AttributeConsumingServiceIndex: '123',
-                Destination: 'https://wwwexampleIdp.com/saml',
-                IsPassive: 'true'},
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'myAuthnContext',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              AttributeConsumingServiceIndex: "123",
+              Destination: "https://wwwexampleIdp.com/saml",
+              IsPassive: "true",
+            },
+            "saml:Issuer": [
+              {
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _: "myAuthnContext",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
+                ],
+              },
+            ],
+          },
+        },
       },
-      { name: "Config with multiple AuthnContext",
+      {
+        name: "Config with multiple AuthnContext",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           passive: true,
           attributeConsumingServiceIndex: 123,
-          authnContext: ['myAuthnContext', 'myAuthnContext2']
-        },
-        result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                AttributeConsumingServiceIndex: '123',
-                Destination: 'https://wwwexampleIdp.com/saml',
-                IsPassive: 'true'},
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'myAuthnContext',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } },
-                     { _: 'myAuthnContext2',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
-      },
-      { name: "Config with ProviderName",
-        config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
-          providerName: 'myProviderName'
+          authnContext: ["myAuthnContext", "myAuthnContext2"],
         },
         result: {
-          'samlp:AuthnRequest':
-           { '$':
-              { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                Version: '2.0',
-                ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                ProviderName: 'myProviderName',
-                AssertionConsumerServiceURL: 'http://localhost:3033/login',
-                Destination: 'https://wwwexampleIdp.com/saml'},
-             'saml:Issuer':
-              [ { _: 'http://exampleSp.com/saml',
-                  '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-             'samlp:NameIDPolicy':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Format: 'alternateIdentifier',
-                     AllowCreate: 'true' } } ],
-             'samlp:RequestedAuthnContext':
-              [ { '$':
-                   { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                     Comparison: 'exact' },
-                  'saml:AuthnContextClassRef':
-                   [ { _: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
-                       '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } ] } }
-      },
-      { name: "Remove NameIDPolicy, AuthnRequest, and AssertionConsumerServiceURL Config",
-      config: {
-        identifierFormat: null,
-        disableRequestedAuthnContext: true,
-        disableRequestACSUrl: true,
-      },
-      result: {
-        'samlp:AuthnRequest':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              Version: '2.0',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Destination: 'https://wwwexampleIdp.com/saml'},
-           'saml:Issuer':
-            [ { _: 'onelogin_saml',
-                '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ] } }
-      },
-      { name: "Config with full Scoping config",
-        config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
-          scoping: {
-            proxyCount: 2,
-            requesterId: 'fooBarRequesterId',
-            idpList: [
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              AttributeConsumingServiceIndex: "123",
+              Destination: "https://wwwexampleIdp.com/saml",
+              IsPassive: "true",
+            },
+            "saml:Issuer": [
               {
-                entries: [
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    _: "myAuthnContext",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                  },
                   {
-                    providerId: 'myScopingProviderId',
-                    name: 'myScopingProviderName',
-                    loc: 'myScopingProviderLoc',
+                    _: "myAuthnContext2",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
                   },
                 ],
-                getComplete: 'https://www.getcompleteidplist.com',
               },
             ],
           },
         },
+      },
+      {
+        name: "Config with ProviderName",
+        config: {
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
+          providerName: "myProviderName",
+        },
         result: {
-          'samlp:AuthnRequest': {
-            '$': {
-              AssertionConsumerServiceURL: 'http://localhost:3033/login',
-              Destination: 'https://wwwexampleIdp.com/saml',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Version: '2.0',
-              'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              ProviderName: "myProviderName",
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
             },
-            'saml:Issuer': [
-              {
-                '$': {
-                  'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-                },
-                '_': 'http://exampleSp.com/saml',
-              }
-            ],
-            'samlp:NameIDPolicy': [
+            "saml:Issuer": [
               {
-                '$': {
-                  AllowCreate: 'true',
-                  Format: 'alternateIdentifier',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                }
-              }
+                _: "http://exampleSp.com/saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
             ],
-            'samlp:RequestedAuthnContext': [
+            "samlp:NameIDPolicy": [
               {
-                '$': {
-                  Comparison: 'exact',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Format: "alternateIdentifier",
+                  AllowCreate: "true",
                 },
-                'saml:AuthnContextClassRef': [
-                  {
-                    '$': {
-                      'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion'
-                    },
-                    '_': 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
-                  }
-                ]
-              }
+              },
             ],
-            'samlp:Scoping': [
+            "samlp:RequestedAuthnContext": [
               {
-                '$': {
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                  ProxyCount: '2',
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  Comparison: "exact",
                 },
-                'samlp:IDPList': [
+                "saml:AuthnContextClassRef": [
                   {
-                    '$': {
-                      'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    'samlp:GetComplete': [
-                      'https://www.getcompleteidplist.com'
-                    ],
-                    'samlp:IDPEntry': [
-                      {
-                        '$': {
-                          Loc: 'myScopingProviderLoc',
-                          Name: 'myScopingProviderName',
-                          ProviderID: 'myScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
-                      }
-                    ]
-                  }
+                  },
                 ],
-                'samlp:RequesterID': [
-                  'fooBarRequesterId'
-                ]
-              }
-            ]
-          }
-        } },
-      { name: "Config with Scoping config without proxyCount and requesterId",
+              },
+            ],
+          },
+        },
+      },
+      {
+        name:
+          "Remove NameIDPolicy, AuthnRequest, and AssertionConsumerServiceURL Config",
+        config: {
+          identifierFormat: null,
+          disableRequestedAuthnContext: true,
+          disableRequestACSUrl: true,
+        },
+        result: {
+          "samlp:AuthnRequest": {
+            $: {
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+              Version: "2.0",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Destination: "https://wwwexampleIdp.com/saml",
+            },
+            "saml:Issuer": [
+              {
+                _: "onelogin_saml",
+                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+              },
+            ],
+          },
+        },
+      },
+      {
+        name: "Config with full Scoping config",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           scoping: {
+            proxyCount: 2,
+            requesterId: "fooBarRequesterId",
             idpList: [
               {
                 entries: [
                   {
-                    providerId: 'myScopingProviderId',
-                    name: 'myScopingProviderName',
-                    loc: 'myScopingProviderLoc',
+                    providerId: "myScopingProviderId",
+                    name: "myScopingProviderName",
+                    loc: "myScopingProviderLoc",
                   },
                 ],
-                getComplete: 'https://www.getcompleteidplist.com',
+                getComplete: "https://www.getcompleteidplist.com",
               },
             ],
           },
         },
         result: {
-          'samlp:AuthnRequest': {
-            '$': {
-              AssertionConsumerServiceURL: 'http://localhost:3033/login',
-              Destination: 'https://wwwexampleIdp.com/saml',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Version: '2.0',
-              'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+          "samlp:AuthnRequest": {
+            $: {
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Version: "2.0",
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
             },
-            'saml:Issuer': [
+            "saml:Issuer": [
               {
-                '$': {
-                  'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
+                $: {
+                  "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                 },
-                '_': 'http://exampleSp.com/saml',
-              }
+                _: "http://exampleSp.com/saml",
+              },
             ],
-            'samlp:NameIDPolicy': [
+            "samlp:NameIDPolicy": [
               {
-                '$': {
-                  AllowCreate: 'true',
-                  Format: 'alternateIdentifier',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                }
-              }
+                $: {
+                  AllowCreate: "true",
+                  Format: "alternateIdentifier",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+              },
             ],
-            'samlp:RequestedAuthnContext': [
+            "samlp:RequestedAuthnContext": [
               {
-                '$': {
-                  Comparison: 'exact',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                $: {
+                  Comparison: "exact",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'saml:AuthnContextClassRef': [
+                "saml:AuthnContextClassRef": [
                   {
-                    '$': {
-                      'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion'
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    '_': 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
-                  }
-                ]
-              }
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                  },
+                ],
+              },
             ],
-            'samlp:Scoping': [
+            "samlp:Scoping": [
               {
-                '$': {
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                  ProxyCount: "2",
                 },
-                'samlp:IDPList': [
+                "samlp:IDPList": [
                   {
-                    '$': {
-                      'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                    $: {
+                      "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                     },
-                    'samlp:GetComplete': [
-                      'https://www.getcompleteidplist.com'
-                    ],
-                    'samlp:IDPEntry': [
+                    "samlp:GetComplete": ["https://www.getcompleteidplist.com"],
+                    "samlp:IDPEntry": [
                       {
-                        '$': {
-                          Loc: 'myScopingProviderLoc',
-                          Name: 'myScopingProviderName',
-                          ProviderID: 'myScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
-                      }
-                    ]
-                  }
-                ]
-              }
-            ]
-          }
-        } },
-      { name: "Config with Scoping config without proxyCount, requesterId, getComplete",
+                        $: {
+                          Loc: "myScopingProviderLoc",
+                          Name: "myScopingProviderName",
+                          ProviderID: "myScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
+                      },
+                    ],
+                  },
+                ],
+                "samlp:RequesterID": ["fooBarRequesterId"],
+              },
+            ],
+          },
+        },
+      },
+      {
+        name: "Config with Scoping config without proxyCount and requesterId",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           scoping: {
             idpList: [
               {
                 entries: [
                   {
-                    providerId: 'myScopingProviderId',
-                    name: 'myScopingProviderName',
-                    loc: 'myScopingProviderLoc',
+                    providerId: "myScopingProviderId",
+                    name: "myScopingProviderName",
+                    loc: "myScopingProviderLoc",
                   },
-                ]
+                ],
+                getComplete: "https://www.getcompleteidplist.com",
               },
             ],
           },
         },
         result: {
-          'samlp:AuthnRequest': {
-            '$': {
-              AssertionConsumerServiceURL: 'http://localhost:3033/login',
-              Destination: 'https://wwwexampleIdp.com/saml',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Version: '2.0',
-              'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+          "samlp:AuthnRequest": {
+            $: {
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Version: "2.0",
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
             },
-            'saml:Issuer': [
+            "saml:Issuer": [
               {
-                '$': {
-                  'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
+                $: {
+                  "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                 },
-                '_': 'http://exampleSp.com/saml',
-              }
+                _: "http://exampleSp.com/saml",
+              },
             ],
-            'samlp:NameIDPolicy': [
+            "samlp:NameIDPolicy": [
               {
-                '$': {
-                  AllowCreate: 'true',
-                  Format: 'alternateIdentifier',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                }
-              }
+                $: {
+                  AllowCreate: "true",
+                  Format: "alternateIdentifier",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+              },
             ],
-            'samlp:RequestedAuthnContext': [
+            "samlp:RequestedAuthnContext": [
               {
-                '$': {
-                  Comparison: 'exact',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                $: {
+                  Comparison: "exact",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'saml:AuthnContextClassRef': [
+                "saml:AuthnContextClassRef": [
                   {
-                    '$': {
-                      'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion'
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    '_': 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
-                  }
-                ]
-              }
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                  },
+                ],
+              },
             ],
-            'samlp:Scoping': [
+            "samlp:Scoping": [
               {
-                '$': {
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'samlp:IDPList': [
+                "samlp:IDPList": [
                   {
-                    '$': {
-                      'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                    $: {
+                      "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                     },
-                    'samlp:IDPEntry': [
+                    "samlp:GetComplete": ["https://www.getcompleteidplist.com"],
+                    "samlp:IDPEntry": [
                       {
-                        '$': {
-                          Loc: 'myScopingProviderLoc',
-                          Name: 'myScopingProviderName',
-                          ProviderID: 'myScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
-                      }
-                    ]
-                  }
-                ]
-              }
-            ]
-          }
-        } },
-      { name: "Config with Scoping config without proxyCount, requesterId, idpList getComplete, entry name, entry loc",
+                        $: {
+                          Loc: "myScopingProviderLoc",
+                          Name: "myScopingProviderName",
+                          ProviderID: "myScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      },
+      {
+        name:
+          "Config with Scoping config without proxyCount, requesterId, getComplete",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           scoping: {
             idpList: [
               {
                 entries: [
                   {
-                    providerId: 'myScopingProviderId'
+                    providerId: "myScopingProviderId",
+                    name: "myScopingProviderName",
+                    loc: "myScopingProviderLoc",
                   },
-                ]
+                ],
               },
             ],
           },
         },
         result: {
-          'samlp:AuthnRequest': {
-            '$': {
-              AssertionConsumerServiceURL: 'http://localhost:3033/login',
-              Destination: 'https://wwwexampleIdp.com/saml',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Version: '2.0',
-              'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+          "samlp:AuthnRequest": {
+            $: {
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Version: "2.0",
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
             },
-            'saml:Issuer': [
+            "saml:Issuer": [
               {
-                '$': {
-                  'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
+                $: {
+                  "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                 },
-                '_': 'http://exampleSp.com/saml',
-              }
+                _: "http://exampleSp.com/saml",
+              },
             ],
-            'samlp:NameIDPolicy': [
+            "samlp:NameIDPolicy": [
               {
-                '$': {
-                  AllowCreate: 'true',
-                  Format: 'alternateIdentifier',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                }
-              }
+                $: {
+                  AllowCreate: "true",
+                  Format: "alternateIdentifier",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+              },
             ],
-            'samlp:RequestedAuthnContext': [
+            "samlp:RequestedAuthnContext": [
               {
-                '$': {
-                  Comparison: 'exact',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                $: {
+                  Comparison: "exact",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'saml:AuthnContextClassRef': [
+                "saml:AuthnContextClassRef": [
                   {
-                    '$': {
-                      'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion'
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    '_': 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
-                  }
-                ]
-              }
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                  },
+                ],
+              },
             ],
-            'samlp:Scoping': [
+            "samlp:Scoping": [
               {
-                '$': {
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'samlp:IDPList': [
+                "samlp:IDPList": [
                   {
-                    '$': {
-                      'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                    $: {
+                      "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                     },
-                    'samlp:IDPEntry': [
+                    "samlp:IDPEntry": [
                       {
-                        '$': {
-                          ProviderID: 'myScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
-                      }
-                    ]
-                  }
-                ]
-              }
-            ]
-          }
-        } },
-      { name: "Config with Scoping and multiple IDPList entries",
+                        $: {
+                          Loc: "myScopingProviderLoc",
+                          Name: "myScopingProviderName",
+                          ProviderID: "myScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      },
+      {
+        name:
+          "Config with Scoping config without proxyCount, requesterId, idpList getComplete, entry name, entry loc",
+        config: {
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
+          scoping: {
+            idpList: [
+              {
+                entries: [
+                  {
+                    providerId: "myScopingProviderId",
+                  },
+                ],
+              },
+            ],
+          },
+        },
+        result: {
+          "samlp:AuthnRequest": {
+            $: {
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Version: "2.0",
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            },
+            "saml:Issuer": [
+              {
+                $: {
+                  "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                },
+                _: "http://exampleSp.com/saml",
+              },
+            ],
+            "samlp:NameIDPolicy": [
+              {
+                $: {
+                  AllowCreate: "true",
+                  Format: "alternateIdentifier",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+              },
+            ],
+            "samlp:RequestedAuthnContext": [
+              {
+                $: {
+                  Comparison: "exact",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+                "saml:AuthnContextClassRef": [
+                  {
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+                    },
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                  },
+                ],
+              },
+            ],
+            "samlp:Scoping": [
+              {
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+                "samlp:IDPList": [
+                  {
+                    $: {
+                      "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                    },
+                    "samlp:IDPEntry": [
+                      {
+                        $: {
+                          ProviderID: "myScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      },
+      {
+        name: "Config with Scoping and multiple IDPList entries",
         config: {
-          issuer: 'http://exampleSp.com/saml',
-          identifierFormat: 'alternateIdentifier',
+          issuer: "http://exampleSp.com/saml",
+          identifierFormat: "alternateIdentifier",
           scoping: {
             idpList: [
               {
                 entries: [
                   {
-                    providerId: 'myScopingProviderId'
+                    providerId: "myScopingProviderId",
                   },
                   {
-                    providerId: 'myOtherScopingProviderId'
+                    providerId: "myOtherScopingProviderId",
                   },
-                ]
+                ],
               },
             ],
           },
         },
         result: {
-          'samlp:AuthnRequest': {
-            '$': {
-              AssertionConsumerServiceURL: 'http://localhost:3033/login',
-              Destination: 'https://wwwexampleIdp.com/saml',
-              ProtocolBinding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-              Version: '2.0',
-              'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+          "samlp:AuthnRequest": {
+            $: {
+              AssertionConsumerServiceURL: "http://localhost:3033/login",
+              Destination: "https://wwwexampleIdp.com/saml",
+              ProtocolBinding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+              Version: "2.0",
+              "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
             },
-            'saml:Issuer': [
+            "saml:Issuer": [
               {
-                '$': {
-                  'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
+                $: {
+                  "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                 },
-                '_': 'http://exampleSp.com/saml',
-              }
+                _: "http://exampleSp.com/saml",
+              },
             ],
-            'samlp:NameIDPolicy': [
+            "samlp:NameIDPolicy": [
               {
-                '$': {
-                  AllowCreate: 'true',
-                  Format: 'alternateIdentifier',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-                }
-              }
+                $: {
+                  AllowCreate: "true",
+                  Format: "alternateIdentifier",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                },
+              },
             ],
-            'samlp:RequestedAuthnContext': [
+            "samlp:RequestedAuthnContext": [
               {
-                '$': {
-                  Comparison: 'exact',
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                $: {
+                  Comparison: "exact",
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'saml:AuthnContextClassRef': [
+                "saml:AuthnContextClassRef": [
                   {
-                    '$': {
-                      'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion'
+                    $: {
+                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    '_': 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
-                  }
-                ]
-              }
+                    _:
+                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                  },
+                ],
+              },
             ],
-            'samlp:Scoping': [
+            "samlp:Scoping": [
               {
-                '$': {
-                  'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
+                $: {
+                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                 },
-                'samlp:IDPList': [
+                "samlp:IDPList": [
                   {
-                    '$': {
-                      'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
+                    $: {
+                      "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
                     },
-                    'samlp:IDPEntry': [
+                    "samlp:IDPEntry": [
                       {
-                        '$': {
-                          ProviderID: 'myScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
+                        $: {
+                          ProviderID: "myScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
                       },
                       {
-                        '$': {
-                          ProviderID: 'myOtherScopingProviderId',
-                          'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol'
-                        }
-                      }
-                    ]
+                        $: {
+                          ProviderID: "myOtherScopingProviderId",
+                          "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+                        },
+                      },
+                    ],
                   },
-                ]
-              }
-            ]
-          }
-        } }
-
-
-
-
-
+                ],
+              },
+            ],
+          },
+        },
+      },
     ];
 
     var server;
 
-    function testForCheck( check ) {
-      return function( done ) {
+    function testForCheck(check) {
+      return function (done) {
         var app = express();
-        app.use( bodyParser.urlencoded({extended: false}) );
-        app.use( passport.initialize() );
+        app.use(bodyParser.urlencoded({ extended: false }));
+        app.use(passport.initialize());
         var config = check.config;
-        config.callbackUrl = 'http://localhost:3033/login';
-        config.entryPoint = 'https://wwwexampleIdp.com/saml';
+        config.callbackUrl = "http://localhost:3033/login";
+        config.entryPoint = "https://wwwexampleIdp.com/saml";
         var profile = null;
-        passport.use( new SamlStrategy( config, function(_profile, done) {
-          profile = _profile;
-          done(null, profile );
+        passport.use(
+          new SamlStrategy(config, function (_profile, done) {
+            profile = _profile;
+            done(null, profile);
           })
         );
 
         var userSerialized = false;
-        passport.serializeUser(function(user, done) {
+        passport.serializeUser(function (user, done) {
           userSerialized = true;
           done(null, user);
         });
 
-        app.get( '/login',
-          passport.authenticate( "saml", { samlFallback: 'login-request', session: false } ),
-          function(req, res) {
+        app.get(
+          "/login",
+          passport.authenticate("saml", {
+            samlFallback: "login-request",
+            session: false,
+          }),
+          function (req, res) {
             res.status(200).send("200 OK");
-          });
+          }
+        );
 
-        app.use( function( err, req, res, next ) {
+        app.use(function (err, req, res, next) {
           // console.log( err.stack );
-          res.status(500).send('500 Internal Server Error');
+          res.status(500).send("500 Internal Server Error");
         });
 
-        server = app.listen( 3033, function() {
+        server = app.listen(3033, function () {
           var requestOpts = {
-            url: 'http://localhost:3033/login',
-            method: 'get',
-            followRedirect: false
+            url: "http://localhost:3033/login",
+            method: "get",
+            followRedirect: false,
           };
 
-          request(requestOpts, function(err, response, body) {
+          request(requestOpts, function (err, response, body) {
             try {
               should.not.exist(err);
 
               var encodedSamlRequest;
-              if ( check.config.authnRequestBinding === "HTTP-POST" ) {
+              if (check.config.authnRequestBinding === "HTTP-POST") {
                 response.statusCode.should.equal(200);
-                body.should.match(/<!DOCTYPE html>[^]*<input.*name="SAMLRequest"[^]*<\/html>/);
-                encodedSamlRequest = body.match( /<input.*name="SAMLRequest" value="([^"]*)"/ )[1];
+                body.should.match(
+                  /<!DOCTYPE html>[^]*<input.*name="SAMLRequest"[^]*<\/html>/
+                );
+                encodedSamlRequest = body.match(
+                  /<input.*name="SAMLRequest" value="([^"]*)"/
+                )[1];
               } else {
                 response.statusCode.should.equal(302);
-                var query = response.headers.location.match( /^[^\?]*\?(.*)$/ )[1];
-                encodedSamlRequest = querystring.parse( query ).SAMLRequest;
+                var query = response.headers.location.match(
+                  /^[^\?]*\?(.*)$/
+                )[1];
+                encodedSamlRequest = querystring.parse(query).SAMLRequest;
               }
 
-              var buffer = Buffer.from(encodedSamlRequest, 'base64');
-              if (check.config.skipRequestCompression)
-                helper(null, buffer);
-              else
-                zlib.inflateRaw( buffer, helper );
+              var buffer = Buffer.from(encodedSamlRequest, "base64");
+              if (check.config.skipRequestCompression) helper(null, buffer);
+              else zlib.inflateRaw(buffer, helper);
 
               function helper(err, samlRequest) {
                 try {
-                  should.not.exist( err );
-                  parseString( samlRequest.toString(), function( err, doc ) {
+                  should.not.exist(err);
+                  parseString(samlRequest.toString(), function (err, doc) {
                     try {
-                      should.not.exist( err );
-                      delete doc['samlp:AuthnRequest']['$']["ID"];
-                      delete doc['samlp:AuthnRequest']['$']["IssueInstant"];
-                      doc.should.eql( check.result );
+                      should.not.exist(err);
+                      delete doc["samlp:AuthnRequest"]["$"]["ID"];
+                      delete doc["samlp:AuthnRequest"]["$"]["IssueInstant"];
+                      doc.should.eql(check.result);
                       done();
                     } catch (err2) {
                       done(err2);
@@ -1065,67 +1278,65 @@ describe( 'passport-saml /', function() {
       };
     }
 
-    function testForCheckLogout( check ) {
-      return function( done ) {
+    function testForCheckLogout(check) {
+      return function (done) {
         var app = express();
-        app.use( bodyParser.urlencoded({extended: false}) );
-        app.use( passport.initialize() );
+        app.use(bodyParser.urlencoded({ extended: false }));
+        app.use(passport.initialize());
         var config = check.config;
-        config.callbackUrl = 'http://localhost:3033/login';
-        config.entryPoint = 'https://wwwexampleIdp.com/saml';
+        config.callbackUrl = "http://localhost:3033/login";
+        config.entryPoint = "https://wwwexampleIdp.com/saml";
         var profile = null;
-        passport.use( new SamlStrategy( config, function(_profile, done) {
+        passport.use(
+          new SamlStrategy(config, function (_profile, done) {
             profile = _profile;
-            done(null, profile );
+            done(null, profile);
           })
         );
 
         var userSerialized = false;
-        passport.serializeUser(function(user, done) {
+        passport.serializeUser(function (user, done) {
           userSerialized = true;
           done(null, user);
         });
 
-        app.post( '/login',
-          passport.authenticate( "saml"),
-          function(req, res) {
-            res.status(200).send("200 OK");
-          });
+        app.post("/login", passport.authenticate("saml"), function (req, res) {
+          res.status(200).send("200 OK");
+        });
 
-        app.use( function( err, req, res, next ) {
+        app.use(function (err, req, res, next) {
           // console.log( err.stack );
-          res.status(500).send('500 Internal Server Error');
+          res.status(500).send("500 Internal Server Error");
         });
 
-        server = app.listen( 3033, function() {
+        server = app.listen(3033, function () {
           var requestOpts = {
-            url: 'http://localhost:3033/login',
-            method: 'post',
-            form: check.samlRequest
+            url: "http://localhost:3033/login",
+            method: "post",
+            form: check.samlRequest,
           };
 
-          request(requestOpts, function(err, response, body) {
+          request(requestOpts, function (err, response, body) {
             try {
-              var encodedSamlResponse = querystring.parse(this.uri.query).SAMLResponse;
+              var encodedSamlResponse = querystring.parse(this.uri.query)
+                .SAMLResponse;
               // An error will exist because the endpoint we're trying to log out of doesn't exist,
               // but we can still test to make sure that everything is behaving as it should.
               // should.not.exist(err);
 
-              var buffer = Buffer.from(encodedSamlResponse, 'base64');
-              if (check.config.skipRequestCompression)
-                helper(null, buffer);
-              else
-                zlib.inflateRaw( buffer, helper );
+              var buffer = Buffer.from(encodedSamlResponse, "base64");
+              if (check.config.skipRequestCompression) helper(null, buffer);
+              else zlib.inflateRaw(buffer, helper);
 
               function helper(err, samlResponse) {
                 try {
-                  should.not.exist( err );
-                  parseString( samlResponse.toString(), function( err, doc ) {
+                  should.not.exist(err);
+                  parseString(samlResponse.toString(), function (err, doc) {
                     try {
-                      should.not.exist( err );
-                      delete doc['samlp:LogoutResponse']['$']["ID"];
-                      delete doc['samlp:LogoutResponse']['$']["IssueInstant"];
-                      doc.should.eql( check.result );
+                      should.not.exist(err);
+                      delete doc["samlp:LogoutResponse"]["$"]["ID"];
+                      delete doc["samlp:LogoutResponse"]["$"]["IssueInstant"];
+                      doc.should.eql(check.result);
                       done();
                     } catch (err2) {
                       done(err2);
@@ -1143,9 +1354,9 @@ describe( 'passport-saml /', function() {
       };
     }
 
-    for( var i = 0; i < capturedChecks.length; i++ ) {
+    for (var i = 0; i < capturedChecks.length; i++) {
       var check = capturedChecks[i];
-      it( check.name, testForCheck( check ) );
+      it(check.name, testForCheck(check));
     }
 
     for (var i = 0; i < logoutChecks.length; i++) {
@@ -1153,124 +1364,152 @@ describe( 'passport-saml /', function() {
       it(check.name, testForCheckLogout(check));
     }
 
-    afterEach( function( done ) {
-      server.close( done );
+    afterEach(function (done) {
+      server.close(done);
     });
   });
 
-  describe( 'saml.js / ', function() {
-    it( 'should throw an error if cert property is provided to saml constructor but is empty', function() {
-      should(function() {
-        new SAML( { cert: null } );
-      }).throw('Invalid property: cert must not be empty');
+  describe("saml.js / ", function () {
+    it("should throw an error if cert property is provided to saml constructor but is empty", function () {
+      should(function () {
+        new SAML({ cert: null });
+      }).throw("Invalid property: cert must not be empty");
     });
 
-    it( 'generateUniqueID should generate 20 char IDs', function() {
-      var samlObj = new SAML( { entryPoint: "foo" } );
-      for(var i = 0; i < 200; i++){
-          samlObj.generateUniqueID().length.should.eql(20);
+    it("generateUniqueID should generate 20 char IDs", function () {
+      var samlObj = new SAML({ entryPoint: "foo" });
+      for (var i = 0; i < 200; i++) {
+        samlObj.generateUniqueID().length.should.eql(20);
       }
     });
 
-    it( 'generateLogoutRequest', function( done ) {
+    it("generateLogoutRequest", function (done) {
       var expectedRequest = {
-        'samlp:LogoutRequest':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-              //ID: '_85ba0a112df1ffb57805',
-              Version: '2.0',
-              //IssueInstant: '2014-05-29T03:32:23Z',
-              Destination: 'foo' },
-           'saml:Issuer':
-            [ { _: 'onelogin_saml',
-                '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-           'saml:NameID': [ { _: 'bar', '$': { Format: 'foo' } } ] } };
-
-      var samlObj = new SAML( { entryPoint: "foo" } );
+        "samlp:LogoutRequest": {
+          $: {
+            "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+            //ID: '_85ba0a112df1ffb57805',
+            Version: "2.0",
+            //IssueInstant: '2014-05-29T03:32:23Z',
+            Destination: "foo",
+          },
+          "saml:Issuer": [
+            {
+              _: "onelogin_saml",
+              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+            },
+          ],
+          "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
+        },
+      };
+
+      var samlObj = new SAML({ entryPoint: "foo" });
       var logoutRequestPromise = samlObj.generateLogoutRequest({
         user: {
-          nameIDFormat: 'foo',
-          nameID: 'bar'
-        }
+          nameIDFormat: "foo",
+          nameID: "bar",
+        },
       });
 
-      logoutRequestPromise.then(function(logoutRequest) {
-        parseString( logoutRequest, function( err, doc ) {
+      logoutRequestPromise.then(function (logoutRequest) {
+        parseString(logoutRequest, function (err, doc) {
           try {
-            delete doc['samlp:LogoutRequest']['$']["ID"];
-            delete doc['samlp:LogoutRequest']['$']["IssueInstant"];
-            doc.should.eql( expectedRequest );
+            delete doc["samlp:LogoutRequest"]["$"]["ID"];
+            delete doc["samlp:LogoutRequest"]["$"]["IssueInstant"];
+            doc.should.eql(expectedRequest);
             done();
           } catch (err2) {
             done(err2);
           }
         });
-      })
+      });
     });
 
-    it( 'generateLogoutRequest adds the NameQualifier and SPNameQualifier to the saml request', function( done ) {
+    it("generateLogoutRequest adds the NameQualifier and SPNameQualifier to the saml request", function (done) {
       var expectedRequest = {
-        'samlp:LogoutRequest':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-              //ID: '_85ba0a112df1ffb57805',
-              Version: '2.0',
-              //IssueInstant: '2014-05-29T03:32:23Z',
-              Destination: 'foo' },
-           'saml:Issuer':
-            [ { _: 'onelogin_saml',
-                '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-           'saml:NameID': [ { _: 'bar', '$': { Format: 'foo',
-                                               SPNameQualifier: 'Service Provider',
-                                               NameQualifier: 'Identity Provider' } } ] } };
-
-      var samlObj = new SAML( { entryPoint: "foo" } );
+        "samlp:LogoutRequest": {
+          $: {
+            "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+            //ID: '_85ba0a112df1ffb57805',
+            Version: "2.0",
+            //IssueInstant: '2014-05-29T03:32:23Z',
+            Destination: "foo",
+          },
+          "saml:Issuer": [
+            {
+              _: "onelogin_saml",
+              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+            },
+          ],
+          "saml:NameID": [
+            {
+              _: "bar",
+              $: {
+                Format: "foo",
+                SPNameQualifier: "Service Provider",
+                NameQualifier: "Identity Provider",
+              },
+            },
+          ],
+        },
+      };
+
+      var samlObj = new SAML({ entryPoint: "foo" });
       var logoutRequestPromise = samlObj.generateLogoutRequest({
         user: {
-          nameIDFormat: 'foo',
-          nameID: 'bar',
-          nameQualifier: 'Identity Provider',
-          spNameQualifier: 'Service Provider'
-        }
+          nameIDFormat: "foo",
+          nameID: "bar",
+          nameQualifier: "Identity Provider",
+          spNameQualifier: "Service Provider",
+        },
       });
 
-      logoutRequestPromise.then(function(logoutRequest) {
-        parseString( logoutRequest, function( err, doc ) {
+      logoutRequestPromise.then(function (logoutRequest) {
+        parseString(logoutRequest, function (err, doc) {
           try {
-            delete doc['samlp:LogoutRequest']['$']["ID"];
-            delete doc['samlp:LogoutRequest']['$']["IssueInstant"];
-            doc.should.eql( expectedRequest );
+            delete doc["samlp:LogoutRequest"]["$"]["ID"];
+            delete doc["samlp:LogoutRequest"]["$"]["IssueInstant"];
+            doc.should.eql(expectedRequest);
             done();
           } catch (err2) {
             done(err2);
           }
         });
-      })
+      });
     });
 
-    it( 'generateLogoutResponse', function( done ) {
-      var expectedResponse =  {
-        'samlp:LogoutResponse':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-              //ID: '_d11b3c5e085b2417f4aa',
-              Version: '2.0',
-              //IssueInstant: '2014-05-29T01:11:32Z',
-              Destination: 'foo',
-              InResponseTo: 'quux' },
-           'saml:Issuer': [ 'onelogin_saml' ],
-           'samlp:Status': [ { 'samlp:StatusCode': [ { '$': { Value: 'urn:oasis:names:tc:SAML:2.0:status:Success' } } ] } ] } };
-
-      var samlObj = new SAML( { entryPoint: "foo" } );
+    it("generateLogoutResponse", function (done) {
+      var expectedResponse = {
+        "samlp:LogoutResponse": {
+          $: {
+            "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+            //ID: '_d11b3c5e085b2417f4aa',
+            Version: "2.0",
+            //IssueInstant: '2014-05-29T01:11:32Z',
+            Destination: "foo",
+            InResponseTo: "quux",
+          },
+          "saml:Issuer": ["onelogin_saml"],
+          "samlp:Status": [
+            {
+              "samlp:StatusCode": [
+                { $: { Value: "urn:oasis:names:tc:SAML:2.0:status:Success" } },
+              ],
+            },
+          ],
+        },
+      };
+
+      var samlObj = new SAML({ entryPoint: "foo" });
       var logoutRequest = samlObj.generateLogoutResponse({}, { ID: "quux" });
-      parseString( logoutRequest, function( err, doc ) {
+      parseString(logoutRequest, function (err, doc) {
         try {
-          delete doc['samlp:LogoutResponse']['$']["ID"];
-          delete doc['samlp:LogoutResponse']['$']["IssueInstant"];
-          doc.should.eql( expectedResponse );
+          delete doc["samlp:LogoutResponse"]["$"]["ID"];
+          delete doc["samlp:LogoutResponse"]["$"]["IssueInstant"];
+          doc.should.eql(expectedResponse);
           done();
         } catch (err2) {
           done(err2);
@@ -1278,80 +1517,98 @@ describe( 'passport-saml /', function() {
       });
     });
 
-    it( 'generateLogoutRequest', function( done ) {
+    it("generateLogoutRequest", function (done) {
       var expectedRequest = {
-        'samlp:LogoutRequest':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-              //ID: '_85ba0a112df1ffb57805',
-              Version: '2.0',
-              //IssueInstant: '2014-05-29T03:32:23Z',
-              Destination: 'foo' },
-           'saml:Issuer':
-            [ { _: 'onelogin_saml',
-                '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-           'saml:NameID': [ { _: 'bar', '$': { Format: 'foo' } } ],
-           'saml2p:SessionIndex':
-           [ { _: 'session-id',
-               '$': { 'xmlns:saml2p': 'urn:oasis:names:tc:SAML:2.0:protocol' } } ] } };
-
-      var samlObj = new SAML( { entryPoint: "foo" } );
+        "samlp:LogoutRequest": {
+          $: {
+            "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+            //ID: '_85ba0a112df1ffb57805',
+            Version: "2.0",
+            //IssueInstant: '2014-05-29T03:32:23Z',
+            Destination: "foo",
+          },
+          "saml:Issuer": [
+            {
+              _: "onelogin_saml",
+              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+            },
+          ],
+          "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
+          "saml2p:SessionIndex": [
+            {
+              _: "session-id",
+              $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" },
+            },
+          ],
+        },
+      };
+
+      var samlObj = new SAML({ entryPoint: "foo" });
       var logoutRequestPromise = samlObj.generateLogoutRequest({
         user: {
-          nameIDFormat: 'foo',
-          nameID: 'bar',
-          sessionIndex: 'session-id'
-        }
+          nameIDFormat: "foo",
+          nameID: "bar",
+          sessionIndex: "session-id",
+        },
       });
 
-      logoutRequestPromise.then(function(logoutRequest) {
-        parseString( logoutRequest, function( err, doc ) {
+      logoutRequestPromise.then(function (logoutRequest) {
+        parseString(logoutRequest, function (err, doc) {
           try {
-            delete doc['samlp:LogoutRequest']['$']["ID"];
-            delete doc['samlp:LogoutRequest']['$']["IssueInstant"];
-            doc.should.eql( expectedRequest );
+            delete doc["samlp:LogoutRequest"]["$"]["ID"];
+            delete doc["samlp:LogoutRequest"]["$"]["IssueInstant"];
+            doc.should.eql(expectedRequest);
             done();
           } catch (err2) {
             done(err2);
           }
         });
-      })
+      });
     });
 
-    it( 'generateLogoutRequest saves id and instant to cache', function( done ) {
+    it("generateLogoutRequest saves id and instant to cache", function (done) {
       var expectedRequest = {
-        'samlp:LogoutRequest':
-         { '$':
-            { 'xmlns:samlp': 'urn:oasis:names:tc:SAML:2.0:protocol',
-              'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion',
-              //ID: '_85ba0a112df1ffb57805',
-              Version: '2.0',
-              //IssueInstant: '2014-05-29T03:32:23Z',
-              Destination: 'foo' },
-           'saml:Issuer':
-            [ { _: 'onelogin_saml',
-                '$': { 'xmlns:saml': 'urn:oasis:names:tc:SAML:2.0:assertion' } } ],
-           'saml:NameID': [ { _: 'bar', '$': { Format: 'foo' } } ],
-           'saml2p:SessionIndex':
-           [ { _: 'session-id',
-               '$': { 'xmlns:saml2p': 'urn:oasis:names:tc:SAML:2.0:protocol' } } ] } };
-
-      var samlObj = new SAML( { entryPoint: "foo" } );
-      var cacheSaveSpy = sinon.spy(samlObj.cacheProvider, 'save')
+        "samlp:LogoutRequest": {
+          $: {
+            "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
+            "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
+            //ID: '_85ba0a112df1ffb57805',
+            Version: "2.0",
+            //IssueInstant: '2014-05-29T03:32:23Z',
+            Destination: "foo",
+          },
+          "saml:Issuer": [
+            {
+              _: "onelogin_saml",
+              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
+            },
+          ],
+          "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
+          "saml2p:SessionIndex": [
+            {
+              _: "session-id",
+              $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" },
+            },
+          ],
+        },
+      };
+
+      var samlObj = new SAML({ entryPoint: "foo" });
+      var cacheSaveSpy = sinon.spy(samlObj.cacheProvider, "save");
       var logoutRequestPromise = samlObj.generateLogoutRequest({
         user: {
-          nameIDFormat: 'foo',
-          nameID: 'bar',
-          sessionIndex: 'session-id'
-        }
+          nameIDFormat: "foo",
+          nameID: "bar",
+          sessionIndex: "session-id",
+        },
       });
 
-      logoutRequestPromise.then(function(logoutRequest) {
-        parseString( logoutRequest, function( err, doc ) {
+      logoutRequestPromise.then(function (logoutRequest) {
+        parseString(logoutRequest, function (err, doc) {
           try {
-            var id = doc['samlp:LogoutRequest']['$']["ID"];
-            var issueInstant = doc['samlp:LogoutRequest']['$']["IssueInstant"];
+            var id = doc["samlp:LogoutRequest"]["$"]["ID"];
+            var issueInstant = doc["samlp:LogoutRequest"]["$"]["IssueInstant"];
 
             id.should.be.an.instanceOf(String);
             issueInstant.should.be.an.instanceOf(String);
@@ -1362,206 +1619,284 @@ describe( 'passport-saml /', function() {
             done(err2);
           }
         });
-      })
+      });
     });
 
-    describe( 'generateServiceProviderMetadata tests /', function() {
-      function testMetadata( samlConfig, expectedMetadata, signingCert ) {
-        var samlObj = new SAML( samlConfig );
-        var decryptionCert = fs.readFileSync(__dirname + '/static/testshib encryption cert.pem', 'utf-8');
-        var metadata = samlObj.generateServiceProviderMetadata( decryptionCert, signingCert );
+    describe("generateServiceProviderMetadata tests /", function () {
+      function testMetadata(samlConfig, expectedMetadata, signingCert) {
+        var samlObj = new SAML(samlConfig);
+        var decryptionCert = fs.readFileSync(
+          __dirname + "/static/testshib encryption cert.pem",
+          "utf-8"
+        );
+        var metadata = samlObj.generateServiceProviderMetadata(
+          decryptionCert,
+          signingCert
+        );
         // splits are to get a nice diff if they don't match for some reason
-        metadata.split( '\n' ).should.eql( expectedMetadata.split( '\n' ) );
+        metadata.split("\n").should.eql(expectedMetadata.split("\n"));
 
         // verify that we are exposed through Strategy as well
-        var strategy = new SamlStrategy( samlConfig, function() {} );
-        metadata = strategy.generateServiceProviderMetadata( decryptionCert, signingCert );
-        metadata.split( '\n' ).should.eql( expectedMetadata.split( '\n' ) );
+        var strategy = new SamlStrategy(samlConfig, function () {});
+        metadata = strategy.generateServiceProviderMetadata(
+          decryptionCert,
+          signingCert
+        );
+        metadata.split("\n").should.eql(expectedMetadata.split("\n"));
       }
 
-      it( 'config with callbackUrl and decryptionPvk should pass', function() {
+      it("config with callbackUrl and decryptionPvk should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          callbackUrl: 'http://example.serviceprovider.com/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem')
+          issuer: "http://example.serviceprovider.com",
+          callbackUrl: "http://example.serviceprovider.com/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expected metadata.xml', 'utf-8');
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expected metadata.xml",
+          "utf-8"
+        );
 
-        testMetadata( samlConfig, expectedMetadata );
+        testMetadata(samlConfig, expectedMetadata);
       });
 
-      it( 'config with callbackUrl should pass', function() {
+      it("config with callbackUrl should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          callbackUrl: 'http://example.serviceprovider.com/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
+          issuer: "http://example.serviceprovider.com",
+          callbackUrl: "http://example.serviceprovider.com/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expected metadata without key.xml', 'utf-8');
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expected metadata without key.xml",
+          "utf-8"
+        );
 
-        testMetadata( samlConfig, expectedMetadata );
+        testMetadata(samlConfig, expectedMetadata);
       });
 
-      it( 'config with protocol, path, host, and decryptionPvk should pass', function() {
+      it("config with protocol, path, host, and decryptionPvk should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          protocol: 'http://',
-          host: 'example.serviceprovider.com',
-          path: '/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem')
+          issuer: "http://example.serviceprovider.com",
+          protocol: "http://",
+          host: "example.serviceprovider.com",
+          path: "/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expected metadata.xml', 'utf-8');
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expected metadata.xml",
+          "utf-8"
+        );
 
-        testMetadata( samlConfig, expectedMetadata );
+        testMetadata(samlConfig, expectedMetadata);
       });
 
-      it( 'config with protocol, path, and host should pass', function() {
+      it("config with protocol, path, and host should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          protocol: 'http://',
-          host: 'example.serviceprovider.com',
-          path: '/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
+          issuer: "http://example.serviceprovider.com",
+          protocol: "http://",
+          host: "example.serviceprovider.com",
+          path: "/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expected metadata without key.xml', 'utf-8');
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expected metadata without key.xml",
+          "utf-8"
+        );
 
-        testMetadata( samlConfig, expectedMetadata );
+        testMetadata(samlConfig, expectedMetadata);
       });
 
-      it( 'config with protocol, path, host, decryptionPvk and privateCert should pass', function() {
+      it("config with protocol, path, host, decryptionPvk and privateCert should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          protocol: 'http://',
-          host: 'example.serviceprovider.com',
-          path: '/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem'),
-          privateCert: fs.readFileSync(__dirname + '/static/acme_tools_com.key')
+          issuer: "http://example.serviceprovider.com",
+          protocol: "http://",
+          host: "example.serviceprovider.com",
+          path: "/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
+          privateCert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key"
+          ),
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expectedMetadataWithBothKeys.xml', 'utf-8');
-        var signingCert = fs.readFileSync(__dirname + '/static/acme_tools_com.cert').toString();
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expectedMetadataWithBothKeys.xml",
+          "utf-8"
+        );
+        var signingCert = fs
+          .readFileSync(__dirname + "/static/acme_tools_com.cert")
+          .toString();
 
-        testMetadata( samlConfig, expectedMetadata, signingCert );
+        testMetadata(samlConfig, expectedMetadata, signingCert);
       });
 
-      it( 'config with protocol, path, host, decryptionPvk and privateKey should pass', function() {
+      it("config with protocol, path, host, decryptionPvk and privateKey should pass", function () {
         var samlConfig = {
-          issuer: 'http://example.serviceprovider.com',
-          protocol: 'http://',
-          host: 'example.serviceprovider.com',
-          path: '/saml/callback',
-          identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-          decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem'),
-          privateKey: fs.readFileSync(__dirname + '/static/acme_tools_com.key')
+          issuer: "http://example.serviceprovider.com",
+          protocol: "http://",
+          host: "example.serviceprovider.com",
+          path: "/saml/callback",
+          identifierFormat:
+            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(
+            __dirname + "/static/testshib encryption pvk.pem"
+          ),
+          privateKey: fs.readFileSync(__dirname + "/static/acme_tools_com.key"),
         };
-        var expectedMetadata = fs.readFileSync(__dirname + '/static/expectedMetadataWithBothKeys.xml', 'utf-8');
-        var signingCert = fs.readFileSync(__dirname + '/static/acme_tools_com.cert').toString();
+        var expectedMetadata = fs.readFileSync(
+          __dirname + "/static/expectedMetadataWithBothKeys.xml",
+          "utf-8"
+        );
+        var signingCert = fs
+          .readFileSync(__dirname + "/static/acme_tools_com.cert")
+          .toString();
 
-        testMetadata( samlConfig, expectedMetadata, signingCert );
+        testMetadata(samlConfig, expectedMetadata, signingCert);
       });
+    });
 
-  });
-
-    it('generateServiceProviderMetadata contains logout callback url', function () {
+    it("generateServiceProviderMetadata contains logout callback url", function () {
       var samlConfig = {
-        issuer: 'http://example.serviceprovider.com',
-        callbackUrl: 'http://example.serviceprovider.com/saml/callback',
-        identifierFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-        decryptionPvk: fs.readFileSync(__dirname + '/static/testshib encryption pvk.pem'),
-        logoutCallbackUrl: 'http://example.serviceprovider.com/logout'
+        issuer: "http://example.serviceprovider.com",
+        callbackUrl: "http://example.serviceprovider.com/saml/callback",
+        identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+        decryptionPvk: fs.readFileSync(
+          __dirname + "/static/testshib encryption pvk.pem"
+        ),
+        logoutCallbackUrl: "http://example.serviceprovider.com/logout",
       };
 
       var samlObj = new SAML(samlConfig);
-      var decryptionCert = fs.readFileSync(__dirname + '/static/testshib encryption cert.pem', 'utf-8');
+      var decryptionCert = fs.readFileSync(
+        __dirname + "/static/testshib encryption cert.pem",
+        "utf-8"
+      );
       var metadata = samlObj.generateServiceProviderMetadata(decryptionCert);
-      metadata.should.containEql('SingleLogoutService');
+      metadata.should.containEql("SingleLogoutService");
       metadata.should.containEql(samlConfig.logoutCallbackUrl);
     });
 
-    it('#certToPEM should generate valid certificate', function(done){
+    it("#certToPEM should generate valid certificate", function (done) {
       var samlConfig = {
-        entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-        cert: '-----BEGIN CERTIFICATE-----'+TEST_CERT+'-----END CERTIFICATE-----',
-        acceptedClockSkewMs: -1
+        entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+        cert:
+          "-----BEGIN CERTIFICATE-----" +
+          TEST_CERT +
+          "-----END CERTIFICATE-----",
+        acceptedClockSkewMs: -1,
       };
-      var samlObj = new SAML( samlConfig );
+      var samlObj = new SAML(samlConfig);
       var certificate = samlObj.certToPEM(samlConfig.cert);
 
-      if (certificate.match(/BEGIN/g).length == 1
-        && certificate.match(/END/g).length == 1){
+      if (
+        certificate.match(/BEGIN/g).length == 1 &&
+        certificate.match(/END/g).length == 1
+      ) {
         done();
       } else {
-        done('Certificate should have only 1 BEGIN and 1 END block');
+        done("Certificate should have only 1 BEGIN and 1 END block");
       }
     });
 
-    describe("validatePostResponse checks /", function() {
-      it('response with junk content should explain the XML or base64 is not valid', function(done) {
-        var samlObj = new SAML( { cert: TEST_CERT });
-        samlObj.validatePostResponse({SAMLResponse: "BOOM"} , function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( /SAMLResponse is not valid base64-encoded XML/ );
-            done();
-          } catch (err2) {
-            done(err2);
+    describe("validatePostResponse checks /", function () {
+      it("response with junk content should explain the XML or base64 is not valid", function (done) {
+        var samlObj = new SAML({ cert: TEST_CERT });
+        samlObj.validatePostResponse(
+          { SAMLResponse: "BOOM" },
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(
+                /SAMLResponse is not valid base64-encoded XML/
+              );
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('response with error status message should generate appropriate error', function(done) {
-        var xml = '<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost/browserSamlLogin" ID="_6a377272c8662561acf1056274ef3f81" InResponseTo="_4324fb0d00661146f7dc" IssueInstant="2014-07-02T18:16:31.278Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp.testshib.org/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></saml2p:StatusCode><saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage></saml2p:Status></saml2p:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("response with error status message should generate appropriate error", function (done) {
+        var xml =
+          '<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost/browserSamlLogin" ID="_6a377272c8662561acf1056274ef3f81" InResponseTo="_4324fb0d00661146f7dc" IssueInstant="2014-07-02T18:16:31.278Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp.testshib.org/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></saml2p:StatusCode><saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage></saml2p:Status></saml2p:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( {
-        cert: '-----BEGIN CERTIFICATE-----'+TEST_CERT+'-----END CERTIFICATE-----',
-        });
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( /Responder/ );
-            err.message.should.match( /Required NameID format not supported/ );
-            should.exist( err.statusXml );
-            done();
-          } catch (err2) {
-            done(err2);
+        var samlObj = new SAML({
+          cert:
+            "-----BEGIN CERTIFICATE-----" +
+            TEST_CERT +
+            "-----END CERTIFICATE-----",
+        });
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Responder/);
+              err.message.should.match(/Required NameID format not supported/);
+              should.exist(err.statusXml);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it('response with error status code should generate appropriate error', function(done) {
-        var xml = '<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost/browserSamlLogin" ID="_6a377272c8662561acf1056274ef3f81" InResponseTo="_4324fb0d00661146f7dc" IssueInstant="2014-07-02T18:16:31.278Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp.testshib.org/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></saml2p:StatusCode></saml2p:Status></saml2p:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("response with error status code should generate appropriate error", function (done) {
+        var xml =
+          '<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost/browserSamlLogin" ID="_6a377272c8662561acf1056274ef3f81" InResponseTo="_4324fb0d00661146f7dc" IssueInstant="2014-07-02T18:16:31.278Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp.testshib.org/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/></saml2p:StatusCode></saml2p:Status></saml2p:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( {} );
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( /Responder/ );
-            err.message.should.match( /InvalidNameIDPolicy/ );
-            should.exist( err.statusXml );
-            done();
-          } catch (err2) {
-            done(err2);
+        var samlObj = new SAML({});
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Responder/);
+              err.message.should.match(/InvalidNameIDPolicy/);
+              should.exist(err.statusXml);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it('accept response with an attributeStatement element without attributeValue', function(done) {
-        var fakeClock = sinon.useFakeTimers(Date.parse('2015-08-31T08:55:00+00:00'));
+      it("accept response with an attributeStatement element without attributeValue", function (done) {
+        var fakeClock = sinon.useFakeTimers(
+          Date.parse("2015-08-31T08:55:00+00:00")
+        );
         var container = {
-            SAMLResponse : fs.readFileSync(
-                __dirname + '/static/response-with-uncomplete-attribute.xml'
-            ).toString('base64')
+          SAMLResponse: fs
+            .readFileSync(
+              __dirname + "/static/response-with-uncomplete-attribute.xml"
+            )
+            .toString("base64"),
         };
         var samlObj = new SAML();
 
-        samlObj.validatePostResponse(container, function(err, profile) {
+        samlObj.validatePostResponse(container, function (err, profile) {
           try {
             should.not.exist(err);
             profile.issuer.should.eql("https://evil-corp.com");
             profile.nameID.should.eql("vincent.vega@evil-corp.com");
-            should(profile).have.property("evil-corp.egroupid").eql("vincent.vega@evil-corp.com");
+            should(profile)
+              .have.property("evil-corp.egroupid")
+              .eql("vincent.vega@evil-corp.com");
             // attributes without attributeValue child should be ignored
             should(profile).not.have.property("evilcorp.roles");
 
@@ -1574,470 +1909,625 @@ describe( 'passport-saml /', function() {
         });
       });
 
-      it('removes InResponseTo value if response validation fails', function(done) {
-        var requestId = '_a6fc46be84e1e3cf3c50';
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-        '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-        '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("removes InResponseTo value if response validation fails", function (done) {
+        var requestId = "_a6fc46be84e1e3cf3c50";
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
-          validateInResponseTo: true
+          validateInResponseTo: true,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist(err);
-            err.message.should.match("Invalid signature");
-          } catch (err2) {
-            done(err2);
-          }
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
             try {
               should.exist(err);
-              err.message.should.match("InResponseTo is not valid");
-              done();
+              err.message.should.match("Invalid signature");
             } catch (err2) {
               done(err2);
             }
-          });
-        });
+            samlObj.validatePostResponse(
+              container,
+              function (err, profile, logout) {
+                try {
+                  should.exist(err);
+                  err.message.should.match("InResponseTo is not valid");
+                  done();
+                } catch (err2) {
+                  done(err2);
+                }
+              }
+            );
+          }
+        );
       });
 
-      describe( 'validatePostResponse xml signature checks /', function() {
-
+      describe("validatePostResponse xml signature checks /", function () {
         var fakeClock;
-        beforeEach(function(){
-            fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+        beforeEach(function () {
+          fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
         });
-        afterEach(function(){
-            fakeClock.restore();
+        afterEach(function () {
+          fakeClock.restore();
         });
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
         };
-        it( 'valid onelogin xml document should validate', function( done ) {
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+        it("valid onelogin xml document should validate", function (done) {
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( samlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.not.exist( err );
-              profile.nameID.should.startWith( 'ploer' );
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(samlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.not.exist(err);
+                profile.nameID.should.startWith("ploer");
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'onelogin xml document with altered assertion should fail', function( done ) {
-         var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+        it("onelogin xml document with altered assertion should fail", function (done) {
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( samlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.exist( err );
-              err.message.should.match(/Invalid signature/);
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(samlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.exist(err);
+                err.message.should.match(/Invalid signature/);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
+        });
+
+        it("onelogin xml document with duplicate altered assertion should fail", function (done) {
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
+          var container = { SAMLResponse: base64xml };
+          var samlObj = new SAML(samlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.exist(err);
+                err.message.should.match(/Invalid signature/);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
+            }
+          );
         });
 
-        it( 'onelogin xml document with duplicate altered assertion should fail', function( done ) {
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+        it("onelogin xml document with extra unsigned & altered assertion should fail", function (done) {
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efab" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( samlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.exist( err );
-              err.message.should.match(/Invalid signature/);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
-          });
-        });
-
-        it( 'onelogin xml document with extra unsigned & altered assertion should fail', function( done ) {
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efab" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ben@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
-          var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( samlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.exist( err );
-              err.message.should.match(/Invalid signature/);
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(samlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.exist(err);
+                err.message.should.match(/Invalid signature/);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
-        });
-
-        it( 'onelogin xml document with extra nexted assertion should fail', function( done ) {
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo>' +
-              '<ds:Object>' +
-                '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-              '</ds:Object>' +
+          );
+        });
+
+        it("onelogin xml document with extra nexted assertion should fail", function (done) {
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            "</ds:X509Certificate></ds:X509Data></ds:KeyInfo>" +
+            "<ds:Object>" +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</ds:Object>" +
             '</ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( samlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.exist( err );
-              err.message.should.match(/Invalid signature/);
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(samlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.exist(err);
+                err.message.should.match(/Invalid signature/);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'multiple certs should validate with one of the certs', function( done ) {
+        it("multiple certs should validate with one of the certs", function (done) {
           var multiCertSamlConfig = {
             entryPoint: samlConfig.entryPoint,
-            cert: [
-              ALT_TEST_CERT,
-              samlConfig.cert
-            ]
+            cert: [ALT_TEST_CERT, samlConfig.cert],
           };
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' + TEST_CERT + '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( multiCertSamlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.not.exist( err );
-              profile.nameID.should.startWith( 'ploer' );
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(multiCertSamlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.not.exist(err);
+                profile.nameID.should.startWith("ploer");
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'cert as a function should validate with the returned cert', function( done ) {
+        it("cert as a function should validate with the returned cert", function (done) {
           var functionCertSamlConfig = {
             entryPoint: samlConfig.entryPoint,
-            cert: function (callback) { callback(null, samlConfig.cert); }
+            cert: function (callback) {
+              callback(null, samlConfig.cert);
+            },
           };
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' + TEST_CERT + '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( functionCertSamlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.not.exist( err );
-              profile.nameID.should.startWith( 'ploer' );
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(functionCertSamlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.not.exist(err);
+                profile.nameID.should.startWith("ploer");
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'cert as a function should validate with one of the returned certs', function( done ) {
+        it("cert as a function should validate with one of the returned certs", function (done) {
           var functionMultiCertSamlConfig = {
             entryPoint: samlConfig.entryPoint,
-            cert: function (callback) { callback(null, [
-                ALT_TEST_CERT,
-                samlConfig.cert
-              ]);
-            }
+            cert: function (callback) {
+              callback(null, [ALT_TEST_CERT, samlConfig.cert]);
+            },
           };
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' + TEST_CERT + '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( functionMultiCertSamlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              should.not.exist( err );
-              profile.nameID.should.startWith( 'ploer' );
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(functionMultiCertSamlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                should.not.exist(err);
+                profile.nameID.should.startWith("ploer");
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'cert as a function should return an error if the cert function returns an error', function( done ) {
-          var errorToReturn = new Error('test');
+        it("cert as a function should return an error if the cert function returns an error", function (done) {
+          var errorToReturn = new Error("test");
           var functionErrorCertSamlConfig = {
             entryPoint: samlConfig.entryPoint,
-            cert: function (callback) { callback(errorToReturn) }
+            cert: function (callback) {
+              callback(errorToReturn);
+            },
           };
-          var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' + TEST_CERT + '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+          var xml =
+            '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+            TEST_CERT +
+            '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+            "</samlp:Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
-          var samlObj = new SAML( functionErrorCertSamlConfig );
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            try {
-              err.should.eql( errorToReturn );
-              done();
-            } catch (err2) {
-              done(err2);
+          var samlObj = new SAML(functionErrorCertSamlConfig);
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              try {
+                err.should.eql(errorToReturn);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
             }
-          });
+          );
         });
 
-        it( 'XML AttributeValue should return object', function( done ) {
-          const nameid_opaque_string = '*******************************'
-          const nameQualifier = 'https://idp.example.org/idp/saml'
-          const spNameQualifier = 'https://sp.example.org/sp/entity'
-          const format = 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
+        it("XML AttributeValue should return object", function (done) {
+          const nameid_opaque_string = "*******************************";
+          const nameQualifier = "https://idp.example.org/idp/saml";
+          const spNameQualifier = "https://sp.example.org/sp/entity";
+          const format = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
           const xml =
-          '<Response>' +
+            "<Response>" +
             '<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0">' +
-              '<saml2:AttributeStatement>' +
-                  '<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">' +
-                      '<saml2:AttributeValue>' +
-                          '<saml2:NameID Format="'+format+'" NameQualifier="'+nameQualifier+'" SPNameQualifier="'+spNameQualifier+'">' +
-                          nameid_opaque_string +
-                          '</saml2:NameID>' +
-                      '</saml2:AttributeValue>' +
-                  '</saml2:Attribute>' +
-              '</saml2:AttributeStatement>' +
-            '</saml2:Assertion>' +
-          '</Response>';
-          var base64xml = Buffer.from( xml ).toString('base64');
+            "<saml2:AttributeStatement>" +
+            '<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">' +
+            "<saml2:AttributeValue>" +
+            '<saml2:NameID Format="' +
+            format +
+            '" NameQualifier="' +
+            nameQualifier +
+            '" SPNameQualifier="' +
+            spNameQualifier +
+            '">' +
+            nameid_opaque_string +
+            "</saml2:NameID>" +
+            "</saml2:AttributeValue>" +
+            "</saml2:Attribute>" +
+            "</saml2:AttributeStatement>" +
+            "</saml2:Assertion>" +
+            "</Response>";
+          var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML();
-          samlObj.validatePostResponse( container, function( err, profile, logout ) {
-            should.not.exist( err );
-            const eptid = profile['urn:oid:1.3.6.1.4.1.5923.1.1.1.10'];
-            const nameid = eptid['NameID'][0]
-            nameid._.should.eql(nameid_opaque_string)
-            nameid.$.NameQualifier.should.equal(nameQualifier)
-            nameid.$.SPNameQualifier.should.equal(spNameQualifier)
-            nameid.$.Format.should.equal(format)
-            done();
-          });
+          samlObj.validatePostResponse(
+            container,
+            function (err, profile, logout) {
+              should.not.exist(err);
+              const eptid = profile["urn:oid:1.3.6.1.4.1.5923.1.1.1.10"];
+              const nameid = eptid["NameID"][0];
+              nameid._.should.eql(nameid_opaque_string);
+              nameid.$.NameQualifier.should.equal(nameQualifier);
+              nameid.$.SPNameQualifier.should.equal(spNameQualifier);
+              nameid.$.Format.should.equal(format);
+              done();
+            }
+          );
         });
       });
 
-      it( 'An undefined value given with an object should still be undefined', function( done ) {
+      it("An undefined value given with an object should still be undefined", function (done) {
         const xml =
-        '<Response>' +
+          "<Response>" +
           '<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0">' +
-            '<saml2:AttributeStatement>' +
-              '<saml2:Attribute Name="attributeName" ' +
-                  'NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">' +
-                '<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" ' +
-                  'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ' +
-                  'xsi:type="xs:string"/>' +
-              '</saml2:Attribute>' +
-            '</saml2:AttributeStatement>' +
-          '</saml2:Assertion>' +
-        '</Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+          "<saml2:AttributeStatement>" +
+          '<saml2:Attribute Name="attributeName" ' +
+          'NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">' +
+          '<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" ' +
+          'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ' +
+          'xsi:type="xs:string"/>' +
+          "</saml2:Attribute>" +
+          "</saml2:AttributeStatement>" +
+          "</saml2:Assertion>" +
+          "</Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlObj = new SAML();
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          should.not.exist( err );
-          should(profile['attributeName']).be.undefined();
-          done();
-        });
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            should.not.exist(err);
+            should(profile["attributeName"]).be.undefined();
+            done();
+          }
+        );
       });
     });
 
-    describe( 'getAuthorizeUrl request signature checks /', function() {
+    describe("getAuthorizeUrl request signature checks /", function () {
       var fakeClock;
-      beforeEach(function(){
-          fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+      beforeEach(function () {
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
       });
-      afterEach(function(){
-          fakeClock.restore();
+      afterEach(function () {
+        fakeClock.restore();
       });
 
-      it( 'acme_tools request signed with sha256', function( done ) {
+      it("acme_tools request signed with sha256", function (done) {
         var samlConfig = {
-          entryPoint: 'https://adfs.acme_tools.com/adfs/ls/',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateCert: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
+          entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateCert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
-          signatureAlgorithm: 'sha256',
+          signatureAlgorithm: "sha256",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
-        samlObj.getAuthorizeUrl({}, {}, function(err, url) {
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
+        };
+        samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require('querystring').parse(require('url').parse(url).query);
-            qry.SigAlg.should.match('http://www.w3.org/2001/04/xmldsig-more#rsa-sha256');
-            qry.Signature.should.match('hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA==');
-            qry.customQueryStringParam.should.match('CustomQueryStringParamValue');
+            var qry = require("querystring").parse(
+              require("url").parse(url).query
+            );
+            qry.SigAlg.should.match(
+              "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
+            );
+            qry.Signature.should.match(
+              "hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA=="
+            );
+            qry.customQueryStringParam.should.match(
+              "CustomQueryStringParamValue"
+            );
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it( 'acme_tools request signed with sha256 when using privateKey', function( done ) {
+      it("acme_tools request signed with sha256 when using privateKey", function (done) {
         var samlConfig = {
-          entryPoint: 'https://adfs.acme_tools.com/adfs/ls/',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateKey: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
+          entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateKey: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
-          signatureAlgorithm: 'sha256',
+          signatureAlgorithm: "sha256",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
+        };
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
-        samlObj.getAuthorizeUrl({}, {}, function(err, url) {
+        samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require('querystring').parse(require('url').parse(url).query);
-            qry.SigAlg.should.match('http://www.w3.org/2001/04/xmldsig-more#rsa-sha256');
-            qry.Signature.should.match('hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA==');
-            qry.customQueryStringParam.should.match('CustomQueryStringParamValue');
+            var qry = require("querystring").parse(
+              require("url").parse(url).query
+            );
+            qry.SigAlg.should.match(
+              "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
+            );
+            qry.Signature.should.match(
+              "hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA=="
+            );
+            qry.customQueryStringParam.should.match(
+              "CustomQueryStringParamValue"
+            );
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it( 'acme_tools request not signed if missing entry point', function( done ) {
+      it("acme_tools request not signed if missing entry point", function (done) {
         var samlConfig = {
-          entryPoint: '',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateCert: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
-          signatureAlgorithm: 'sha256',
+          entryPoint: "",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateCert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
+          signatureAlgorithm: "sha256",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
+        };
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
 
-        var request = '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
-        samlObj.requestToUrl(request, null, 'authorize', {}, function(err) {
+        var request =
+          '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
+        samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
           try {
             should.exist(err);
-            err.message.should.eql('"entryPoint" config parameter is required for signed messages');
+            err.message.should.eql(
+              '"entryPoint" config parameter is required for signed messages'
+            );
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it( 'acme_tools request not signed if missing entry point when using privateKey', function( done ) {
+      it("acme_tools request not signed if missing entry point when using privateKey", function (done) {
         var samlConfig = {
-          entryPoint: '',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateKey: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
-          signatureAlgorithm: 'sha256',
+          entryPoint: "",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateKey: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
+          signatureAlgorithm: "sha256",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
+        };
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
 
-        var request = '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
-        samlObj.requestToUrl(request, null, 'authorize', {}, function(err) {
+        var request =
+          '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
+        samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
           try {
             should.exist(err);
-            err.message.should.eql('"entryPoint" config parameter is required for signed messages');
+            err.message.should.eql(
+              '"entryPoint" config parameter is required for signed messages'
+            );
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it( 'acme_tools request signed with sha1', function( done ) {
+      it("acme_tools request signed with sha1", function (done) {
         var samlConfig = {
-          entryPoint: 'https://adfs.acme_tools.com/adfs/ls/',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateCert: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
+          entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateCert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
-          signatureAlgorithm: 'sha1',
+          signatureAlgorithm: "sha1",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
-        samlObj.getAuthorizeUrl({}, {}, function(err, url) {
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
+        };
+        samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require('querystring').parse(require('url').parse(url).query);
-            qry.SigAlg.should.match('http://www.w3.org/2000/09/xmldsig#rsa-sha1');
-            qry.Signature.should.match('MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q==');
-            qry.customQueryStringParam.should.match('CustomQueryStringParamValue');
+            var qry = require("querystring").parse(
+              require("url").parse(url).query
+            );
+            qry.SigAlg.should.match(
+              "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+            );
+            qry.Signature.should.match(
+              "MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q=="
+            );
+            qry.customQueryStringParam.should.match(
+              "CustomQueryStringParamValue"
+            );
             done();
           } catch (err2) {
             done(err2);
           }
         });
       });
-      it( 'acme_tools request signed with sha1 when using privateKey', function( done ) {
+      it("acme_tools request signed with sha1 when using privateKey", function (done) {
         var samlConfig = {
-          entryPoint: 'https://adfs.acme_tools.com/adfs/ls/',
-          issuer: 'acme_tools_com',
-          callbackUrl: 'https://relyingparty/adfs/postResponse',
-          privateKey: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'utf-8'),
-          authnContext: 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password',
+          entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
+          issuer: "acme_tools_com",
+          callbackUrl: "https://relyingparty/adfs/postResponse",
+          privateKey: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.key",
+            "utf-8"
+          ),
+          authnContext:
+            "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
-          signatureAlgorithm: 'sha1',
+          signatureAlgorithm: "sha1",
           additionalParams: {
-            customQueryStringParam: 'CustomQueryStringParamValue'
-          }
+            customQueryStringParam: "CustomQueryStringParamValue",
+          },
+        };
+        var samlObj = new SAML(samlConfig);
+        samlObj.generateUniqueID = function () {
+          return "12345678901234567890";
         };
-        var samlObj = new SAML( samlConfig );
-        samlObj.generateUniqueID = function () { return '12345678901234567890' };
-        samlObj.getAuthorizeUrl({}, {}, function(err, url) {
+        samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require('querystring').parse(require('url').parse(url).query);
-            qry.SigAlg.should.match('http://www.w3.org/2000/09/xmldsig#rsa-sha1');
-            qry.Signature.should.match('MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q==');
-            qry.customQueryStringParam.should.match('CustomQueryStringParamValue');
+            var qry = require("querystring").parse(
+              require("url").parse(url).query
+            );
+            qry.SigAlg.should.match(
+              "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+            );
+            qry.Signature.should.match(
+              "MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q=="
+            );
+            qry.customQueryStringParam.should.match(
+              "CustomQueryStringParamValue"
+            );
             done();
           } catch (err2) {
             done(err2);
@@ -2046,480 +2536,629 @@ describe( 'passport-saml /', function() {
       });
     });
 
-    describe( 'getAdditionalParams checks /', function() {
-      it ( 'should not pass any additional params by default', function() {
+    describe("getAdditionalParams checks /", function () {
+      it("should not pass any additional params by default", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        ['logout', 'authorize'].forEach( function( operation ) {
+        ["logout", "authorize"].forEach(function (operation) {
           var additionalParams = samlObj.getAdditionalParams({}, operation);
-          additionalParams.should.be.empty
+          additionalParams.should.be.empty;
         });
       });
 
-      it ( 'should not pass any additional params by default apart from the RelayState in request query', function() {
+      it("should not pass any additional params by default apart from the RelayState in request query", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        ['logout', 'authorize'].forEach( function( operation ) {
-          var additionalParams = samlObj.getAdditionalParams({query:{RelayState: "test"}}, operation);
+        ["logout", "authorize"].forEach(function (operation) {
+          var additionalParams = samlObj.getAdditionalParams(
+            { query: { RelayState: "test" } },
+            operation
+          );
 
           Object.keys(additionalParams).should.have.length(1);
-          additionalParams.should.containEql({'RelayState': 'test'});
+          additionalParams.should.containEql({ RelayState: "test" });
         });
       });
 
-      it ( 'should not pass any additional params by default apart from the RelayState in request body', function() {
+      it("should not pass any additional params by default apart from the RelayState in request body", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        ['logout', 'authorize'].forEach( function( operation ) {
-          var additionalParams = samlObj.getAdditionalParams({body:{RelayState: "test"}}, operation);
+        ["logout", "authorize"].forEach(function (operation) {
+          var additionalParams = samlObj.getAdditionalParams(
+            { body: { RelayState: "test" } },
+            operation
+          );
 
           Object.keys(additionalParams).should.have.length(1);
-          additionalParams.should.containEql({'RelayState': 'test'});
+          additionalParams.should.containEql({ RelayState: "test" });
         });
       });
 
-      it ( 'should pass additional params with all operations if set in additionalParams', function() {
+      it("should pass additional params with all operations if set in additionalParams", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
-            'queryParam': 'queryParamValue'
-          }
+            queryParam: "queryParamValue",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        ['logout', 'authorize'].forEach( function( operation ) {
+        ["logout", "authorize"].forEach(function (operation) {
           var additionalParams = samlObj.getAdditionalParams({}, operation);
           Object.keys(additionalParams).should.have.length(1);
-          additionalParams.should.containEql({'queryParam': 'queryParamValue'});
+          additionalParams.should.containEql({ queryParam: "queryParamValue" });
         });
       });
 
-      it ( 'should pass additional params with "authorize" operations if set in additionalAuthorizeParams', function() {
+      it('should pass additional params with "authorize" operations if set in additionalAuthorizeParams', function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalAuthorizeParams: {
-            'queryParam': 'queryParamValue'
-          }
+            queryParam: "queryParamValue",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize');
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize"
+        );
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({'queryParam': 'queryParamValue'});
+        additionalAuthorizeParams.should.containEql({
+          queryParam: "queryParamValue",
+        });
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout');
+        var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         additionalLogoutParams.should.be.empty;
       });
 
-      it ( 'should pass additional params with "logout" operations if set in additionalLogoutParams', function() {
+      it('should pass additional params with "logout" operations if set in additionalLogoutParams', function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalLogoutParams: {
-            'queryParam': 'queryParamValue'
-          }
+            queryParam: "queryParamValue",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize');
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize"
+        );
         additionalAuthorizeParams.should.be.empty;
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout');
+        var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({'queryParam': 'queryParamValue'});
+        additionalLogoutParams.should.containEql({
+          queryParam: "queryParamValue",
+        });
       });
 
-      it ( 'should merge additionalLogoutParams and additionalAuthorizeParams with additionalParams', function() {
+      it("should merge additionalLogoutParams and additionalAuthorizeParams with additionalParams", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
-            'queryParam1': 'queryParamValue'
+            queryParam1: "queryParamValue",
           },
           additionalAuthorizeParams: {
-            'queryParam2': 'queryParamValueAuthorize'
+            queryParam2: "queryParamValueAuthorize",
           },
           additionalLogoutParams: {
-            'queryParam2': 'queryParamValueLogout'
-          }
+            queryParam2: "queryParamValueLogout",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize');
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize"
+        );
         Object.keys(additionalAuthorizeParams).should.have.length(2);
-        additionalAuthorizeParams.should.containEql({'queryParam1': 'queryParamValue', 'queryParam2': 'queryParamValueAuthorize'});
+        additionalAuthorizeParams.should.containEql({
+          queryParam1: "queryParamValue",
+          queryParam2: "queryParamValueAuthorize",
+        });
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout');
+        var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         Object.keys(additionalLogoutParams).should.have.length(2);
-        additionalLogoutParams.should.containEql({'queryParam1': 'queryParamValue', 'queryParam2': 'queryParamValueLogout'});
+        additionalLogoutParams.should.containEql({
+          queryParam1: "queryParamValue",
+          queryParam2: "queryParamValueLogout",
+        });
       });
 
-      it ( 'should merge run-time params additionalLogoutParams and additionalAuthorizeParams with additionalParams', function() {
+      it("should merge run-time params additionalLogoutParams and additionalAuthorizeParams with additionalParams", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
-            'queryParam1': 'queryParamValue'
+            queryParam1: "queryParamValue",
           },
           additionalAuthorizeParams: {
-            'queryParam2': 'queryParamValueAuthorize'
+            queryParam2: "queryParamValueAuthorize",
           },
           additionalLogoutParams: {
-            'queryParam2': 'queryParamValueLogout'
-          }
+            queryParam2: "queryParamValueLogout",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
         var options = {
           additionalParams: {
-            queryParam3: 'queryParamRuntimeValue'
-          }
+            queryParam3: "queryParamRuntimeValue",
+          },
         };
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize', options.additionalParams);
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize",
+          options.additionalParams
+        );
         Object.keys(additionalAuthorizeParams).should.have.length(3);
-        additionalAuthorizeParams.should.containEql({'queryParam1': 'queryParamValue',
-          'queryParam2': 'queryParamValueAuthorize',
-          'queryParam3': 'queryParamRuntimeValue'});
+        additionalAuthorizeParams.should.containEql({
+          queryParam1: "queryParamValue",
+          queryParam2: "queryParamValueAuthorize",
+          queryParam3: "queryParamRuntimeValue",
+        });
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout', options.additionalParams);
+        var additionalLogoutParams = samlObj.getAdditionalParams(
+          {},
+          "logout",
+          options.additionalParams
+        );
         Object.keys(additionalLogoutParams).should.have.length(3);
-        additionalLogoutParams.should.containEql({'queryParam1': 'queryParamValue',
-          'queryParam2': 'queryParamValueLogout',
-          'queryParam3': 'queryParamRuntimeValue'});
+        additionalLogoutParams.should.containEql({
+          queryParam1: "queryParamValue",
+          queryParam2: "queryParamValueLogout",
+          queryParam3: "queryParamRuntimeValue",
+        });
       });
 
-      it ( 'should prioritize additionalLogoutParams and additionalAuthorizeParams over additionalParams', function() {
+      it("should prioritize additionalLogoutParams and additionalAuthorizeParams over additionalParams", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
-            'queryParam': 'queryParamValue'
+            queryParam: "queryParamValue",
           },
           additionalAuthorizeParams: {
-            'queryParam': 'queryParamValueAuthorize'
+            queryParam: "queryParamValueAuthorize",
           },
           additionalLogoutParams: {
-            'queryParam': 'queryParamValueLogout'
-          }
+            queryParam: "queryParamValueLogout",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize');
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize"
+        );
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({'queryParam': 'queryParamValueAuthorize'});
+        additionalAuthorizeParams.should.containEql({
+          queryParam: "queryParamValueAuthorize",
+        });
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout');
+        var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({'queryParam': 'queryParamValueLogout'});
+        additionalLogoutParams.should.containEql({
+          queryParam: "queryParamValueLogout",
+        });
       });
 
-      it ( 'should prioritize run-time params over all other params', function() {
+      it("should prioritize run-time params over all other params", function () {
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
-            'queryParam': 'queryParamValue'
+            queryParam: "queryParamValue",
           },
           additionalAuthorizeParams: {
-            'queryParam': 'queryParamValueAuthorize'
+            queryParam: "queryParamValueAuthorize",
           },
           additionalLogoutParams: {
-            'queryParam': 'queryParamValueLogout'
-          }
+            queryParam: "queryParamValueLogout",
+          },
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
         var options = {
           additionalParams: {
-            queryParam: 'queryParamRuntimeValue'
-          }
+            queryParam: "queryParamRuntimeValue",
+          },
         };
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, 'authorize', options.additionalParams);
+        var additionalAuthorizeParams = samlObj.getAdditionalParams(
+          {},
+          "authorize",
+          options.additionalParams
+        );
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({'queryParam': 'queryParamRuntimeValue'});
+        additionalAuthorizeParams.should.containEql({
+          queryParam: "queryParamRuntimeValue",
+        });
 
-        var additionalLogoutParams = samlObj.getAdditionalParams({}, 'logout', options.additionalParams);
+        var additionalLogoutParams = samlObj.getAdditionalParams(
+          {},
+          "logout",
+          options.additionalParams
+        );
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({'queryParam': 'queryParamRuntimeValue'});
+        additionalLogoutParams.should.containEql({
+          queryParam: "queryParamRuntimeValue",
+        });
       });
 
-      it('should check the value of the option `RACComparison`', function() {
-        var samlObjBadComparisonType = new SAML({ RACComparison: 'bad_value' });
-        should.equal(samlObjBadComparisonType.options.RACComparison, 'exact', ['the default value of the option `RACComparison` must be exact']);
+      it("should check the value of the option `RACComparison`", function () {
+        var samlObjBadComparisonType = new SAML({ RACComparison: "bad_value" });
+        should.equal(samlObjBadComparisonType.options.RACComparison, "exact", [
+          "the default value of the option `RACComparison` must be exact",
+        ]);
 
-        var validComparisonTypes = ['exact','minimum','maximum','better'], samlObjValidComparisonType;
-        validComparisonTypes.forEach(function(RACComparison) {
-            samlObjValidComparisonType = new SAML( {RACComparison: RACComparison} );
-            should.equal(samlObjValidComparisonType.options.RACComparison, RACComparison);
+        var validComparisonTypes = ["exact", "minimum", "maximum", "better"],
+          samlObjValidComparisonType;
+        validComparisonTypes.forEach(function (RACComparison) {
+          samlObjValidComparisonType = new SAML({
+            RACComparison: RACComparison,
+          });
+          should.equal(
+            samlObjValidComparisonType.options.RACComparison,
+            RACComparison
+          );
         });
       });
     });
 
-    describe( 'InResponseTo validation checks /', function(){
+    describe("InResponseTo validation checks /", function () {
       var fakeClock = null;
 
-      afterEach(function() {
+      afterEach(function () {
         if (fakeClock) {
           fakeClock.restore();
           fakeClock = null;
         }
       });
 
-      it( 'onelogin xml document with InResponseTo from request should validate', function( done ) {
-        var requestId = '_a6fc46be84e1e3cf3c50';
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with InResponseTo from request should validate", function (done) {
+        var requestId = "_a6fc46be84e1e3cf3c50";
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
-          validateInResponseTo: true
+          validateInResponseTo: true,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
-
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          should.not.exist( err );
-          profile.nameID.should.startWith( 'ploer' );
-          samlObj.cacheProvider.get(requestId, function(err, value){
-            try {
-              should.not.exist(value);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
-          });
-
-        });
-      });
-
-      it( 'onelogin xml document without InResponseTo from request should fail', function( done ) {
-        var requestId = '_a6fc46be84e1e3cf3c50';
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
-        var container = { SAMLResponse: base64xml };
-
-        var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          cert: TEST_CERT,
-          validateInResponseTo: true
-        };
-        var samlObj = new SAML( samlConfig );
-
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'InResponseTo is not valid' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            should.not.exist(err);
+            profile.nameID.should.startWith("ploer");
+            samlObj.cacheProvider.get(requestId, function (err, value) {
+              try {
+                should.not.exist(value);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
+            });
           }
-        });
+        );
       });
 
-      it( 'xml document with SubjectConfirmation InResponseTo from request should be valid', function(done){
-        var requestId = '_dfab47d5d46374cd4b71';
-        var xml = '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" InResponseTo="_dfab47d5d46374cd4b71" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>QecaVjMY/2M4VMJsakvX8uh2Mrg=</DigestValue></Reference></SignedInfo><SignatureValue>QTJ//ZHEQRe9/nA5qTkhECZc2u6M1dHzTkujKBedskLSRPL8LRBb4Yftla0zu848sYvLd3SXzEysYu/jrAjaVDevYZIAdyj/3HCw8pS0ZnQDaCgYuAkH4JmYxBfW1Sc9Kr0vbR58ihwWOZd4xHIn/b8xLs8WNsyTHix2etrLGznioLwTOBO3+SgjwSiSP9NUhrlOvolbuu/6xhLi37/L08JaBvOw3o0k4V8xS87SFczhm4f6wvQM5mP6sZAreoNcWZqQM7vIHFjL0/H9vTaLAN8+fQOc81xFtateTKwFQlJMUmdWKZ8L7ns0Uf1xASQjXtSAACbXI+PuVLjz8nnm3g==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIIC7TCCAdmgAwIBAgIQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rlc3RTVFMwHhcNMTQwNDE2MTIyMTEwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0U1RTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmhReamVYbeOWwrrAvHPvS9KKBwv4Tj7wOSGDXbNgfjhSvVyXsnpYRcuoJkvE8b9tCjFTbXCfbhnaVrpoXaWFtP1YvUIZvCJGdOOTXltMNDlNIaFmsIsomza8IyOHXe+3xHWVtxO8FG3qnteSkkVIQuAvBqpPfQtxrXCZOlbQZm7q69QIQ64JvLJfRwHN1EywMBVwbJgrV8gBdE3RITI76coSOK13OBTlGtB0kGKLDrF2JW+5mB+WnFR7GlXUj+V0R9WStBomVipJEwr6Q3fU0deKZ5lLw0+qJ0T6APInwN5TIN/AbFCHd51aaf3zEP+tZacQ9fbZqy9XBAtL2pCAJQIDAQABo0cwRTBDBgNVHQEEPDA6gBDECazhZ8Ar+ULXb0YTs5MvoRQwEjEQMA4GA1UEAxMHVGVzdFNUU4IQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAA4IBAQAioMSOU9QFw+yhVxGUNK0p/ghVsHnYdeOE3vSRhmFPsetBt8S35sI4QwnQNiuiEYqp++FabiHgePOiqq5oeY6ekJik1qbs7fgwnaQXsxxSucHvc4BU81x24aKy6jeJzxmFxo3mh6y/OI1peCMSH48iUzmhnoSulp0+oAs3gMEFI0ONbgAA/XoAHaVEsrPj10i3gkztoGdpH0DYUe9rABOJxX/3mNF+dCVJG7t7BoSlNAWlSDErKciNNax1nBskFqNWNIKzUKBIb+GVKkIB2QpATMQB6Oe7inUdT9kkZ/Q7oPBATZk+3mFsIoWr8QRFSqvToOhun7EY2/VtuiV1d932</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" InResponseTo="_dfab47d5d46374cd4b71" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document without InResponseTo from request should fail", function (done) {
+        var requestId = "_a6fc46be84e1e3cf3c50";
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          cert: 'MIIC7TCCAdmgAwIBAgIQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rlc3RTVFMwHhcNMTQwNDE2MTIyMTEwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0U1RTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmhReamVYbeOWwrrAvHPvS9KKBwv4Tj7wOSGDXbNgfjhSvVyXsnpYRcuoJkvE8b9tCjFTbXCfbhnaVrpoXaWFtP1YvUIZvCJGdOOTXltMNDlNIaFmsIsomza8IyOHXe+3xHWVtxO8FG3qnteSkkVIQuAvBqpPfQtxrXCZOlbQZm7q69QIQ64JvLJfRwHN1EywMBVwbJgrV8gBdE3RITI76coSOK13OBTlGtB0kGKLDrF2JW+5mB+WnFR7GlXUj+V0R9WStBomVipJEwr6Q3fU0deKZ5lLw0+qJ0T6APInwN5TIN/AbFCHd51aaf3zEP+tZacQ9fbZqy9XBAtL2pCAJQIDAQABo0cwRTBDBgNVHQEEPDA6gBDECazhZ8Ar+ULXb0YTs5MvoRQwEjEQMA4GA1UEAxMHVGVzdFNUU4IQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAA4IBAQAioMSOU9QFw+yhVxGUNK0p/ghVsHnYdeOE3vSRhmFPsetBt8S35sI4QwnQNiuiEYqp++FabiHgePOiqq5oeY6ekJik1qbs7fgwnaQXsxxSucHvc4BU81x24aKy6jeJzxmFxo3mh6y/OI1peCMSH48iUzmhnoSulp0+oAs3gMEFI0ONbgAA/XoAHaVEsrPj10i3gkztoGdpH0DYUe9rABOJxX/3mNF+dCVJG7t7BoSlNAWlSDErKciNNax1nBskFqNWNIKzUKBIb+GVKkIB2QpATMQB6Oe7inUdT9kkZ/Q7oPBATZk+3mFsIoWr8QRFSqvToOhun7EY2/VtuiV1d932',
-          validateInResponseTo: true
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          cert: TEST_CERT,
+          validateInResponseTo: true,
         };
-        var samlObj = new SAML( samlConfig );
-
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-06-05T12:07:07.662Z'));
+        var samlObj = new SAML(samlConfig);
 
-        // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          should.not.exist( err );
-          profile.nameID.should.startWith( 'UIS/jochen-work' );
-          samlObj.cacheProvider.get(requestId, function(err, value){
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
             try {
-              should.not.exist(value);
+              should.exist(err);
+              err.message.should.match("InResponseTo is not valid");
               done();
             } catch (err2) {
               done(err2);
             }
-          });
-        });
+          }
+        );
       });
 
-      it( 'xml document with SubjectConfirmation and missing InResponseTo from request should not be valid', function(done){
-        var requestId = '_dfab47d5d46374cd4b71';
-        var xml = '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>c8xR7YMU8KAYbkV7Jx3WEBhIqso=</DigestValue></Reference></SignedInfo><SignatureValue>jPOrsXdG/YVyGrykXYUbgVK7iX+tNFjMJnOA2iFWOjjtWco9M5DT9tyUsYAag4o4oDUEJribGWhCYn6nvQ24zfW+eJYGwbxO0TSZ26J0iuhnxr+MMFmJVGjxArD70dea0kITssqCxJNKUwmTqteAQ73+qk91H9E9IDoOjMwQERoyD4sAtvfJErRrRontvg9xeQ0BFtyMzJZkwU24QqHvoHyw9/dVO8/NFPydwjaI9uZMu6/QUYKKvkbf6VUXXQUHIiZgX0GCudpB908BqWIcj0dWv8oKGGajQWp+d8Jlx/nxbUTAs8vL1f0dxW3LYCZsDExHmjRQTBhM0pQVMT+HlA==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("xml document with SubjectConfirmation InResponseTo from request should be valid", function (done) {
+        var requestId = "_dfab47d5d46374cd4b71";
+        var xml =
+          '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" InResponseTo="_dfab47d5d46374cd4b71" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>QecaVjMY/2M4VMJsakvX8uh2Mrg=</DigestValue></Reference></SignedInfo><SignatureValue>QTJ//ZHEQRe9/nA5qTkhECZc2u6M1dHzTkujKBedskLSRPL8LRBb4Yftla0zu848sYvLd3SXzEysYu/jrAjaVDevYZIAdyj/3HCw8pS0ZnQDaCgYuAkH4JmYxBfW1Sc9Kr0vbR58ihwWOZd4xHIn/b8xLs8WNsyTHix2etrLGznioLwTOBO3+SgjwSiSP9NUhrlOvolbuu/6xhLi37/L08JaBvOw3o0k4V8xS87SFczhm4f6wvQM5mP6sZAreoNcWZqQM7vIHFjL0/H9vTaLAN8+fQOc81xFtateTKwFQlJMUmdWKZ8L7ns0Uf1xASQjXtSAACbXI+PuVLjz8nnm3g==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIIC7TCCAdmgAwIBAgIQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rlc3RTVFMwHhcNMTQwNDE2MTIyMTEwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0U1RTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmhReamVYbeOWwrrAvHPvS9KKBwv4Tj7wOSGDXbNgfjhSvVyXsnpYRcuoJkvE8b9tCjFTbXCfbhnaVrpoXaWFtP1YvUIZvCJGdOOTXltMNDlNIaFmsIsomza8IyOHXe+3xHWVtxO8FG3qnteSkkVIQuAvBqpPfQtxrXCZOlbQZm7q69QIQ64JvLJfRwHN1EywMBVwbJgrV8gBdE3RITI76coSOK13OBTlGtB0kGKLDrF2JW+5mB+WnFR7GlXUj+V0R9WStBomVipJEwr6Q3fU0deKZ5lLw0+qJ0T6APInwN5TIN/AbFCHd51aaf3zEP+tZacQ9fbZqy9XBAtL2pCAJQIDAQABo0cwRTBDBgNVHQEEPDA6gBDECazhZ8Ar+ULXb0YTs5MvoRQwEjEQMA4GA1UEAxMHVGVzdFNUU4IQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAA4IBAQAioMSOU9QFw+yhVxGUNK0p/ghVsHnYdeOE3vSRhmFPsetBt8S35sI4QwnQNiuiEYqp++FabiHgePOiqq5oeY6ekJik1qbs7fgwnaQXsxxSucHvc4BU81x24aKy6jeJzxmFxo3mh6y/OI1peCMSH48iUzmhnoSulp0+oAs3gMEFI0ONbgAA/XoAHaVEsrPj10i3gkztoGdpH0DYUe9rABOJxX/3mNF+dCVJG7t7BoSlNAWlSDErKciNNax1nBskFqNWNIKzUKBIb+GVKkIB2QpATMQB6Oe7inUdT9kkZ/Q7oPBATZk+3mFsIoWr8QRFSqvToOhun7EY2/VtuiV1d932</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" InResponseTo="_dfab47d5d46374cd4b71" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          cert: 'MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/',
-          validateInResponseTo: true
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          cert:
+            "MIIC7TCCAdmgAwIBAgIQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rlc3RTVFMwHhcNMTQwNDE2MTIyMTEwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0U1RTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmhReamVYbeOWwrrAvHPvS9KKBwv4Tj7wOSGDXbNgfjhSvVyXsnpYRcuoJkvE8b9tCjFTbXCfbhnaVrpoXaWFtP1YvUIZvCJGdOOTXltMNDlNIaFmsIsomza8IyOHXe+3xHWVtxO8FG3qnteSkkVIQuAvBqpPfQtxrXCZOlbQZm7q69QIQ64JvLJfRwHN1EywMBVwbJgrV8gBdE3RITI76coSOK13OBTlGtB0kGKLDrF2JW+5mB+WnFR7GlXUj+V0R9WStBomVipJEwr6Q3fU0deKZ5lLw0+qJ0T6APInwN5TIN/AbFCHd51aaf3zEP+tZacQ9fbZqy9XBAtL2pCAJQIDAQABo0cwRTBDBgNVHQEEPDA6gBDECazhZ8Ar+ULXb0YTs5MvoRQwEjEQMA4GA1UEAxMHVGVzdFNUU4IQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAA4IBAQAioMSOU9QFw+yhVxGUNK0p/ghVsHnYdeOE3vSRhmFPsetBt8S35sI4QwnQNiuiEYqp++FabiHgePOiqq5oeY6ekJik1qbs7fgwnaQXsxxSucHvc4BU81x24aKy6jeJzxmFxo3mh6y/OI1peCMSH48iUzmhnoSulp0+oAs3gMEFI0ONbgAA/XoAHaVEsrPj10i3gkztoGdpH0DYUe9rABOJxX/3mNF+dCVJG7t7BoSlNAWlSDErKciNNax1nBskFqNWNIKzUKBIb+GVKkIB2QpATMQB6Oe7inUdT9kkZ/Q7oPBATZk+3mFsIoWr8QRFSqvToOhun7EY2/VtuiV1d932",
+          validateInResponseTo: true,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-06-05T12:07:07.662Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.eql('InResponseTo is missing from response');
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            should.not.exist(err);
+            profile.nameID.should.startWith("UIS/jochen-work");
+            samlObj.cacheProvider.get(requestId, function (err, value) {
+              try {
+                should.not.exist(value);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
+            });
           }
-        });
+        );
       });
 
-      it( 'xml document with SubjectConfirmation and missing InResponseTo from request should be not problematic if not validated', function(done){
-        var requestId = '_dfab47d5d46374cd4b71';
-        var xml = '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>c8xR7YMU8KAYbkV7Jx3WEBhIqso=</DigestValue></Reference></SignedInfo><SignatureValue>jPOrsXdG/YVyGrykXYUbgVK7iX+tNFjMJnOA2iFWOjjtWco9M5DT9tyUsYAag4o4oDUEJribGWhCYn6nvQ24zfW+eJYGwbxO0TSZ26J0iuhnxr+MMFmJVGjxArD70dea0kITssqCxJNKUwmTqteAQ73+qk91H9E9IDoOjMwQERoyD4sAtvfJErRrRontvg9xeQ0BFtyMzJZkwU24QqHvoHyw9/dVO8/NFPydwjaI9uZMu6/QUYKKvkbf6VUXXQUHIiZgX0GCudpB908BqWIcj0dWv8oKGGajQWp+d8Jlx/nxbUTAs8vL1f0dxW3LYCZsDExHmjRQTBhM0pQVMT+HlA==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("xml document with SubjectConfirmation and missing InResponseTo from request should not be valid", function (done) {
+        var requestId = "_dfab47d5d46374cd4b71";
+        var xml =
+          '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>c8xR7YMU8KAYbkV7Jx3WEBhIqso=</DigestValue></Reference></SignedInfo><SignatureValue>jPOrsXdG/YVyGrykXYUbgVK7iX+tNFjMJnOA2iFWOjjtWco9M5DT9tyUsYAag4o4oDUEJribGWhCYn6nvQ24zfW+eJYGwbxO0TSZ26J0iuhnxr+MMFmJVGjxArD70dea0kITssqCxJNKUwmTqteAQ73+qk91H9E9IDoOjMwQERoyD4sAtvfJErRrRontvg9xeQ0BFtyMzJZkwU24QqHvoHyw9/dVO8/NFPydwjaI9uZMu6/QUYKKvkbf6VUXXQUHIiZgX0GCudpB908BqWIcj0dWv8oKGGajQWp+d8Jlx/nxbUTAs8vL1f0dxW3LYCZsDExHmjRQTBhM0pQVMT+HlA==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          cert: 'MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/',
-          validateInResponseTo: false
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          cert:
+            "MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/",
+          validateInResponseTo: true,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-06-05T12:07:07.662Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          should.not.exist( err );
-          profile.nameID.should.startWith( 'UIS/jochen-work' );
-          samlObj.cacheProvider.get(requestId, function(err, value){
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
             try {
-              should.exist(value);
-              value.should.eql('2014-06-05T12:07:07.662Z');
+              should.exist(err);
+              err.message.should.eql("InResponseTo is missing from response");
               done();
             } catch (err2) {
               done(err2);
             }
-          });
-        });
+          }
+        );
       });
 
-      it( 'xml document with multiple AttributeStatements should have all attributes present on profile', function(done){
-        var requestId = '_dfab47d5d46374cd4b71';
-        var xml = '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" InResponseTo="_dfab47d5d46374cd4b71" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" InResponseTo="_dfab47d5d46374cd4b71"/></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>qD+sVCaEdy1dTJoUQdo6o+tYsuU=</DigestValue></Reference></SignedInfo><SignatureValue>aLl+1yT7zdT4WnRXKh9cx7WWZnUi/NoxMJWhXP5d+Zu9A4/fjKApSywimU0MTTQxYpvZLjOZPsSwmvc1boJOlXveDsL7A3YWi/f7/zqlVWOfXLE8TVLqUE4jtLsJHFWIJXmh8CI0loqQNf6QcYi9BwCK82FhhXC+qWA5WCZIIWUUMxjxnPbunQ7mninEeW568wqyhb9pLV8QkThzZrZINCqxNvWyGuK/XGPx7ciD6ywbBkdOjlDbwRMaKQ9YeCzZGGzJwOe/NuCXj+oUyzfmzUCobIIR0HYLc4B5UplL7XIKQzpOA2lDDsLe6ZzdTv1qjxSm+dlVfo24onmiPlQUgA==</SignatureValue></Signature></samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("xml document with SubjectConfirmation and missing InResponseTo from request should be not problematic if not validated", function (done) {
+        var requestId = "_dfab47d5d46374cd4b71";
+        var xml =
+          '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>c8xR7YMU8KAYbkV7Jx3WEBhIqso=</DigestValue></Reference></SignedInfo><SignatureValue>jPOrsXdG/YVyGrykXYUbgVK7iX+tNFjMJnOA2iFWOjjtWco9M5DT9tyUsYAag4o4oDUEJribGWhCYn6nvQ24zfW+eJYGwbxO0TSZ26J0iuhnxr+MMFmJVGjxArD70dea0kITssqCxJNKUwmTqteAQ73+qk91H9E9IDoOjMwQERoyD4sAtvfJErRrRontvg9xeQ0BFtyMzJZkwU24QqHvoHyw9/dVO8/NFPydwjaI9uZMu6/QUYKKvkbf6VUXXQUHIiZgX0GCudpB908BqWIcj0dWv8oKGGajQWp+d8Jlx/nxbUTAs8vL1f0dxW3LYCZsDExHmjRQTBhM0pQVMT+HlA==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" /></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          cert: 'MIIDtTCCAp2gAwIBAgIJAKg4VeVcIDz1MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTUwODEzMDE1NDIwWhcNMTUwOTEyMDE1NDIwWjBFMQswCQYDVQQGEwJVUzETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxG3ouM7U+fXbJt69X1H6d4UNg/uRr06pFuU9RkfIwNC+yaXyptqB3ynXKsL7BFt4DCd0fflRvJAx3feJIDp16wN9GDVHcufWMYPhh2j5HcTW/j9JoIJzGhJyvO00YKBt+hHy83iN1SdChKv5y0iSyiPP5GnqFw+ayyHoM6hSO0PqBou1Xb0ZSIE+DHosBnvVna5w2AiPY4xrJl9yZHZ4Q7DfMiYTgstjETio4bX+6oLiBnYktn7DjdEslqhffVme4PuBxNojI+uCeg/sn4QVLd/iogMJfDWNuLD8326Mi/FE9cCRvFlvAiMSaebMI3zPaySsxTK7Zgj5TpEbmbHI9wIDAQABo4GnMIGkMB0GA1UdDgQWBBSVGgvoW4MhMuzBGce29PY8vSzHFzB1BgNVHSMEbjBsgBSVGgvoW4MhMuzBGce29PY8vSzHF6FJpEcwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAKg4VeVcIDz1MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAJu1rqs+anD74dbdwgd3CnqnQsQDJiEXmBhG2leaGt3ve9b/9gKaJg2pyb2NyppDe1uLqh6nNXDuzg1oNZrPz5pJL/eCXPl7FhxhMUi04TtLf8LeNTCIWYZiFuO4pmhohHcv8kRvYR1+6SkLTC8j/TZerm7qvesSiTQFNapa1eNdVQ8nFwVkEtWl+JzKEM1BlRcn42sjJkijeFp7DpI7pU+PnYeiaXpRv5pJo8ogM1iFxN+SnfEs0EuQ7fhKIG9aHKi7bKZ7L6SyX7MDIGLeulEU6lf5D9BfXNmcMambiS0pXhL2QXajt96UBq8FT2KNXY8XNtR4y6MyyCzhaiZZcc8=',
-          validateInResponseTo: true
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          cert:
+            "MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/",
+          validateInResponseTo: false,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-06-05T12:07:07.662Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
-
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          should.not.exist( err );
-          profile.nameID.should.startWith( 'UIS/jochen-work' );
-          profile['vz::identity'].should.equal( 'UIS/jochen-work' );
-          profile['vz::subjecttype'].should.equal( 'UIS user' );
-          profile['vz::account'].should.equal( 'e9aba0c4-ece8-4b44-9526-d24418aa95dc' );
-          profile['vz::org'].should.equal( 'testorg' );
-          profile['vz::name'].should.equal( 'Test User' );
-          profile['net::ip'].should.equal( '::1' );
-          samlObj.cacheProvider.get(requestId, function(err, value){
-            try {
-              should.not.exist(value);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
-          });
-        });
-      });
-
-      describe( 'InResponseTo server cache expiration tests /', function() {
-        it( 'should expire a cached request id after the time', function(done){
-          var requestId = '_dfab47d5d46374cd4b71';
-
-          var samlConfig = {
-            validateInResponseTo: true,
-            requestIdExpirationPeriodMs: 100
-          };
-          var samlObj = new SAML( samlConfig );
-
-          // Mock the SAML request being passed through Passport-SAML
-          samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
 
-          setTimeout(function(){
-            samlObj.cacheProvider.get(requestId, function(err, value){
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            should.not.exist(err);
+            profile.nameID.should.startWith("UIS/jochen-work");
+            samlObj.cacheProvider.get(requestId, function (err, value) {
               try {
-                should.not.exist(value);
+                should.exist(value);
+                value.should.eql("2014-06-05T12:07:07.662Z");
                 done();
               } catch (err2) {
                 done(err2);
               }
             });
-          }, 300);
-        });
-
-        it( 'should expire many cached request ids after the time', function(done){
-          var expiredRequestId1 = '_dfab47d5d46374cd4b71';
-          var expiredRequestId2 = '_dfab47d5d46374cd4b72';
-          var requestId = '_dfab47d5d46374cd4b73';
+          }
+        );
+      });
 
-          var samlConfig = {
-              validateInResponseTo: true,
-              requestIdExpirationPeriodMs: 100
-          };
-          var samlObj = new SAML( samlConfig );
+      it("xml document with multiple AttributeStatements should have all attributes present on profile", function (done) {
+        var requestId = "_dfab47d5d46374cd4b71";
+        var xml =
+          '<samlp:Response ID="_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3" InResponseTo="_dfab47d5d46374cd4b71" Version="2.0" IssueInstant="2014-06-05T12:07:07.662Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">Verizon IDP Hub</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion Version="2.0" ID="_ea67f283-0afb-465a-ba78-5abe7b7f8584" IssueInstant="2014-06-05T12:07:07.663Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>Verizon IDP Hub</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">UIS/jochen-work</saml:NameID><saml:SubjectConfirmation><saml:SubjectConfirmationData NotBefore="2014-06-05T12:06:07.664Z" NotOnOrAfter="2014-06-05T12:10:07.664Z" InResponseTo="_dfab47d5d46374cd4b71"/></saml:SubjectConfirmation></saml:Subject><saml:AttributeStatement><saml:Attribute Name="vz::identity" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS/jochen-work</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::subjecttype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">UIS user</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::account" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">e9aba0c4-ece8-4b44-9526-d24418aa95dc</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::org" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">testorg</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="vz::name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Test User</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AttributeStatement><saml:Attribute Name="net::ip" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xsi:type="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">::1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_f6c28a7d-9c82-4ae8-ba14-fc42c85081d3"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>qD+sVCaEdy1dTJoUQdo6o+tYsuU=</DigestValue></Reference></SignedInfo><SignatureValue>aLl+1yT7zdT4WnRXKh9cx7WWZnUi/NoxMJWhXP5d+Zu9A4/fjKApSywimU0MTTQxYpvZLjOZPsSwmvc1boJOlXveDsL7A3YWi/f7/zqlVWOfXLE8TVLqUE4jtLsJHFWIJXmh8CI0loqQNf6QcYi9BwCK82FhhXC+qWA5WCZIIWUUMxjxnPbunQ7mninEeW568wqyhb9pLV8QkThzZrZINCqxNvWyGuK/XGPx7ciD6ywbBkdOjlDbwRMaKQ9YeCzZGGzJwOe/NuCXj+oUyzfmzUCobIIR0HYLc4B5UplL7XIKQzpOA2lDDsLe6ZzdTv1qjxSm+dlVfo24onmiPlQUgA==</SignatureValue></Signature></samlp:Response>';
+        var base64xml = Buffer.from(xml).toString("base64");
+        var container = { SAMLResponse: base64xml };
 
-          samlObj.cacheProvider.save(expiredRequestId1, new Date().toISOString(), function(){});
-          samlObj.cacheProvider.save(expiredRequestId2, new Date().toISOString(), function(){});
+        var samlConfig = {
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          cert:
+            "MIIDtTCCAp2gAwIBAgIJAKg4VeVcIDz1MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTUwODEzMDE1NDIwWhcNMTUwOTEyMDE1NDIwWjBFMQswCQYDVQQGEwJVUzETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxG3ouM7U+fXbJt69X1H6d4UNg/uRr06pFuU9RkfIwNC+yaXyptqB3ynXKsL7BFt4DCd0fflRvJAx3feJIDp16wN9GDVHcufWMYPhh2j5HcTW/j9JoIJzGhJyvO00YKBt+hHy83iN1SdChKv5y0iSyiPP5GnqFw+ayyHoM6hSO0PqBou1Xb0ZSIE+DHosBnvVna5w2AiPY4xrJl9yZHZ4Q7DfMiYTgstjETio4bX+6oLiBnYktn7DjdEslqhffVme4PuBxNojI+uCeg/sn4QVLd/iogMJfDWNuLD8326Mi/FE9cCRvFlvAiMSaebMI3zPaySsxTK7Zgj5TpEbmbHI9wIDAQABo4GnMIGkMB0GA1UdDgQWBBSVGgvoW4MhMuzBGce29PY8vSzHFzB1BgNVHSMEbjBsgBSVGgvoW4MhMuzBGce29PY8vSzHF6FJpEcwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAKg4VeVcIDz1MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAJu1rqs+anD74dbdwgd3CnqnQsQDJiEXmBhG2leaGt3ve9b/9gKaJg2pyb2NyppDe1uLqh6nNXDuzg1oNZrPz5pJL/eCXPl7FhxhMUi04TtLf8LeNTCIWYZiFuO4pmhohHcv8kRvYR1+6SkLTC8j/TZerm7qvesSiTQFNapa1eNdVQ8nFwVkEtWl+JzKEM1BlRcn42sjJkijeFp7DpI7pU+PnYeiaXpRv5pJo8ogM1iFxN+SnfEs0EuQ7fhKIG9aHKi7bKZ7L6SyX7MDIGLeulEU6lf5D9BfXNmcMambiS0pXhL2QXajt96UBq8FT2KNXY8XNtR4y6MyyCzhaiZZcc8=",
+          validateInResponseTo: true,
+        };
+        var samlObj = new SAML(samlConfig);
+
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
+
+        // Mock the SAML request being passed through Passport-SAML
+        samlObj.cacheProvider.save(
+          requestId,
+          new Date().toISOString(),
+          function () {}
+        );
+
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            should.not.exist(err);
+            profile.nameID.should.startWith("UIS/jochen-work");
+            profile["vz::identity"].should.equal("UIS/jochen-work");
+            profile["vz::subjecttype"].should.equal("UIS user");
+            profile["vz::account"].should.equal(
+              "e9aba0c4-ece8-4b44-9526-d24418aa95dc"
+            );
+            profile["vz::org"].should.equal("testorg");
+            profile["vz::name"].should.equal("Test User");
+            profile["net::ip"].should.equal("::1");
+            samlObj.cacheProvider.get(requestId, function (err, value) {
+              try {
+                should.not.exist(value);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
+            });
+          }
+        );
+      });
+
+      describe("InResponseTo server cache expiration tests /", function () {
+        it("should expire a cached request id after the time", function (done) {
+          var requestId = "_dfab47d5d46374cd4b71";
 
-          setTimeout(function(){
+          var samlConfig = {
+            validateInResponseTo: true,
+            requestIdExpirationPeriodMs: 100,
+          };
+          var samlObj = new SAML(samlConfig);
+
+          // Mock the SAML request being passed through Passport-SAML
+          samlObj.cacheProvider.save(
+            requestId,
+            new Date().toISOString(),
+            function () {}
+          );
+
+          setTimeout(function () {
+            samlObj.cacheProvider.get(requestId, function (err, value) {
+              try {
+                should.not.exist(value);
+                done();
+              } catch (err2) {
+                done(err2);
+              }
+            });
+          }, 300);
+        });
+
+        it("should expire many cached request ids after the time", function (done) {
+          var expiredRequestId1 = "_dfab47d5d46374cd4b71";
+          var expiredRequestId2 = "_dfab47d5d46374cd4b72";
+          var requestId = "_dfab47d5d46374cd4b73";
+
+          var samlConfig = {
+            validateInResponseTo: true,
+            requestIdExpirationPeriodMs: 100,
+          };
+          var samlObj = new SAML(samlConfig);
+
+          samlObj.cacheProvider.save(
+            expiredRequestId1,
+            new Date().toISOString(),
+            function () {}
+          );
+          samlObj.cacheProvider.save(
+            expiredRequestId2,
+            new Date().toISOString(),
+            function () {}
+          );
+
+          setTimeout(function () {
             // Add one more that shouldn't expire
-            samlObj.cacheProvider.save(requestId, new Date().toISOString(), function(){});
+            samlObj.cacheProvider.save(
+              requestId,
+              new Date().toISOString(),
+              function () {}
+            );
 
-            samlObj.cacheProvider.get(expiredRequestId1, function(err, value){
+            samlObj.cacheProvider.get(expiredRequestId1, function (err, value) {
               should.not.exist(value);
             });
-            samlObj.cacheProvider.get(expiredRequestId2, function(err, value){
+            samlObj.cacheProvider.get(expiredRequestId2, function (err, value) {
               should.not.exist(value);
             });
-            samlObj.cacheProvider.get(requestId, function(err, value){
+            samlObj.cacheProvider.get(requestId, function (err, value) {
               should.exist(value);
             });
 
             // Let the expiration timer run again and we should have no more cached
-            setTimeout(function(){
-              samlObj.cacheProvider.get(requestId, function(err, value){
+            setTimeout(function () {
+              samlObj.cacheProvider.get(requestId, function (err, value) {
                 try {
                   should.not.exist(value);
                   done();
@@ -2527,261 +3166,320 @@ describe( 'passport-saml /', function() {
                   done(err2);
                 }
               });
-            }, 300)
+            }, 300);
           }, 300);
         });
       });
     });
 
-    describe( 'assertion condition checks /', function() {
+    describe("assertion condition checks /", function () {
       var samlConfig = {
-        entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+        entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         cert: TEST_CERT,
       };
       var fakeClock;
 
-      beforeEach(function() {
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+      beforeEach(function () {
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
       });
 
-      afterEach(function() {
+      afterEach(function () {
         fakeClock.restore();
       });
 
-      it( 'onelogin xml document with current time after NotBefore time should validate', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time after NotBefore time should validate", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be within the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:09Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.not.exist( err );
-            profile.nameID.should.startWith( 'ploer' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with current time equal to NotBefore (plus default clock skew)  time should validate', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time equal to NotBefore (plus default clock skew)  time should validate", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be within the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:08Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:08Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.not.exist( err );
-            profile.nameID.should.startWith( 'ploer' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with current time before NotBefore time should fail', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time before NotBefore time should fail", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be after the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:13:07Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:07Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'SAML assertion not yet valid' );
-            done();
-          } catch (erro2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match("SAML assertion not yet valid");
+              done();
+            } catch (erro2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with current time equal to NotOnOrAfter (minus default clock skew) time should fail', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time equal to NotOnOrAfter (minus default clock skew) time should fail", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be after the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:19:08Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:19:08Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'SAML assertion expired' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match("SAML assertion expired");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with current time after NotOnOrAfter time (minus default clock skew) should fail', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time after NotOnOrAfter time (minus default clock skew) should fail", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be after the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:19:09Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:19:09Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'SAML assertion expired' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match("SAML assertion expired");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with current time after NotOnOrAfter time with accepted clock skew equal to -1 should pass', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with current time after NotOnOrAfter time with accepted clock skew equal to -1 should pass", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
-          acceptedClockSkewMs: -1
+          acceptedClockSkewMs: -1,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
         // Fake the current date to be after the valid time range
         fakeClock.restore();
-        fakeClock = sinon.useFakeTimers(Date.parse('2014-05-28T00:20:09Z'));
+        fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:20:09Z"));
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.not.exist( err );
-            profile.nameID.should.startWith( 'ploer' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with audience and no AudienceRestriction should not pass', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with audience and no AudienceRestriction should not pass", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          audience: 'http://sp.example.com',
-          acceptedClockSkewMs: -1
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          audience: "http://sp.example.com",
+          acceptedClockSkewMs: -1,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'SAML assertion has no AudienceRestriction' );
-            done();
-          } catch(err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(
+                "SAML assertion has no AudienceRestriction"
+              );
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with audience not matching AudienceRestriction should not pass', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with audience not matching AudienceRestriction should not pass", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          audience: 'http://sp.example.com',
-          acceptedClockSkewMs: -1
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          audience: "http://sp.example.com",
+          acceptedClockSkewMs: -1,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.exist( err );
-            err.message.should.match( 'SAML assertion audience mismatch' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match("SAML assertion audience mismatch");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it( 'onelogin xml document with audience matching AudienceRestriction should pass', function( done ) {
-        var xml = '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
-            '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>'+TEST_CERT+'</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>http://sp.example.com</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
-            '</samlp:Response>';
-        var base64xml = Buffer.from( xml ).toString('base64');
+      it("onelogin xml document with audience matching AudienceRestriction should pass", function (done) {
+        var xml =
+          '<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="R689b0733bccca22a137e3654830312332940b1be" Version="2.0" IssueInstant="2014-05-28T00:16:08Z" Destination="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' +
+          '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa" IssueInstant="2014-05-28T00:16:08Z"><saml:Issuer>https://app.onelogin.com/saml/metadata/371755</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#pfx3b63c7be-fe86-62fd-8cb5-16ab6273efaa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>DCnPTQYBb1hKspbe6fg1U3q8xn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>e0+aFomA0+JAY0f9tKqzIuqIVSSw7LiFUsneEDKPBWdiTz1sMdgr/2y1e9+rjaS2mRmCi/vSQLY3zTYz0hp6nJNU19+TWoXo9kHQyWT4KkeQL4Xs/gZ/AoKC20iHVKtpPps0IQ0Ml/qRoouSitt6Sf/WDz2LV/pWcH2hx5tv3xSw36hK2NQc7qw7r1mEXnvcjXReYo8rrVf7XHGGxNoRIEICUIi110uvsWemSXf0Z0dyb0FVYOWuSsQMDlzNpheADBifFO4UTfSEhFZvn8kVCGZUIwrbOhZ2d/+YEtgyuTg+qtslgfy4dwd4TvEcfuRzQTazeefprSFyiQckAXOjcw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>' +
+          TEST_CERT +
+          '</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ploer@subspacesw.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-05-28T00:19:08Z" Recipient="{recipient}" InResponseTo="_a6fc46be84e1e3cf3c50"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-05-28T00:13:08Z" NotOnOrAfter="2014-05-28T00:19:08Z"><saml:AudienceRestriction><saml:Audience>http://sp.example.com</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-05-28T00:16:07Z" SessionNotOnOrAfter="2014-05-29T00:16:08Z" SessionIndex="_30a4af50-c82b-0131-f8b5-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>' +
+          "</samlp:Response>";
+        var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint: 'https://app.onelogin.com/trust/saml2/http-post/sso/371755',
-          audience: 'http://sp.example.com',
-          acceptedClockSkewMs: -1
+          entryPoint:
+            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          audience: "http://sp.example.com",
+          acceptedClockSkewMs: -1,
         };
-        var samlObj = new SAML( samlConfig );
+        var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse( container, function( err, profile, logout ) {
-          try {
-            should.not.exist( err );
-            profile.nameID.should.startWith( 'ploer' );
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validatePostResponse(
+          container,
+          function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-
     });
   });
-  describe('validatePostRequest()', function() {
+  describe("validatePostRequest()", function () {
     var samlObj;
-    beforeEach(function() {
+    beforeEach(function () {
       samlObj = new SAML({
-        cert: fs.readFileSync(__dirname + '/static/cert.pem', 'ascii')
+        cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
       });
     });
 
-    it('errors if bad xml', function(done) {
+    it("errors if bad xml", function (done) {
       var body = {
-        SAMLRequest: "asdf"
+        SAMLRequest: "asdf",
       };
-      samlObj.validatePostRequest(body, function(err) {
+      samlObj.validatePostRequest(body, function (err) {
         try {
           should.exist(err);
           done();
@@ -2790,32 +3488,38 @@ describe( 'passport-saml /', function() {
         }
       });
     });
-    it('errors if bad signature', function(done) {
+    it("errors if bad signature", function (done) {
       var body = {
-        SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_bad_signature.xml', 'base64')
+        SAMLRequest: fs.readFileSync(
+          __dirname + "/static/logout_request_with_bad_signature.xml",
+          "base64"
+        ),
       };
-      samlObj.validatePostRequest(body, function(err) {
+      samlObj.validatePostRequest(body, function (err) {
         try {
           should.exist(err);
-          err.should.eql(new Error('Invalid signature on documentElement'));
+          err.should.eql(new Error("Invalid signature on documentElement"));
           done();
         } catch (err2) {
           done(err2);
         }
       });
     });
-    it('returns profile for valid signature', function(done) {
+    it("returns profile for valid signature", function (done) {
       var body = {
-        SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_good_signature.xml', 'base64')
+        SAMLRequest: fs.readFileSync(
+          __dirname + "/static/logout_request_with_good_signature.xml",
+          "base64"
+        ),
       };
-      samlObj.validatePostRequest(body, function(err, profile) {
+      samlObj.validatePostRequest(body, function (err, profile) {
         try {
           should.not.exist(err);
           profile.should.eql({
-            ID: 'pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1',
-            issuer: 'http://sp.example.com/demo1/metadata.php',
-            nameID: 'ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7',
-            nameIDFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
+            ID: "pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1",
+            issuer: "http://sp.example.com/demo1/metadata.php",
+            nameID: "ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7",
+            nameIDFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
           });
           done();
         } catch (err2) {
@@ -2823,43 +3527,49 @@ describe( 'passport-saml /', function() {
         }
       });
     });
-    it('returns profile for valid signature including session index', function(done) {
+    it("returns profile for valid signature including session index", function (done) {
       var body = {
-        SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_session_index.xml', 'base64')
+        SAMLRequest: fs.readFileSync(
+          __dirname + "/static/logout_request_with_session_index.xml",
+          "base64"
+        ),
       };
-      samlObj.validatePostRequest(body, function(err, profile) {
+      samlObj.validatePostRequest(body, function (err, profile) {
         try {
           should.not.exist(err);
           profile.should.eql({
-            ID: 'pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1',
-            issuer: 'http://sp.example.com/demo1/metadata.php',
-            nameID: 'ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7',
-            nameIDFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-            sessionIndex: '1'
+            ID: "pfxd4d369e8-9ea1-780c-aff8-a1d11a9862a1",
+            issuer: "http://sp.example.com/demo1/metadata.php",
+            nameID: "ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7",
+            nameIDFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+            sessionIndex: "1",
           });
           done();
         } catch (err2) {
           done(err2);
         }
       });
-    })
-    it('returns profile for valid signature with encrypted nameID', function(done) {
+    });
+    it("returns profile for valid signature with encrypted nameID", function (done) {
       var samlObj = new SAML({
-        cert: fs.readFileSync(__dirname + '/static/cert.pem', 'ascii'),
-        decryptionPvk: fs.readFileSync(__dirname + '/static/key.pem', 'ascii')
+        cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
+        decryptionPvk: fs.readFileSync(__dirname + "/static/key.pem", "ascii"),
       });
       var body = {
-        SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_encrypted_name_id.xml', 'base64')
+        SAMLRequest: fs.readFileSync(
+          __dirname + "/static/logout_request_with_encrypted_name_id.xml",
+          "base64"
+        ),
       };
-      samlObj.validatePostRequest(body, function(err, profile) {
+      samlObj.validatePostRequest(body, function (err, profile) {
         try {
           should.not.exist(err);
           profile.should.eql({
-            ID: 'pfx00cb5227-d9d0-1d4b-bdb2-c7ad6c3c6906',
-            issuer: 'http://sp.example.com/demo1/metadata.php',
-            nameID: 'ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7',
-            nameIDFormat: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-            sessionIndex: '1'
+            ID: "pfx00cb5227-d9d0-1d4b-bdb2-c7ad6c3c6906",
+            issuer: "http://sp.example.com/demo1/metadata.php",
+            nameID: "ONELOGIN_f92cc1834efc0f73e9c09f482fce80037a6251e7",
+            nameIDFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+            sessionIndex: "1",
           });
           done();
         } catch (err2) {
@@ -2868,15 +3578,21 @@ describe( 'passport-saml /', function() {
       });
     });
   });
-  it('validatePostRequest errors for encrypted nameID with wrong decryptionPvk', function(done) {
+  it("validatePostRequest errors for encrypted nameID with wrong decryptionPvk", function (done) {
     var samlObj = new SAML({
-      cert: fs.readFileSync(__dirname + '/static/cert.pem', 'ascii'),
-      decryptionPvk: fs.readFileSync(__dirname + '/static/acme_tools_com.key', 'ascii')
+      cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
+      decryptionPvk: fs.readFileSync(
+        __dirname + "/static/acme_tools_com.key",
+        "ascii"
+      ),
     });
     var body = {
-      SAMLRequest: fs.readFileSync(__dirname + '/static/logout_request_with_encrypted_name_id.xml', 'base64')
+      SAMLRequest: fs.readFileSync(
+        __dirname + "/static/logout_request_with_encrypted_name_id.xml",
+        "base64"
+      ),
     };
-    samlObj.validatePostRequest(body, function(err) {
+    samlObj.validatePostRequest(body, function (err) {
       try {
         should.exist(err);
         done();
@@ -2884,51 +3600,11 @@ describe( 'passport-saml /', function() {
         done(err2);
       }
     });
-    it('errors if bad privateCert to requestToURL', function(done){
-		  var samlObj = new SAML({
-              entryPoint: "foo",
-              privateCert: "-----BEGIN CERTIFICATE-----\n"+
-                "8mvhvrcCOiJ3mjgKNN1F31jOBJuZNmq0U7n9v+Z+3NfyU/0E9jkrnFvm5ks+p8kl\n" +
-                "BjuBk9RAkazsU9l02XMS/VxOOIifxKC7R9bDtx0hjolYxgqxPIO5s4rmjj0rLzvo\n" +
-                "vQTTTx/tB5e+hbdx922QSeTjP4DO4ms6cIexcH+ZEUOJ3wXiHToJW83SXLRtwPI9\n" +
-                "JbWKeS9nWPnzcedbDNZkGtohW5vf32BHuvLsWcl6eFXRSkdX/7+rgpXmDRB7caQ+\n" +
-                "2SXVY7ORily7LTKg1cFmuKHDzKTGFIp5/GU6dwIDAQABAoIBAArgFQ+Uk4UN4diY\n" +
-                "gJWCAaQlTVmP0UEHZQt/NmJrc9ZVduuhOP0hH6gF53nREHz5UQb4nXB2Ksa3MtYD\n" +
-                "Z1vhJcu/T7pvmib4q+Ij6oAmlyeL/xwVY3IUURMxX3tCdPItlk4PEFELKeqQOiIS\n" +
-                "7B0DYxWfJbMle3c95w5ruYEr2A+fHCKVSlDpg7uPd9VQ6t7bGMZZvc9tDSC1qPXQ\n" +
-                "Gd/WOMXxi+t/TpyVZ6tOcEekQzAMLmWElUUPx3TJ0ur0Zl2LZ7IvQEXXias4lUHV\n" +
-                "fnH3akDCMmdhlJSVqUfplrh85zAOh6fLloZagphj/Kpgfw1TZ+njSDYqSLYE0NZ1\n" +
-                "j+83feECgYEA2aNGgbc+t6QLrJJ63l9Mz541lVV3IUAxZ5ACqOnMkQVuLoa5IMwM\n" +
-                "oENIo38ptfHQqjQ9x8/tEINFqOHnQuOJ/+1xP9f0Me+0clRDCqjGYqNYgmakKyD7\n" +
-                "vey/q6kwHk679RVGiI1p+HdoA+CbEKWHJiRxE0RhAA3G3wGAq7kpJocCgYEAxp4/\n" +
-                "tCft+eHVRivspfDN//axc2TR6qWP9E1ueGvbiXPXv0Puag0W9cER/df/s5jW4Rqg\n" +
-                "CE8649HPUZ0FJT+YaeKgu2Sw9SMcGl4/uyHzg7KnXIeYyQZJPqQkKyXmIix8cw3+\n" +
-                "HBGRtwX5nOy0DgFdaMiH0F08peNI9QHKKTBoWJECgYEAyymJ1ekzWMaAR1Zt8EvS\n" +
-                "LjWoG4EuthFwjRZ4BSpLVk1Vb4VAKAeS+cAVfNpmG3xip6Ag0/ebe0CvtFk9QsmZ\n" +
-                "txj2EP0M7div/9H8y2SF3OpS41fhhIlDtyXcPuivDHu/Jaf4sdwgwlrk9EmlN0Lu\n" +
-                "CIMYMz4vtpclwGNss+EjMt0CgYEAqepD0Vm/iuCaVhfJsgSaFvnywSdlNfpBdtyv\n" +
-                "PzH2dFa4IZZ55hwgoklznNgmlnyQh68BbVpqpO+fDtDnz//h4ePRYb84a96Hcj9j\n" +
-                "AjJ/YxF5f/04xfEsw/wkPQ2FHYM1TDCSTWzyXcMs0gTl3H1qbfPvzF+XPMt+ZKwN\n" +
-                "SMNy4SECgYB3ig6t+XVfNkw8oBOh0Gx37XKbmImXsA8ucDAX9KUbMIvD03XCEf34\n" +
-                "jF3SNJh0SmHoT62vc+cJqPxMDP6E7Q1nZxsEyaAkKr2H4dSM4SlRm0VB+bS+jXsz\n" +
-                "PCiRGSm8eupuxfix05LMMreo4mC7e3Ir4JhdCsXxAMZIvbNyXcvUMA==\n" +
-                "-----END CERTIFICATE-----\n"
-		  });
-        var request = '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
-        samlObj.requestToUrl(request, null, 'authorize', {}, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.containEql('no start line');
-            done();
-          } catch (err2) {
-            done(err2);
-          }
-        });
-	  });
-    it('errors if bad privateKey to requestToURL', function(done){
+    it("errors if bad privateCert to requestToURL", function (done) {
       var samlObj = new SAML({
         entryPoint: "foo",
-        privateKey: "-----BEGIN CERTIFICATE-----\n"+
+        privateCert:
+          "-----BEGIN CERTIFICATE-----\n" +
           "8mvhvrcCOiJ3mjgKNN1F31jOBJuZNmq0U7n9v+Z+3NfyU/0E9jkrnFvm5ks+p8kl\n" +
           "BjuBk9RAkazsU9l02XMS/VxOOIifxKC7R9bDtx0hjolYxgqxPIO5s4rmjj0rLzvo\n" +
           "vQTTTx/tB5e+hbdx922QSeTjP4DO4ms6cIexcH+ZEUOJ3wXiHToJW83SXLRtwPI9\n" +
@@ -2953,13 +3629,57 @@ describe( 'passport-saml /', function() {
           "SMNy4SECgYB3ig6t+XVfNkw8oBOh0Gx37XKbmImXsA8ucDAX9KUbMIvD03XCEf34\n" +
           "jF3SNJh0SmHoT62vc+cJqPxMDP6E7Q1nZxsEyaAkKr2H4dSM4SlRm0VB+bS+jXsz\n" +
           "PCiRGSm8eupuxfix05LMMreo4mC7e3Ir4JhdCsXxAMZIvbNyXcvUMA==\n" +
-          "-----END CERTIFICATE-----\n"
+          "-----END CERTIFICATE-----\n",
       });
-      var request = '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
-      samlObj.requestToUrl(request, null, 'authorize', {}, function(err) {
+      var request =
+        '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
+      samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
         try {
           should.exist(err);
-          err.message.should.containEql('no start line');
+          err.message.should.containEql("no start line");
+          done();
+        } catch (err2) {
+          done(err2);
+        }
+      });
+    });
+    it("errors if bad privateKey to requestToURL", function (done) {
+      var samlObj = new SAML({
+        entryPoint: "foo",
+        privateKey:
+          "-----BEGIN CERTIFICATE-----\n" +
+          "8mvhvrcCOiJ3mjgKNN1F31jOBJuZNmq0U7n9v+Z+3NfyU/0E9jkrnFvm5ks+p8kl\n" +
+          "BjuBk9RAkazsU9l02XMS/VxOOIifxKC7R9bDtx0hjolYxgqxPIO5s4rmjj0rLzvo\n" +
+          "vQTTTx/tB5e+hbdx922QSeTjP4DO4ms6cIexcH+ZEUOJ3wXiHToJW83SXLRtwPI9\n" +
+          "JbWKeS9nWPnzcedbDNZkGtohW5vf32BHuvLsWcl6eFXRSkdX/7+rgpXmDRB7caQ+\n" +
+          "2SXVY7ORily7LTKg1cFmuKHDzKTGFIp5/GU6dwIDAQABAoIBAArgFQ+Uk4UN4diY\n" +
+          "gJWCAaQlTVmP0UEHZQt/NmJrc9ZVduuhOP0hH6gF53nREHz5UQb4nXB2Ksa3MtYD\n" +
+          "Z1vhJcu/T7pvmib4q+Ij6oAmlyeL/xwVY3IUURMxX3tCdPItlk4PEFELKeqQOiIS\n" +
+          "7B0DYxWfJbMle3c95w5ruYEr2A+fHCKVSlDpg7uPd9VQ6t7bGMZZvc9tDSC1qPXQ\n" +
+          "Gd/WOMXxi+t/TpyVZ6tOcEekQzAMLmWElUUPx3TJ0ur0Zl2LZ7IvQEXXias4lUHV\n" +
+          "fnH3akDCMmdhlJSVqUfplrh85zAOh6fLloZagphj/Kpgfw1TZ+njSDYqSLYE0NZ1\n" +
+          "j+83feECgYEA2aNGgbc+t6QLrJJ63l9Mz541lVV3IUAxZ5ACqOnMkQVuLoa5IMwM\n" +
+          "oENIo38ptfHQqjQ9x8/tEINFqOHnQuOJ/+1xP9f0Me+0clRDCqjGYqNYgmakKyD7\n" +
+          "vey/q6kwHk679RVGiI1p+HdoA+CbEKWHJiRxE0RhAA3G3wGAq7kpJocCgYEAxp4/\n" +
+          "tCft+eHVRivspfDN//axc2TR6qWP9E1ueGvbiXPXv0Puag0W9cER/df/s5jW4Rqg\n" +
+          "CE8649HPUZ0FJT+YaeKgu2Sw9SMcGl4/uyHzg7KnXIeYyQZJPqQkKyXmIix8cw3+\n" +
+          "HBGRtwX5nOy0DgFdaMiH0F08peNI9QHKKTBoWJECgYEAyymJ1ekzWMaAR1Zt8EvS\n" +
+          "LjWoG4EuthFwjRZ4BSpLVk1Vb4VAKAeS+cAVfNpmG3xip6Ag0/ebe0CvtFk9QsmZ\n" +
+          "txj2EP0M7div/9H8y2SF3OpS41fhhIlDtyXcPuivDHu/Jaf4sdwgwlrk9EmlN0Lu\n" +
+          "CIMYMz4vtpclwGNss+EjMt0CgYEAqepD0Vm/iuCaVhfJsgSaFvnywSdlNfpBdtyv\n" +
+          "PzH2dFa4IZZ55hwgoklznNgmlnyQh68BbVpqpO+fDtDnz//h4ePRYb84a96Hcj9j\n" +
+          "AjJ/YxF5f/04xfEsw/wkPQ2FHYM1TDCSTWzyXcMs0gTl3H1qbfPvzF+XPMt+ZKwN\n" +
+          "SMNy4SECgYB3ig6t+XVfNkw8oBOh0Gx37XKbmImXsA8ucDAX9KUbMIvD03XCEf34\n" +
+          "jF3SNJh0SmHoT62vc+cJqPxMDP6E7Q1nZxsEyaAkKr2H4dSM4SlRm0VB+bS+jXsz\n" +
+          "PCiRGSm8eupuxfix05LMMreo4mC7e3Ir4JhdCsXxAMZIvbNyXcvUMA==\n" +
+          "-----END CERTIFICATE-----\n",
+      });
+      var request =
+        '<?xml version=\\"1.0\\"?><samlp:AuthnRequest xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" ID=\\"_ea40a8ab177df048d645\\" Version=\\"2.0\\" IssueInstant=\\"2017-08-22T19:30:01.363Z\\" ProtocolBinding=\\"urn:oasis:names$tc:SAML:2.0:bindings:HTTP-POST\\" AssertionConsumerServiceURL=\\"https://example.com/login/callback\\" Destination=\\"https://www.example.com\\"><saml:Issuer xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">onelogin_saml</saml:Issuer><s$mlp:NameIDPolicy xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protocol\\" Format=\\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\\" AllowCreate=\\"true\\"/><samlp:RequestedAuthnContext xmlns:samlp=\\"urn:oasis:names:tc:SAML:2.0:protoc$l\\" Comparison=\\"exact\\"><saml:AuthnContextClassRef xmlns:saml=\\"urn:oasis:names:tc:SAML:2.0:assertion\\">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></samlp:RequestedAuthnContext></samlp$AuthnRequest>';
+      samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
+        try {
+          should.exist(err);
+          err.message.should.containEql("no start line");
           done();
         } catch (err2) {
           done(err2);
@@ -2968,109 +3688,136 @@ describe( 'passport-saml /', function() {
     });
   });
 
-  describe('validateRedirect()', function() {
-    describe('idp slo', function() {
+  describe("validateRedirect()", function () {
+    describe("idp slo", function () {
       var samlObj;
-      beforeEach(function() {
+      beforeEach(function () {
         samlObj = new SAML({
-          cert: fs.readFileSync(__dirname + '/static/acme_tools_com.cert', 'ascii'),
-          idpIssuer: 'http://localhost:20000/saml2/idp/metadata.php'
+          cert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.cert",
+            "ascii"
+          ),
+          idpIssuer: "http://localhost:20000/saml2/idp/metadata.php",
         });
-        this.request = Object.assign({}, require('./static/idp_slo_redirect'));
-        this.clock = sinon.useFakeTimers(Date.parse('2018-04-11T14:08:00Z'));
+        this.request = Object.assign({}, require("./static/idp_slo_redirect"));
+        this.clock = sinon.useFakeTimers(Date.parse("2018-04-11T14:08:00Z"));
       });
-      afterEach(function() {
+      afterEach(function () {
         this.clock.restore();
       });
-      it('errors if bad xml', function(done) {
+      it("errors if bad xml", function (done) {
         var body = {
-          SAMLRequest: "asdf"
+          SAMLRequest: "asdf",
         };
-        samlObj.validateRedirect(body, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validateRedirect(
+          body,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if idpIssuer is set and issuer is wrong', function(done) {
-        samlObj.options.idpIssuer = 'foo';
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql(
-              'Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php'
-            );
-            done();
-          } catch (err2) {
-            done(err2);
+      it("errors if idpIssuer is set and issuer is wrong", function (done) {
+        samlObj.options.idpIssuer = "foo";
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql(
+                "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
+              );
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if request has expired', function(done) {
+      it("errors if request has expired", function (done) {
         this.clock.restore();
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql('SAML assertion expired');
-            done();
-          } catch (err2) {
-            done(err2);
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql("SAML assertion expired");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if request has a bad signature', function(done) {
-        this.request.Signature = 'foo';
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql('Invalid signature');
-            done();
-          } catch (err2) {
-            done(err2);
+      it("errors if request has a bad signature", function (done) {
+        this.request.Signature = "foo";
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql("Invalid signature");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('returns profile for valid signature including session index', function(done) {
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err, profile) {
-          try {
-            should.not.exist(err);
-            profile.should.eql({
-              ID: '_8f0effde308adfb6ae7f1e29b414957fc320f5636f',
-              issuer: 'http://localhost:20000/saml2/idp/metadata.php',
-              nameID: 'stavros@workable.com',
-              nameIDFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
-              sessionIndex: '_00bf7b2d5d9d3c970217eecefb1194bef3362a618e'
-            });
-            done();
-          } catch (err2) {
-            done(err2);
+      it("returns profile for valid signature including session index", function (done) {
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err, profile) {
+            try {
+              should.not.exist(err);
+              profile.should.eql({
+                ID: "_8f0effde308adfb6ae7f1e29b414957fc320f5636f",
+                issuer: "http://localhost:20000/saml2/idp/metadata.php",
+                nameID: "stavros@workable.com",
+                nameIDFormat:
+                  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                sessionIndex: "_00bf7b2d5d9d3c970217eecefb1194bef3362a618e",
+              });
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
     });
-    describe('sp slo', function() {
+    describe("sp slo", function () {
       var samlObj;
-      beforeEach(function() {
+      beforeEach(function () {
         samlObj = new SAML({
-          cert: fs.readFileSync(__dirname + '/static/acme_tools_com.cert', 'ascii'),
-          idpIssuer: 'http://localhost:20000/saml2/idp/metadata.php',
-          validateInResponseTo: true
+          cert: fs.readFileSync(
+            __dirname + "/static/acme_tools_com.cert",
+            "ascii"
+          ),
+          idpIssuer: "http://localhost:20000/saml2/idp/metadata.php",
+          validateInResponseTo: true,
         });
-        this.request = Object.assign({}, require('./static/sp_slo_redirect'));
-        this.clock = sinon.useFakeTimers(Date.parse('2018-04-11T14:08:00Z'));
+        this.request = Object.assign({}, require("./static/sp_slo_redirect"));
+        this.clock = sinon.useFakeTimers(Date.parse("2018-04-11T14:08:00Z"));
       });
-      afterEach(function(done) {
+      afterEach(function (done) {
         this.clock.restore();
-        samlObj.cacheProvider.remove('_79db1e7ad12ca1d63e5b', done);
+        samlObj.cacheProvider.remove("_79db1e7ad12ca1d63e5b", done);
       });
-      it('errors if bad xml', function(done) {
+      it("errors if bad xml", function (done) {
         var body = {
-          SAMLRequest: "asdf"
+          SAMLRequest: "asdf",
         };
-        samlObj.validateRedirect(body, null, function(err) {
+        samlObj.validateRedirect(body, null, function (err) {
           try {
             should.exist(err);
             done();
@@ -3079,80 +3826,119 @@ describe( 'passport-saml /', function() {
           }
         });
       });
-      it('errors if idpIssuer is set and wrong issuer', function(done) {
-        samlObj.options.idpIssuer = 'foo';
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql(
-              'Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php'
-            );
-            done();
-          } catch (err2) {
-            done(err2);
+      it("errors if idpIssuer is set and wrong issuer", function (done) {
+        samlObj.options.idpIssuer = "foo";
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql(
+                "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
+              );
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if unsuccessful', function(done) {
-        this.request = require('./static/sp_slo_redirect_failure');
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql(
-              'Bad status code: urn:oasis:names:tc:SAML:2.0:status:Requester'
-            );
-            done();
-          } catch(err2) {
-            done(err2);
+      it("errors if unsuccessful", function (done) {
+        this.request = require("./static/sp_slo_redirect_failure");
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql(
+                "Bad status code: urn:oasis:names:tc:SAML:2.0:status:Requester"
+              );
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if InResponseTo is not found', function(done) {
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql('InResponseTo is not valid');
-            done();
-          } catch (err2) {
-            done(err2);
+      it("errors if InResponseTo is not found", function (done) {
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql("InResponseTo is not valid");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
-      it('errors if bad signature', function(done) {
-        samlObj.cacheProvider.save('_79db1e7ad12ca1d63e5b', new Date().toISOString(), function(){});
-        this.request.Signature = 'foo';
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err) {
-          try {
-            should.exist(err);
-            err.message.should.eql('Invalid signature');
-            done();
-          } catch (err2) {
-            done(err2);
+      it("errors if bad signature", function (done) {
+        samlObj.cacheProvider.save(
+          "_79db1e7ad12ca1d63e5b",
+          new Date().toISOString(),
+          function () {}
+        );
+        this.request.Signature = "foo";
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err) {
+            try {
+              should.exist(err);
+              err.message.should.eql("Invalid signature");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
           }
-        });
+        );
       });
 
-      it('returns true for valid signature', function(done) {
-        samlObj.cacheProvider.save('_79db1e7ad12ca1d63e5b', new Date().toISOString(), function(){});
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err, _data, success) {
-          try {
+      it("returns true for valid signature", function (done) {
+        samlObj.cacheProvider.save(
+          "_79db1e7ad12ca1d63e5b",
+          new Date().toISOString(),
+          function () {}
+        );
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err, _data, success) {
+            try {
+              should.not.exist(err);
+              success.should.eql(true);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
+          }
+        );
+      });
+
+      it("accepts cert without header and footer line", function (done) {
+        samlObj.options.cert = fs.readFileSync(
+          __dirname + "/static/acme_tools_com_without_header_and_footer.cert",
+          "ascii"
+        );
+        samlObj.cacheProvider.save(
+          "_79db1e7ad12ca1d63e5b",
+          new Date().toISOString(),
+          function () {}
+        );
+        samlObj.validateRedirect(
+          this.request,
+          this.request.originalQuery,
+          function (err, _data, success) {
             should.not.exist(err);
             success.should.eql(true);
             done();
-          } catch (err2) {
-            done(err2);
           }
-        });
-      });
-
-      it('accepts cert without header and footer line', function(done) {
-        samlObj.options.cert = fs.readFileSync(__dirname + '/static/acme_tools_com_without_header_and_footer.cert', 'ascii')
-        samlObj.cacheProvider.save('_79db1e7ad12ca1d63e5b', new Date().toISOString(), function(){});
-        samlObj.validateRedirect(this.request, this.request.originalQuery, function(err, _data, success) {
-          should.not.exist(err);
-          success.should.eql(true);
-          done();
-        });
+        );
       });
     });
   });
diff --git a/tsconfig.json b/tsconfig.json
index bf94eca0..92c79a77 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -4,18 +4,20 @@
 
     /* Basic Options */
     // "incremental": true,                   /* Enable incremental compilation */
-    "target": "es2018",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019', 'ES2020', or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', 'es2020', or 'ESNext'. */
-    "lib": ["es2018"],                             /* Specify library files to be included in the compilation. */
-    "allowJs": true,                       /* Allow javascript files to be compiled. */
+    "target": "es2018" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019', 'ES2020', or 'ESNEXT'. */,
+    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', 'es2020', or 'ESNext'. */,
+    "lib": [
+      "es2018"
+    ] /* Specify library files to be included in the compilation. */,
+    "allowJs": true /* Allow javascript files to be compiled. */,
     // "checkJs": true,                       /* Report errors in .js files. */
     // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
-    "declaration": true,                   /* Generates corresponding '.d.ts' file. */
+    "declaration": true /* Generates corresponding '.d.ts' file. */,
     // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
-    "sourceMap": true,                     /* Generates corresponding '.map' file. */
+    "sourceMap": true /* Generates corresponding '.map' file. */,
     // "outFile": "./",                       /* Concatenate and emit output to single file. */
-    "outDir": "./lib",                        /* Redirect output structure to the directory. */
-    "rootDir": "./src",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
+    "outDir": "./lib" /* Redirect output structure to the directory. */,
+    "rootDir": "./src" /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */,
     // "composite": true,                     /* Enable project compilation */
     // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
     // "removeComments": true,                /* Do not emit comments to output. */
@@ -25,7 +27,7 @@
     // "isolatedModules": true,               /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */
 
     /* Strict Type-Checking Options */
-    "strict": true,                           /* Enable all strict type-checking options. */
+    "strict": true /* Enable all strict type-checking options. */,
     // "noImplicitAny": true,                 /* Raise error on expressions and declarations with an implied 'any' type. */
     // "strictNullChecks": true,              /* Enable strict null checks. */
     // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
@@ -56,15 +58,22 @@
     // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
     // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
     // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
-    "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
+    "inlineSources": true /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */,
 
     /* Experimental Options */
     // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
     // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
 
     /* Advanced Options */
-    "skipLibCheck": true,                     /* Skip type checking of declaration files. */
-    "forceConsistentCasingInFileNames": true  /* Disallow inconsistently-cased references to the same file. */
+    "skipLibCheck": true /* Skip type checking of declaration files. */,
+    "forceConsistentCasingInFileNames": true /* Disallow inconsistently-cased references to the same file. */
   },
-  "exclude": ["node_modules", "docs", "lib", "test", "multiSamlStrategy.js", "multiSamlStrategy.d.ts"]
+  "exclude": [
+    "node_modules",
+    "docs",
+    "lib",
+    "test",
+    "multiSamlStrategy.js",
+    "multiSamlStrategy.d.ts"
+  ]
 }

From 43f0596313af409b15bce828c8715451a00daba0 Mon Sep 17 00:00:00 2001
From: Chris Barth <chrisjbarth@hotmail.com>
Date: Sun, 31 Jan 2021 13:11:40 -0500
Subject: [PATCH 2/2] Use line length of 100

---
 .prettierrc.json                             |    4 +-
 README.md                                    |    5 +-
 docs/adfs/README.md                          |    3 +-
 src/passport-saml/inmemory-cache-provider.ts |   22 +-
 src/passport-saml/multiSamlStrategy.ts       |   28 +-
 src/passport-saml/saml-post-signing.ts       |   25 +-
 src/passport-saml/saml.ts                    |  316 +---
 src/passport-saml/strategy.ts                |   53 +-
 src/passport-saml/types.ts                   |   13 +-
 test/multiSamlStrategy.js                    |   92 +-
 test/saml-post-signing-tests.js              |    8 +-
 test/samlTests.js                            |   25 +-
 test/test-signatures.js                      |   84 +-
 test/tests.js                                | 1404 ++++++------------
 tsconfig.json                                |    4 +-
 15 files changed, 658 insertions(+), 1428 deletions(-)

diff --git a/.prettierrc.json b/.prettierrc.json
index 0967ef42..de753c53 100644
--- a/.prettierrc.json
+++ b/.prettierrc.json
@@ -1 +1,3 @@
-{}
+{
+  "printWidth": 100
+}
diff --git a/README.md b/README.md
index 58d03721..3cfb6a7b 100644
--- a/README.md
+++ b/README.md
@@ -294,10 +294,7 @@ If you have a certificate in the binary DER encoding, you can convert it to the
 If the Identity Provider has multiple signing certificates that are valid (such as during the rolling from an old key to a new key and responses signed with either key are valid) then the `cert` configuration key can be an array:
 
 ```javascript
-cert: [
-  "MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==",
-  "MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6M ... g=",
-];
+cert: ["MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==", "MIIEOTCCAyGgAwIBAgIJAKZgJdKdCdL6M ... g="];
 ```
 
 The `cert` configuration key can also be a function that receives a callback as argument calls back a possible error and a certificate or array of certificates. This allows the Identity Provider to be polled for valid certificates and the new certificate can be used if it is changed:
diff --git a/docs/adfs/README.md b/docs/adfs/README.md
index e3b293dc..f125e887 100644
--- a/docs/adfs/README.md
+++ b/docs/adfs/README.md
@@ -59,8 +59,7 @@ passport.use(
     },
     function (profile, done) {
       return done(null, {
-        upn:
-          profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"],
+        upn: profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"],
         // e.g. if you added a Group claim
         group: profile["http://schemas.xmlsoap.org/claims/Group"],
       });
diff --git a/src/passport-saml/inmemory-cache-provider.ts b/src/passport-saml/inmemory-cache-provider.ts
index 55ef4493..730b12ef 100644
--- a/src/passport-saml/inmemory-cache-provider.ts
+++ b/src/passport-saml/inmemory-cache-provider.ts
@@ -46,8 +46,7 @@ export class CacheProvider {
       keys.forEach((key) => {
         if (
           nowMs >=
-          new Date(this.cacheKeys[key].createdAt).getTime() +
-            this.options.keyExpirationPeriodMs
+          new Date(this.cacheKeys[key].createdAt).getTime() + this.options.keyExpirationPeriodMs
         ) {
           this.remove(key, () => undefined);
         }
@@ -57,8 +56,7 @@ export class CacheProvider {
     // we only want this to run if the process is still open; it shouldn't hold the process open (issue #68)
     //   (unref only introduced in node 0.9, so check whether we have it)
     // Skip this in 0.10.34 due to https://github.com/joyent/node/issues/8900
-    if (expirationTimer.unref && process.version !== "v0.10.34")
-      expirationTimer.unref();
+    if (expirationTimer.unref && process.version !== "v0.10.34") expirationTimer.unref();
   }
 
   /**
@@ -67,11 +65,7 @@ export class CacheProvider {
    * @param id
    * @param value
    */
-  save(
-    key: string,
-    value: string,
-    callback: (error: null, value: CacheItem | null) => void
-  ) {
+  save(key: string, value: string, callback: (error: null, value: CacheItem | null) => void) {
     if (!this.cacheKeys[key]) {
       this.cacheKeys[key] = {
         createdAt: new Date().getTime(),
@@ -89,10 +83,7 @@ export class CacheProvider {
    * @param id
    * @returns {boolean}
    */
-  get(
-    key: string,
-    callback: (key: string | null, value: string | null) => void
-  ) {
+  get(key: string, callback: (key: string | null, value: string | null) => void) {
     if (this.cacheKeys[key]) {
       callback(null, this.cacheKeys[key].value);
     } else {
@@ -104,10 +95,7 @@ export class CacheProvider {
    * Removes an item from the cache if it exists
    * @param key
    */
-  remove(
-    key: string,
-    callback: (err: Error | null, key: string | null) => void
-  ) {
+  remove(key: string, callback: (err: Error | null, key: string | null) => void) {
     if (this.cacheKeys[key]) {
       delete this.cacheKeys[key];
       callback(null, key);
diff --git a/src/passport-saml/multiSamlStrategy.ts b/src/passport-saml/multiSamlStrategy.ts
index ad7e845d..92f9d3a6 100644
--- a/src/passport-saml/multiSamlStrategy.ts
+++ b/src/passport-saml/multiSamlStrategy.ts
@@ -14,10 +14,7 @@ import {
 
 class MultiSamlStrategy extends SamlStrategy {
   _options: MultiSamlConfig;
-  constructor(
-    options: MultiSamlConfig,
-    verify: VerifyWithRequest | VerifyWithoutRequest
-  ) {
+  constructor(options: MultiSamlConfig, verify: VerifyWithRequest | VerifyWithoutRequest) {
     if (!options || typeof options.getSamlOptions != "function") {
       throw new Error("Please provide a getSamlOptions function");
     }
@@ -36,10 +33,7 @@ class MultiSamlStrategy extends SamlStrategy {
     this._options = options;
   }
 
-  authenticate(
-    req: RequestWithUser,
-    options: AuthenticateOptions & AuthorizeOptions
-  ) {
+  authenticate(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions) {
     this._options.getSamlOptions(req, (err, samlOptions) => {
       if (err) {
         return this.error(err);
@@ -61,9 +55,7 @@ class MultiSamlStrategy extends SamlStrategy {
         return callback(err);
       }
 
-      const samlService = new saml.SAML(
-        Object.assign({}, this._options, samlOptions)
-      );
+      const samlService = new saml.SAML(Object.assign({}, this._options, samlOptions));
       const strategy = Object.assign({}, this, { _saml: samlService });
       Object.setPrototypeOf(strategy, this);
       super.logout.call(strategy, req, callback);
@@ -78,9 +70,7 @@ class MultiSamlStrategy extends SamlStrategy {
     callback: (err: Error | null, metadata?: string) => void
   ) {
     if (typeof callback !== "function") {
-      throw new Error(
-        "Metadata can't be provided synchronously for MultiSamlStrategy."
-      );
+      throw new Error("Metadata can't be provided synchronously for MultiSamlStrategy.");
     }
 
     return this._options.getSamlOptions(req, (err, samlOptions) => {
@@ -88,18 +78,12 @@ class MultiSamlStrategy extends SamlStrategy {
         return callback(err);
       }
 
-      const samlService = new saml.SAML(
-        Object.assign({}, this._options, samlOptions)
-      );
+      const samlService = new saml.SAML(Object.assign({}, this._options, samlOptions));
       const strategy = Object.assign({}, this, { _saml: samlService });
       Object.setPrototypeOf(strategy, this);
       return callback(
         null,
-        super.generateServiceProviderMetadata.call(
-          strategy,
-          decryptionCert,
-          signingCert
-        )
+        super.generateServiceProviderMetadata.call(strategy, decryptionCert, signingCert)
       );
     });
   }
diff --git a/src/passport-saml/saml-post-signing.ts b/src/passport-saml/saml-post-signing.ts
index 7f479e40..020be2ef 100644
--- a/src/passport-saml/saml-post-signing.ts
+++ b/src/passport-saml/saml-post-signing.ts
@@ -11,11 +11,7 @@ const defaultTransforms = [
   "http://www.w3.org/2001/10/xml-exc-c14n#",
 ];
 
-export function signSamlPost(
-  samlMessage: string,
-  xpath: string,
-  options: SAMLOptions
-) {
+export function signSamlPost(samlMessage: string, xpath: string, options: SAMLOptions) {
   if (!samlMessage) throw new Error("samlMessage is required");
   if (!xpath) throw new Error("xpath is required");
   if (!options) {
@@ -23,9 +19,7 @@ export function signSamlPost(
   }
 
   if (options.privateCert) {
-    console.warn(
-      "options.privateCert has been deprecated; use options.privateKey instead."
-    );
+    console.warn("options.privateCert has been deprecated; use options.privateKey instead.");
 
     if (!options.privateKey) {
       options.privateKey = options.privateCert;
@@ -37,15 +31,9 @@ export function signSamlPost(
   const transforms = options.xmlSignatureTransforms || defaultTransforms;
   const sig = new SignedXml();
   if (options.signatureAlgorithm) {
-    sig.signatureAlgorithm = algorithms.getSigningAlgorithm(
-      options.signatureAlgorithm
-    );
+    sig.signatureAlgorithm = algorithms.getSigningAlgorithm(options.signatureAlgorithm);
   }
-  sig.addReference(
-    xpath,
-    transforms,
-    algorithms.getDigestAlgorithm(options.digestAlgorithm)
-  );
+  sig.addReference(xpath, transforms, algorithms.getDigestAlgorithm(options.digestAlgorithm));
   sig.signingKey = options.privateKey;
   sig.computeSignature(samlMessage, {
     location: { reference: xpath + issuerXPath, action: "after" },
@@ -53,9 +41,6 @@ export function signSamlPost(
   return sig.getSignedXml();
 }
 
-export function signAuthnRequestPost(
-  authnRequest: string,
-  options: SAMLOptions
-) {
+export function signAuthnRequestPost(authnRequest: string, options: SAMLOptions) {
   return signSamlPost(authnRequest, authnRequestXPath, options);
 }
diff --git a/src/passport-saml/saml.ts b/src/passport-saml/saml.ts
index 783034a1..02071dbc 100644
--- a/src/passport-saml/saml.ts
+++ b/src/passport-saml/saml.ts
@@ -120,19 +120,14 @@ class SAML {
     }
 
     if (options.privateCert) {
-      console.warn(
-        "options.privateCert has been deprecated; use options.privateKey instead."
-      );
+      console.warn("options.privateCert has been deprecated; use options.privateKey instead.");
 
       if (!options.privateKey) {
         options.privateKey = options.privateCert;
       }
     }
 
-    if (
-      Object.prototype.hasOwnProperty.call(options, "cert") &&
-      !options.cert
-    ) {
+    if (Object.prototype.hasOwnProperty.call(options, "cert") && !options.cert) {
       throw new Error("Invalid property: cert must not be empty");
     }
 
@@ -149,13 +144,11 @@ class SAML {
     }
 
     if (options.identifierFormat === undefined) {
-      options.identifierFormat =
-        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+      options.identifierFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
     }
 
     if (options.authnContext === undefined) {
-      options.authnContext =
-        "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
+      options.authnContext = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
     }
 
     if (!Array.isArray(options.authnContext)) {
@@ -200,9 +193,7 @@ class SAML {
      */
     if (
       !options.RACComparison ||
-      ["exact", "minimum", "maximum", "better"].indexOf(
-        options.RACComparison
-      ) === -1
+      ["exact", "minimum", "maximum", "better"].indexOf(options.RACComparison) === -1
     ) {
       options.RACComparison = "exact";
     }
@@ -239,9 +230,7 @@ class SAML {
 
   signRequest(samlMessage: querystring.ParsedUrlQueryInput) {
     const samlMessageToSign: querystring.ParsedUrlQueryInput = {};
-    samlMessage.SigAlg = algorithms.getSigningAlgorithm(
-      this.options.signatureAlgorithm
-    );
+    samlMessage.SigAlg = algorithms.getSigningAlgorithm(this.options.signatureAlgorithm);
     const signer = algorithms.getSigner(this.options.signatureAlgorithm);
     if (samlMessage.SAMLRequest) {
       samlMessageToSign.SAMLRequest = samlMessage.SAMLRequest;
@@ -256,10 +245,7 @@ class SAML {
       samlMessageToSign.SigAlg = samlMessage.SigAlg;
     }
     signer.update(querystring.stringify(samlMessageToSign));
-    samlMessage.Signature = signer.sign(
-      this.keyToPEM(this.options.privateKey),
-      "base64"
-    );
+    samlMessage.Signature = signer.sign(this.keyToPEM(this.options.privateKey), "base64");
   }
 
   /**
@@ -287,10 +273,7 @@ class SAML {
     const forceAuthn = this.options.forceAuthn || false;
 
     if (this.options.validateInResponseTo) {
-      await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(
-        id,
-        instant
-      );
+      await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(id, instant);
     }
     const request: AuthorizeRequestXML = {
       "samlp:AuthnRequest": {
@@ -314,9 +297,7 @@ class SAML {
     }
 
     if (!this.options.disableRequestACSUrl) {
-      request["samlp:AuthnRequest"][
-        "@AssertionConsumerServiceURL"
-      ] = this.getCallbackUrl(req);
+      request["samlp:AuthnRequest"]["@AssertionConsumerServiceURL"] = this.getCallbackUrl(req);
     }
 
     if (this.options.identifierFormat) {
@@ -350,9 +331,7 @@ class SAML {
     }
 
     if (this.options.providerName) {
-      request["samlp:AuthnRequest"][
-        "@ProviderName"
-      ] = this.options.providerName;
+      request["samlp:AuthnRequest"]["@ProviderName"] = this.options.providerName;
     }
 
     if (this.options.scoping) {
@@ -394,8 +373,7 @@ class SAML {
             }
 
             if (idpListItem.getComplete) {
-              formattedIdpListItem["samlp:GetComplete"] =
-                idpListItem.getComplete;
+              formattedIdpListItem["samlp:GetComplete"] = idpListItem.getComplete;
             }
 
             return formattedIdpListItem;
@@ -410,9 +388,7 @@ class SAML {
       request["samlp:AuthnRequest"]["samlp:Scoping"] = scoping;
     }
 
-    let stringRequest = xmlbuilder
-      .create((request as unknown) as Record<string, any>)
-      .end();
+    let stringRequest = xmlbuilder.create((request as unknown) as Record<string, any>).end();
     if (isHttpPostBinding && this.options.privateKey) {
       stringRequest = signAuthnRequestPost(stringRequest, this.options);
     }
@@ -443,15 +419,11 @@ class SAML {
     } as LogoutRequestXML;
 
     if (req.user!.nameQualifier != null) {
-      request["samlp:LogoutRequest"]["saml:NameID"][
-        "@NameQualifier"
-      ] = req.user!.nameQualifier;
+      request["samlp:LogoutRequest"]["saml:NameID"]["@NameQualifier"] = req.user!.nameQualifier;
     }
 
     if (req.user!.spNameQualifier != null) {
-      request["samlp:LogoutRequest"]["saml:NameID"][
-        "@SPNameQualifier"
-      ] = req.user!.spNameQualifier;
+      request["samlp:LogoutRequest"]["saml:NameID"]["@SPNameQualifier"] = req.user!.spNameQualifier;
     }
 
     if (req.user!.sessionIndex) {
@@ -461,10 +433,7 @@ class SAML {
       };
     }
 
-    await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(
-      id,
-      instant
-    );
+    await util.promisify(this.cacheProvider.save).bind(this.cacheProvider)(id, instant);
     return xmlbuilder.create((request as unknown) as Record<string, any>).end();
   }
 
@@ -545,9 +514,7 @@ class SAML {
     });
     if (this.options.privateKey) {
       if (!this.options.entryPoint) {
-        throw new Error(
-          '"entryPoint" config parameter is required for signed messages'
-        );
+        throw new Error('"entryPoint" config parameter is required for signed messages');
       }
 
       // sets .SigAlg and .Signature
@@ -571,8 +538,7 @@ class SAML {
   ) {
     const additionalParams: querystring.ParsedUrlQuery = {};
 
-    const RelayState =
-      (req.query && req.query.RelayState) || (req.body && req.body.RelayState);
+    const RelayState = (req.query && req.query.RelayState) || (req.body && req.body.RelayState);
     if (RelayState) {
       additionalParams.RelayState = RelayState;
     }
@@ -584,12 +550,10 @@ class SAML {
 
     let optionsAdditionalParamsForThisOperation: Record<string, string> = {};
     if (operation == "authorize") {
-      optionsAdditionalParamsForThisOperation =
-        this.options.additionalAuthorizeParams || {};
+      optionsAdditionalParamsForThisOperation = this.options.additionalAuthorizeParams || {};
     }
     if (operation == "logout") {
-      optionsAdditionalParamsForThisOperation =
-        this.options.additionalLogoutParams || {};
+      optionsAdditionalParamsForThisOperation = this.options.additionalLogoutParams || {};
     }
 
     Object.keys(optionsAdditionalParamsForThisOperation).forEach(function (k) {
@@ -615,15 +579,8 @@ class SAML {
     util.callbackify(() => this.getAuthorizeUrlAsync(req, options))(callback);
   }
 
-  async getAuthorizeUrlAsync(
-    req: Request,
-    options: AuthenticateOptions & AuthorizeOptions
-  ) {
-    const request = await this.generateAuthorizeRequestAsync(
-      req,
-      this.options.passive,
-      false
-    );
+  async getAuthorizeUrlAsync(req: Request, options: AuthenticateOptions & AuthorizeOptions) {
+    const request = await this.generateAuthorizeRequestAsync(req, this.options.passive, false);
     const operation = "authorize";
     const overrideParams = options ? options.additionalParams || {} : {};
     return await this.requestToUrlAsync(
@@ -637,10 +594,7 @@ class SAML {
   /**
    * @deprecated
    */
-  getAuthorizeForm(
-    req: Request,
-    callback: (err: Error | null, data?: unknown) => void
-  ) {
+  getAuthorizeForm(req: Request, callback: (err: Error | null, data?: unknown) => void) {
     util.callbackify(() => this.getAuthorizeFormAsync(req))(callback);
   }
   async getAuthorizeFormAsync(req: Request) {
@@ -674,11 +628,7 @@ class SAML {
       );
     };
 
-    const request = await this.generateAuthorizeRequestAsync(
-      req,
-      this.options.passive,
-      true
-    );
+    const request = await this.generateAuthorizeRequestAsync(req, this.options.passive, true);
     let buffer: Buffer;
     if (this.options.skipRequestCompression) {
       buffer = Buffer.from(request!, "utf8");
@@ -698,13 +648,7 @@ class SAML {
 
     const formInputs = Object.keys(samlMessage)
       .map((k) => {
-        return (
-          '<input type="hidden" name="' +
-          k +
-          '" value="' +
-          quoteattr(samlMessage[k]) +
-          '" />'
-        );
+        return '<input type="hidden" name="' + k + '" value="' + quoteattr(samlMessage[k]) + '" />';
       })
       .join("\r\n");
 
@@ -719,9 +663,7 @@ class SAML {
       "<noscript>",
       "<p><strong>Note:</strong> Since your browser does not support JavaScript, you must press the button below once to proceed.</p>",
       "</noscript>",
-      '<form method="post" action="' +
-        encodeURI(this.options.entryPoint) +
-        '">',
+      '<form method="post" action="' + encodeURI(this.options.entryPoint) + '">',
       formInputs,
       '<input type="submit" value="Submit" />',
       "</form>",
@@ -741,10 +683,7 @@ class SAML {
   ) {
     util.callbackify(() => this.getLogoutUrlAsync(req, options))(callback);
   }
-  async getLogoutUrlAsync(
-    req: RequestWithUser,
-    options: AuthenticateOptions & AuthorizeOptions
-  ) {
+  async getLogoutUrlAsync(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions) {
     const request = await this.generateLogoutRequest(req);
     const operation = "logout";
     const overrideParams = options ? options.additionalParams || {} : {};
@@ -761,9 +700,7 @@ class SAML {
     options: AuthenticateOptions & AuthorizeOptions,
     callback: (err: Error | null, url?: string | null) => void
   ) {
-    util.callbackify(() => this.getLogoutResponseUrlAsync(req, options))(
-      callback
-    );
+    util.callbackify(() => this.getLogoutResponseUrlAsync(req, options))(callback);
   }
   async getLogoutResponseUrlAsync(
     req: RequestWithUser,
@@ -783,10 +720,8 @@ class SAML {
   certToPEM(cert: string): string {
     cert = cert.match(/.{1,64}/g)!.join("\n");
 
-    if (cert.indexOf("-BEGIN CERTIFICATE-") === -1)
-      cert = "-----BEGIN CERTIFICATE-----\n" + cert;
-    if (cert.indexOf("-END CERTIFICATE-") === -1)
-      cert = cert + "\n-----END CERTIFICATE-----\n";
+    if (cert.indexOf("-BEGIN CERTIFICATE-") === -1) cert = "-----BEGIN CERTIFICATE-----\n" + cert;
+    if (cert.indexOf("-END CERTIFICATE-") === -1) cert = cert + "\n-----END CERTIFICATE-----\n";
 
     return cert;
   }
@@ -817,11 +752,7 @@ class SAML {
   //
   // See https://github.com/bergie/passport-saml/issues/19 for references to some of the attack
   //   vectors against SAML signature verification.
-  validateSignature(
-    fullXml: string,
-    currentNode: HTMLElement,
-    certs: string[]
-  ) {
+  validateSignature(fullXml: string, currentNode: HTMLElement, certs: string[]) {
     const xpathSigQuery =
       ".//*[" +
       "local-name(.)='Signature' and " +
@@ -839,12 +770,7 @@ class SAML {
 
     const signature = signatures[0];
     return certs.some((certToCheck) => {
-      return this.validateSignatureForCert(
-        signature as string,
-        certToCheck,
-        fullXml,
-        currentNode
-      );
+      return this.validateSignatureForCert(signature as string, certToCheck, fullXml, currentNode);
     });
   }
 
@@ -890,11 +816,7 @@ class SAML {
    */
   validatePostResponse(
     container: Record<string, string>,
-    callback: (
-      err: Error | null,
-      profile?: Profile | null,
-      loggedOut?: boolean
-    ) => void
+    callback: (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => void
   ) {
     this.validatePostResponseAsync(container)
       .then((res) => callback(null, res.profile, res.loggedOut))
@@ -918,19 +840,14 @@ class SAML {
       ) as Attr[];
 
       if (inResponseToNodes) {
-        inResponseTo = inResponseToNodes.length
-          ? inResponseToNodes[0].nodeValue
-          : null;
+        inResponseTo = inResponseToNodes.length ? inResponseToNodes[0].nodeValue : null;
 
         await this.validateInResponseTo(inResponseTo);
       }
       const certs = await this.certsToCheck();
       // Check if this document has a valid top-level signature
       let validSignature = false;
-      if (
-        this.options.cert &&
-        this.validateSignature(xml, doc.documentElement, certs!)
-      ) {
+      if (this.options.cert && this.validateSignature(xml, doc.documentElement, certs!)) {
         validSignature = true;
       }
 
@@ -971,18 +888,16 @@ class SAML {
         const encryptedAssertionXml = encryptedAssertions[0].toString();
 
         const xmlencOptions = { key: this.options.decryptionPvk };
-        const decryptedXml: string = await util
-          .promisify(xmlenc.decrypt)
-          .bind(xmlenc)(encryptedAssertionXml, xmlencOptions);
-        const decryptedDoc = new xmldom.DOMParser().parseFromString(
-          decryptedXml
+        const decryptedXml: string = await util.promisify(xmlenc.decrypt).bind(xmlenc)(
+          encryptedAssertionXml,
+          xmlencOptions
         );
+        const decryptedDoc = new xmldom.DOMParser().parseFromString(decryptedXml);
         const decryptedAssertions = xmlCrypto.xpath(
           decryptedDoc,
           "/*[local-name()='Assertion']"
         ) as HTMLElement[];
-        if (decryptedAssertions.length != 1)
-          throw new Error("Invalid EncryptedAssertion content");
+        if (decryptedAssertions.length != 1) throw new Error("Invalid EncryptedAssertion content");
 
         if (
           this.options.cert &&
@@ -1017,14 +932,12 @@ class SAML {
             const statusCode = status[0].StatusCode;
             if (
               statusCode &&
-              statusCode[0].$.Value ===
-                "urn:oasis:names:tc:SAML:2.0:status:Responder"
+              statusCode[0].$.Value === "urn:oasis:names:tc:SAML:2.0:status:Responder"
             ) {
               const nestedStatusCode = statusCode[0].StatusCode;
               if (
                 nestedStatusCode &&
-                nestedStatusCode[0].$.Value ===
-                  "urn:oasis:names:tc:SAML:2.0:status:NoPassive"
+                nestedStatusCode[0].$.Value === "urn:oasis:names:tc:SAML:2.0:status:NoPassive"
               ) {
                 if (this.options.cert && !validSignature) {
                   throw new Error("Invalid signature: NoPassive");
@@ -1045,17 +958,13 @@ class SAML {
                 } else if (statusCode[0].StatusCode) {
                   msg = statusCode[0].StatusCode[0].$.Value.match(/[^:]*$/)[0];
                 }
-                const error = new Error(
-                  "SAML provider returned " + msgType + " error: " + msg
-                );
+                const error = new Error("SAML provider returned " + msgType + " error: " + msg);
                 const builderOpts = {
                   rootName: "Status",
                   headless: true,
                 };
                 // @ts-expect-error adding extra attr to default Error object
-                error.statusXml = new xml2js.Builder(builderOpts).buildObject(
-                  status[0]
-                );
+                error.statusXml = new xml2js.Builder(builderOpts).buildObject(status[0]);
                 throw error;
               }
             }
@@ -1076,9 +985,7 @@ class SAML {
     } catch (err) {
       debug("validatePostResponse resulted in an error: %s", err);
       if (this.options.validateInResponseTo) {
-        await util
-          .promisify(this.cacheProvider.remove)
-          .bind(this.cacheProvider)(inResponseTo!);
+        await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo!);
       }
       throw err;
     }
@@ -1087,9 +994,9 @@ class SAML {
   async validateInResponseTo(inResponseTo: string | null) {
     if (this.options.validateInResponseTo) {
       if (inResponseTo) {
-        const result = await util
-          .promisify(this.cacheProvider.get)
-          .bind(this.cacheProvider)(inResponseTo);
+        const result = await util.promisify(this.cacheProvider.get).bind(this.cacheProvider)(
+          inResponseTo
+        );
         if (!result) throw new Error("InResponseTo is not valid");
         return;
       } else {
@@ -1106,11 +1013,7 @@ class SAML {
   validateRedirect(
     container: ParsedQs,
     originalQuery: string | null,
-    callback: (
-      err: Error | null,
-      profile?: Profile | null,
-      loggedOut?: boolean
-    ) => void
+    callback: (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => void
   ) {
     this.validateRedirectAsync(container, originalQuery)
       .then((res) => callback(null, res.profile, res.loggedOut))
@@ -1121,9 +1024,7 @@ class SAML {
     container: ParsedQs,
     originalQuery: string | null
   ): Promise<{ profile?: Profile | null; loggedOut?: boolean }> {
-    const samlMessageType = container.SAMLRequest
-      ? "SAMLRequest"
-      : "SAMLResponse";
+    const samlMessageType = container.SAMLRequest ? "SAMLRequest" : "SAMLResponse";
 
     const data = Buffer.from(container[samlMessageType] as string, "base64");
     const inflated = await inflateRawAsync(data);
@@ -1242,10 +1143,7 @@ class SAML {
       if (issuer) {
         if (issuer[0]._ !== this.options.idpIssuer)
           throw new Error(
-            "Unknown SAML issuer. Expected: " +
-              this.options.idpIssuer +
-              " Received: " +
-              issuer[0]._
+            "Unknown SAML issuer. Expected: " + this.options.idpIssuer + " Received: " + issuer[0]._
           );
       } else {
         throw new Error("Missing SAML issuer");
@@ -1326,12 +1224,8 @@ class SAML {
           subjectConfirmation && subjectConfirmation.SubjectConfirmationData
             ? subjectConfirmation.SubjectConfirmationData[0]
             : null;
-        if (
-          subject[0].SubjectConfirmation &&
-          subject[0].SubjectConfirmation.length > 1
-        ) {
-          msg =
-            "Unable to process multiple SubjectConfirmations in SAML assertion";
+        if (subject[0].SubjectConfirmation && subject[0].SubjectConfirmation.length > 1) {
+          msg = "Unable to process multiple SubjectConfirmations in SAML assertion";
           throw new Error(msg);
         }
 
@@ -1358,31 +1252,24 @@ class SAML {
         if (subjectConfirmation) {
           if (confirmData && confirmData.$) {
             const subjectInResponseTo = confirmData.$.InResponseTo;
-            if (
-              inResponseTo &&
-              subjectInResponseTo &&
-              subjectInResponseTo != inResponseTo
-            ) {
-              await util
-                .promisify(this.cacheProvider.remove)
-                .bind(this.cacheProvider)(inResponseTo);
+            if (inResponseTo && subjectInResponseTo && subjectInResponseTo != inResponseTo) {
+              await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(
+                inResponseTo
+              );
               throw new Error("InResponseTo is not valid");
             } else if (subjectInResponseTo) {
               let foundValidInResponseTo = false;
-              const result = await util
-                .promisify(this.cacheProvider.get)
-                .bind(this.cacheProvider)(subjectInResponseTo);
+              const result = await util.promisify(this.cacheProvider.get).bind(this.cacheProvider)(
+                subjectInResponseTo
+              );
               if (result) {
                 const createdAt = new Date(result);
-                if (
-                  nowMs <
-                  createdAt.getTime() + this.options.requestIdExpirationPeriodMs
-                )
+                if (nowMs < createdAt.getTime() + this.options.requestIdExpirationPeriodMs)
                   foundValidInResponseTo = true;
               }
-              await util
-                .promisify(this.cacheProvider.remove)
-                .bind(this.cacheProvider)(inResponseTo);
+              await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(
+                inResponseTo
+              );
               if (!foundValidInResponseTo) {
                 throw new Error("InResponseTo is not valid");
               }
@@ -1390,9 +1277,7 @@ class SAML {
             }
           }
         } else {
-          await util
-            .promisify(this.cacheProvider.remove)
-            .bind(this.cacheProvider)(inResponseTo);
+          await util.promisify(this.cacheProvider.remove).bind(this.cacheProvider)(inResponseTo);
           break getInResponseTo;
         }
       } else {
@@ -1438,9 +1323,7 @@ class SAML {
 
       if (attributes) {
         attributes.forEach((attribute) => {
-          if (
-            !Object.prototype.hasOwnProperty.call(attribute, "AttributeValue")
-          ) {
+          if (!Object.prototype.hasOwnProperty.call(attribute, "AttributeValue")) {
             // if attributes has no AttributeValue child, continue
             return;
           }
@@ -1471,11 +1354,7 @@ class SAML {
     return { profile, loggedOut: false };
   }
 
-  checkTimestampsValidityError(
-    nowMs: number,
-    notBefore: string,
-    notOnOrAfter: string
-  ) {
+  checkTimestampsValidityError(nowMs: number, notBefore: string, notOnOrAfter: string) {
     if (this.options.acceptedClockSkewMs == -1) return null;
 
     if (notBefore) {
@@ -1501,14 +1380,8 @@ class SAML {
     }
     const errors = audienceRestrictions
       .map((restriction) => {
-        if (
-          !restriction.Audience ||
-          !restriction.Audience[0] ||
-          !restriction.Audience[0]._
-        ) {
-          return new Error(
-            "SAML assertion AudienceRestriction has no Audience value"
-          );
+        if (!restriction.Audience || !restriction.Audience[0] || !restriction.Audience[0]._) {
+          return new Error("SAML assertion AudienceRestriction has no Audience value");
         }
         if (restriction.Audience[0]._ !== expectedAudience) {
           return new Error("SAML assertion audience mismatch");
@@ -1529,11 +1402,7 @@ class SAML {
    */
   validatePostRequest(
     container: Record<string, string>,
-    callback: (
-      err: Error | null,
-      profile?: Profile,
-      loggedOut?: boolean
-    ) => void
+    callback: (err: Error | null, profile?: Profile, loggedOut?: boolean) => void
   ) {
     this.validatePostRequestAsync(container)
       .then((res) => callback(null, res.profile, res.loggedOut))
@@ -1553,10 +1422,7 @@ class SAML {
     const parser = new xml2js.Parser(parserConfig);
     const doc = await parser.parseStringPromise(xml);
     const certs = await this.certsToCheck();
-    if (
-      this.options.cert &&
-      !this.validateSignature(xml, dom.documentElement, certs!)
-    ) {
+    if (this.options.cert && !this.validateSignature(xml, dom.documentElement, certs!)) {
       throw new Error("Invalid signature on documentElement");
     }
     return await processValidlySignedPostRequestAsync(this, doc, dom);
@@ -1565,14 +1431,8 @@ class SAML {
   /**
    * @deprecated
    */
-  getNameID(
-    self: SAML,
-    doc: Node,
-    callback: (err: Error | null, nameID?: XMLOutput) => void
-  ) {
-    return util.callbackify(() => this.getNameIDAsync(self, doc)).bind(this)(
-      callback
-    );
+  getNameID(self: SAML, doc: Node, callback: (err: Error | null, nameID?: XMLOutput) => void) {
+    return util.callbackify(() => this.getNameIDAsync(self, doc)).bind(this)(callback);
   }
 
   async getNameIDAsync(self: SAML, doc: Node): Promise<NameID> {
@@ -1596,10 +1456,7 @@ class SAML {
         throw new Error("No decryption key for encrypted SAML response");
       }
 
-      const encryptedDatas = xmlCrypto.xpath(
-        encryptedIds[0],
-        "./*[local-name()='EncryptedData']"
-      );
+      const encryptedDatas = xmlCrypto.xpath(encryptedIds[0], "./*[local-name()='EncryptedData']");
 
       if (encryptedDatas.length !== 1) {
         throw new Error("Invalid LogoutRequest");
@@ -1607,14 +1464,12 @@ class SAML {
       const encryptedDataXml = encryptedDatas[0].toString();
 
       const xmlencOptions = { key: self.options.decryptionPvk };
-      const decryptedXml: string = await util
-        .promisify(xmlenc.decrypt)
-        .bind(xmlenc)(encryptedDataXml, xmlencOptions);
+      const decryptedXml: string = await util.promisify(xmlenc.decrypt).bind(xmlenc)(
+        encryptedDataXml,
+        xmlencOptions
+      );
       const decryptedDoc = new xmldom.DOMParser().parseFromString(decryptedXml);
-      const decryptedIds = xmlCrypto.xpath(
-        decryptedDoc,
-        "/*[local-name()='NameID']"
-      ) as Node[];
+      const decryptedIds = xmlCrypto.xpath(decryptedDoc, "/*[local-name()='NameID']") as Node[];
       if (decryptedIds.length !== 1) {
         throw new Error("Invalid EncryptedAssertion content");
       }
@@ -1623,10 +1478,7 @@ class SAML {
     throw new Error("Missing SAML NameID");
   }
 
-  generateServiceProviderMetadata(
-    decryptionCert: string | null,
-    signingCert?: string | null
-  ) {
+  generateServiceProviderMetadata(decryptionCert: string | null, signingCert?: string | null) {
     const metadata: ServiceMetadataXML = {
       EntityDescriptor: {
         "@xmlns": "urn:oasis:names:tc:SAML:2.0:metadata",
@@ -1674,14 +1526,8 @@ class SAML {
       }
 
       if (this.options.decryptionPvk) {
-        decryptionCert = decryptionCert!.replace(
-          /-+BEGIN CERTIFICATE-+\r?\n?/,
-          ""
-        );
-        decryptionCert = decryptionCert.replace(
-          /-+END CERTIFICATE-+\r?\n?/,
-          ""
-        );
+        decryptionCert = decryptionCert!.replace(/-+BEGIN CERTIFICATE-+\r?\n?/, "");
+        decryptionCert = decryptionCert.replace(/-+END CERTIFICATE-+\r?\n?/, "");
         decryptionCert = decryptionCert.replace(/\r\n/g, "\n");
 
         metadata.EntityDescriptor.SPSSODescriptor.KeyDescriptor.push({
diff --git a/src/passport-saml/strategy.ts b/src/passport-saml/strategy.ts
index 646bfac5..93793870 100644
--- a/src/passport-saml/strategy.ts
+++ b/src/passport-saml/strategy.ts
@@ -18,10 +18,7 @@ class Strategy extends PassportStrategy {
   _passReqToCallback?: boolean;
   _authnRequestBinding?: string;
 
-  constructor(
-    options: SamlConfig,
-    verify: VerifyWithRequest | VerifyWithoutRequest
-  ) {
+  constructor(options: SamlConfig, verify: VerifyWithRequest | VerifyWithoutRequest) {
     super();
     if (typeof options == "function") {
       verify = options;
@@ -29,9 +26,7 @@ class Strategy extends PassportStrategy {
     }
 
     if (!verify) {
-      throw new Error(
-        "SAML authentication strategy requires a verify function"
-      );
+      throw new Error("SAML authentication strategy requires a verify function");
     }
 
     // Customizing the name can be useful to support multiple SAML configurations at the same time.
@@ -48,17 +43,10 @@ class Strategy extends PassportStrategy {
     this._authnRequestBinding = options.authnRequestBinding || "HTTP-Redirect";
   }
 
-  authenticate(
-    req: RequestWithUser,
-    options: AuthenticateOptions & AuthorizeOptions
-  ): void {
+  authenticate(req: RequestWithUser, options: AuthenticateOptions & AuthorizeOptions): void {
     options.samlFallback = options.samlFallback || "login-request";
 
-    const validateCallback = (
-      err: Error | null,
-      profile?: Profile | null,
-      loggedOut?: boolean
-    ) => {
+    const validateCallback = (err: Error | null, profile?: Profile | null, loggedOut?: boolean) => {
       if (err) {
         return this.error(err);
       }
@@ -67,11 +55,7 @@ class Strategy extends PassportStrategy {
         req.logout();
         if (profile) {
           req.samlLogoutRequest = profile;
-          return this._saml.getLogoutResponseUrl(
-            req,
-            options,
-            redirectIfSuccess
-          );
+          return this._saml.getLogoutResponseUrl(req, options, redirectIfSuccess);
         }
         return this.pass();
       }
@@ -118,17 +102,14 @@ class Strategy extends PassportStrategy {
       const requestHandler = {
         "login-request": () => {
           if (this._authnRequestBinding === "HTTP-POST") {
-            this._saml.getAuthorizeForm(
-              req,
-              (err: Error | null, data?: any) => {
-                if (err) {
-                  this.error(err);
-                } else {
-                  const res = req.res!;
-                  res.send(data);
-                }
+            this._saml.getAuthorizeForm(req, (err: Error | null, data?: any) => {
+              if (err) {
+                this.error(err);
+              } else {
+                const res = req.res!;
+                res.send(data);
               }
-            );
+            });
           } else {
             // Defaults to HTTP-Redirect
             this._saml.getAuthorizeUrl(req, options, redirectIfSuccess);
@@ -147,10 +128,7 @@ class Strategy extends PassportStrategy {
     }
   }
 
-  logout(
-    req: RequestWithUser,
-    callback: (err: Error | null, url?: string | null) => void
-  ): void {
+  logout(req: RequestWithUser, callback: (err: Error | null, url?: string | null) => void): void {
     this._saml.getLogoutUrl(req, {}, callback);
   }
 
@@ -158,10 +136,7 @@ class Strategy extends PassportStrategy {
     decryptionCert: string | null,
     signingCert?: string | null
   ): string {
-    return this._saml.generateServiceProviderMetadata(
-      decryptionCert,
-      signingCert
-    );
+    return this._saml.generateServiceProviderMetadata(decryptionCert, signingCert);
   }
 }
 
diff --git a/src/passport-saml/types.ts b/src/passport-saml/types.ts
index 93bb4b05..854d3ed3 100644
--- a/src/passport-saml/types.ts
+++ b/src/passport-saml/types.ts
@@ -76,13 +76,7 @@ export interface SamlScopingConfig {
   requesterId?: string[];
 }
 
-export type XMLValue =
-  | string
-  | number
-  | boolean
-  | null
-  | XMLObject
-  | XMLValue[];
+export type XMLValue = string | number | boolean | null | XMLObject | XMLValue[];
 
 export type XMLObject = {
   [key: string]: XMLValue;
@@ -165,10 +159,7 @@ export type VerifyWithoutRequest = (
   done: VerifiedCallback
 ) => void;
 
-export type SamlOptionsCallback = (
-  err: Error | null,
-  samlOptions?: SamlConfig
-) => void;
+export type SamlOptionsCallback = (err: Error | null, samlOptions?: SamlConfig) => void;
 
 export interface MultiSamlConfig extends SamlConfig {
   getSamlOptions(req: express.Request, callback: SamlOptionsCallback): void;
diff --git a/test/multiSamlStrategy.js b/test/multiSamlStrategy.js
index 265226a6..84d54f21 100644
--- a/test/multiSamlStrategy.js
+++ b/test/multiSamlStrategy.js
@@ -12,10 +12,7 @@ describe("Strategy()", function () {
     function getSamlOptions() {
       return {};
     }
-    var strategy = new MultiSamlStrategy(
-      { getSamlOptions: getSamlOptions },
-      verify
-    );
+    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
     strategy.should.be.an.instanceOf(SamlStrategy);
   });
 
@@ -29,10 +26,7 @@ describe("Strategy()", function () {
 
 describe("strategy#authenticate", function () {
   beforeEach(function () {
-    this.superAuthenticateStub = sinon.stub(
-      SamlStrategy.prototype,
-      "authenticate"
-    );
+    this.superAuthenticateStub = sinon.stub(SamlStrategy.prototype, "authenticate");
   });
 
   afterEach(function () {
@@ -88,8 +82,7 @@ describe("strategy#authenticate", function () {
       cert: "deadbeef",
       host: "lvh",
       acceptedClockSkewMs: -1,
-      identifierFormat:
-        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+      identifierFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
       path: "/saml/callback",
       logoutUrl: "http://foo.slo",
       signatureAlgorithm: "sha256",
@@ -100,11 +93,7 @@ describe("strategy#authenticate", function () {
         fn(null, samlOptions);
         sinon.assert.calledOnce(superAuthenticateStub);
         superAuthenticateStub.calledWith(
-          Object.assign(
-            {},
-            { cacheProvider: "mock cache provider" },
-            samlOptions
-          )
+          Object.assign({}, { cacheProvider: "mock cache provider" }, samlOptions)
         );
         done();
       } catch (err2) {
@@ -141,10 +130,7 @@ describe("strategy#logout", function () {
       }
     }
 
-    var strategy = new MultiSamlStrategy(
-      { getSamlOptions: getSamlOptions },
-      verify
-    );
+    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
     strategy.logout();
   });
 
@@ -176,8 +162,7 @@ describe("strategy#logout", function () {
       cert: "deadbeef",
       host: "lvh",
       acceptedClockSkewMs: -1,
-      identifierFormat:
-        "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+      identifierFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
       path: "/saml/callback",
       logoutUrl: "http://foo.slo",
       signatureAlgorithm: "sha256",
@@ -194,10 +179,7 @@ describe("strategy#logout", function () {
       }
     }
 
-    var strategy = new MultiSamlStrategy(
-      { getSamlOptions: getSamlOptions },
-      verify
-    );
+    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
     strategy.logout();
   });
 });
@@ -214,8 +196,7 @@ describe("strategy#generateServiceProviderMetadata", function () {
   });
 
   it("calls super with request and generateServiceProviderMetadata options", function (done) {
-    var superGenerateServiceProviderMetadata = this
-      .superGenerateServiceProviderMetadata;
+    var superGenerateServiceProviderMetadata = this.superGenerateServiceProviderMetadata;
     function getSamlOptions(req, fn) {
       try {
         fn();
@@ -228,16 +209,8 @@ describe("strategy#generateServiceProviderMetadata", function () {
       }
     }
 
-    var strategy = new MultiSamlStrategy(
-      { getSamlOptions: getSamlOptions },
-      verify
-    );
-    strategy.generateServiceProviderMetadata(
-      "foo",
-      "bar",
-      "baz",
-      function () {}
-    );
+    var strategy = new MultiSamlStrategy({ getSamlOptions: getSamlOptions }, verify);
+    strategy.generateServiceProviderMetadata("foo", "bar", "baz", function () {});
   });
 
   it("passes options on to saml strategy", function (done) {
@@ -257,12 +230,7 @@ describe("strategy#generateServiceProviderMetadata", function () {
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata(
-      "foo",
-      "bar",
-      "baz",
-      function () {}
-    );
+    strategy.generateServiceProviderMetadata("foo", "bar", "baz", function () {});
   });
 
   it("should pass error to callback function", function (done) {
@@ -273,19 +241,14 @@ describe("strategy#generateServiceProviderMetadata", function () {
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata(
-      "foo",
-      "bar",
-      "baz",
-      function (error, result) {
-        try {
-          should(error).equal("My error");
-          done();
-        } catch (err2) {
-          done(err2);
-        }
+    strategy.generateServiceProviderMetadata("foo", "bar", "baz", function (error, result) {
+      try {
+        should(error).equal("My error");
+        done();
+      } catch (err2) {
+        done(err2);
       }
-    );
+    });
   });
 
   it("should pass result to callback function", function (done) {
@@ -296,18 +259,13 @@ describe("strategy#generateServiceProviderMetadata", function () {
     };
 
     var strategy = new MultiSamlStrategy(passportOptions, verify);
-    strategy.generateServiceProviderMetadata(
-      "foo",
-      "bar",
-      "baz",
-      function (error, result) {
-        try {
-          should(result).equal("My Metadata Result");
-          done();
-        } catch (err2) {
-          done(err2);
-        }
+    strategy.generateServiceProviderMetadata("foo", "bar", "baz", function (error, result) {
+      try {
+        should(result).equal("My Metadata Result");
+        done();
+      } catch (err2) {
+        done(err2);
       }
-    );
+    });
   });
 });
diff --git a/test/saml-post-signing-tests.js b/test/saml-post-signing-tests.js
index 40c7b705..c4dfc61d 100644
--- a/test/saml-post-signing-tests.js
+++ b/test/saml-post-signing-tests.js
@@ -51,9 +51,7 @@ describe("SAML POST Signing", function () {
     result.should.match(
       /<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/
     );
-    result.should.match(
-      /<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/
-    );
+    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/);
     result.should.match(
       /<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/
     );
@@ -74,9 +72,7 @@ describe("SAML POST Signing", function () {
     result.should.match(
       /<SignatureMethod Algorithm="http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256"/
     );
-    result.should.match(
-      /<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/
-    );
+    result.should.match(/<Transform Algorithm="http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#"\/>/);
     result.should.match(
       /<Transform Algorithm="http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature"\/>/
     );
diff --git a/test/samlTests.js b/test/samlTests.js
index 86848e89..29b4b174 100644
--- a/test/samlTests.js
+++ b/test/samlTests.js
@@ -80,9 +80,7 @@ describe("SAML.js", function () {
             Object.keys(url.parse(target, true).query).should.have.length(3);
             url.parse(target, true).query["key"].should.equal("value");
             url.parse(target, true).query["SAMLRequest"].should.not.be.empty();
-            url
-              .parse(target, true)
-              .query["additionalKey"].should.equal("additionalValue");
+            url.parse(target, true).query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -149,9 +147,7 @@ describe("SAML.js", function () {
             Object.keys(url.parse(target, true).query).should.have.length(3);
             url.parse(target, true).query["key"].should.equal("value");
             url.parse(target, true).query["SAMLRequest"].should.not.be.empty();
-            url
-              .parse(target, true)
-              .query["additionalKey"].should.equal("additionalValue");
+            url.parse(target, true).query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -218,9 +214,7 @@ describe("SAML.js", function () {
             Object.keys(url.parse(target, true).query).should.have.length(3);
             url.parse(target, true).query["key"].should.equal("value");
             url.parse(target, true).query["SAMLResponse"].should.not.be.empty();
-            url
-              .parse(target, true)
-              .query["additionalKey"].should.equal("additionalValue");
+            url.parse(target, true).query["additionalKey"].should.equal("additionalValue");
             done();
           } catch (err2) {
             done(err2);
@@ -241,10 +235,9 @@ describe("SAML.js", function () {
     });
 
     describe("keyToPEM", function () {
-      var [regular, singleline] = [
-        "acme_tools_com.key",
-        "singleline_acme_tools_com.key",
-      ].map(keyFromFile);
+      var [regular, singleline] = ["acme_tools_com.key", "singleline_acme_tools_com.key"].map(
+        keyFromFile
+      );
 
       it("formats singleline keys properly", function () {
         var result = saml.keyToPEM(singleline);
@@ -256,16 +249,14 @@ describe("SAML.js", function () {
         result.should.equal(regular);
       });
 
-      it("does nothing to falsy", function (done) {
+      it("does nothing to falsy", function () {
         var result = saml.keyToPEM(null);
         should.equal(result, null);
-        done();
       });
 
-      it("does nothing to non strings", function (done) {
+      it("does nothing to non strings", function () {
         var result = saml.keyToPEM(1);
         should.equal(result, 1);
-        done();
       });
     });
   });
diff --git a/test/test-signatures.js b/test/test-signatures.js
index 75e905ca..d46ffd2f 100644
--- a/test/test-signatures.js
+++ b/test/test-signatures.js
@@ -8,10 +8,7 @@ describe("Signatures", function () {
   const INVALID_ROOT_SIGNATURE = "Invalid signature on documentElement",
     INVALID_SIGNATURE = "Invalid signature",
     createBody = (pathToXml) => ({
-      SAMLResponse: fs.readFileSync(
-        __dirname + "/static/signatures" + pathToXml,
-        "base64"
-      ),
+      SAMLResponse: fs.readFileSync(__dirname + "/static/signatures" + pathToXml, "base64"),
     }),
     tryCatchTest = (done, func) => (...args) => {
       try {
@@ -20,11 +17,7 @@ describe("Signatures", function () {
         done(ex);
       }
     },
-    testOneResponseBody = (
-      samlResponseBody,
-      shouldErrorWith,
-      amountOfSignatureChecks = 1
-    ) => {
+    testOneResponseBody = (samlResponseBody, shouldErrorWith, amountOfSignatureChecks = 1) => {
       return (done) => {
         //== Instantiate new instance before every test
         const samlObj = new SAML({ cert });
@@ -55,27 +48,15 @@ describe("Signatures", function () {
     //== VALID
     it(
       "R1A - both signed => valid",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-signed.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-signed.xml", false, 1)
     );
     it(
       "R1A - root signed => valid",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-unsigned.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-unsigned.xml", false, 1)
     );
     it(
       "R1A - asrt signed => valid",
-      testOneResponse(
-        "/valid/response.root-unsigned.assertion-signed.xml",
-        false,
-        2
-      )
+      testOneResponse("/valid/response.root-unsigned.assertion-signed.xml", false, 2)
     );
 
     //== INVALID
@@ -89,27 +70,15 @@ describe("Signatures", function () {
     );
     it(
       "R1A - both signed => error",
-      testOneResponse(
-        "/invalid/response.root-signed.assertion-signed.xml",
-        INVALID_SIGNATURE,
-        2
-      )
+      testOneResponse("/invalid/response.root-signed.assertion-signed.xml", INVALID_SIGNATURE, 2)
     );
     it(
       "R1A - root signed => error",
-      testOneResponse(
-        "/invalid/response.root-signed.assertion-unsigned.xml",
-        INVALID_SIGNATURE,
-        2
-      )
+      testOneResponse("/invalid/response.root-signed.assertion-unsigned.xml", INVALID_SIGNATURE, 2)
     );
     it(
       "R1A - asrt signed => error",
-      testOneResponse(
-        "/invalid/response.root-unsigned.assertion-signed.xml",
-        INVALID_SIGNATURE,
-        2
-      )
+      testOneResponse("/invalid/response.root-unsigned.assertion-signed.xml", INVALID_SIGNATURE, 2)
     );
   });
 
@@ -117,27 +86,15 @@ describe("Signatures", function () {
     //== VALID
     it(
       "R1A1Ad - signed root+asrt+advi => valid",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-signed.1advice-signed.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-signed.1advice-signed.xml", false, 1)
     );
     it(
       "R1A1Ad - signed root+asrt => valid",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-signed.1advice-unsigned.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-signed.1advice-unsigned.xml", false, 1)
     );
     it(
       "R1A1Ad - signed asrt+advi => valid",
-      testOneResponse(
-        "/valid/response.root-unsigned.assertion-signed.1advice-signed.xml",
-        false,
-        2
-      )
+      testOneResponse("/valid/response.root-unsigned.assertion-signed.1advice-signed.xml", false, 2)
     );
     it(
       "R1A1Ad - signed root => valid",
@@ -211,19 +168,11 @@ describe("Signatures", function () {
     //== VALID
     it(
       "R1A2Ad - signed root+asrt+advi => error",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-signed.2advice-signed.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-signed.2advice-signed.xml", false, 1)
     );
     it(
       "R1A2Ad - signed root+asrt => error",
-      testOneResponse(
-        "/valid/response.root-signed.assertion-signed.2advice-unsigned.xml",
-        false,
-        1
-      )
+      testOneResponse("/valid/response.root-signed.assertion-signed.2advice-unsigned.xml", false, 1)
     );
     it(
       "R1A2Ad - signed root => error",
@@ -272,13 +221,10 @@ describe("Signatures", function () {
   describe("Signature on saml:Response with non-LF line endings", () => {
     const samlResponseXml = fs
       .readFileSync(
-        __dirname +
-          "/static/signatures/valid/response.root-signed.assertion-signed.xml"
+        __dirname + "/static/signatures/valid/response.root-signed.assertion-signed.xml"
       )
       .toString();
-    const makeBody = (str) => ({
-      SAMLResponse: Buffer.from(str).toString("base64"),
-    });
+    const makeBody = (str) => ({ SAMLResponse: Buffer.from(str).toString("base64") });
 
     it("CRLF line endings", (done) => {
       const body = makeBody(samlResponseXml.replace(/\n/g, "\r\n"));
diff --git a/test/tests.js b/test/tests.js
index 6dcc27c5..262f59b5 100644
--- a/test/tests.js
+++ b/test/tests.js
@@ -51,9 +51,7 @@ describe("passport-saml /", function () {
             "https://frontapp.oktapreview.com/app/frontdev584714_front_1/exk7xdi6axPfombzx0h7/sso/saml",
           cert:
             "MIIDoDCCAoigAwIBAgIGAVaZ04POMA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCGZyb250YXBwMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMB4XDTE2MDgxNzE4NDUzMVoXDTI2MDgxNzE4NDYzMVowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwIZnJvbnRhcHAxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvplQONVwknRy1iBnaoZtsOz28A7XW2tRpFW+0La7RJexbziIwEy1bPZENhfwjPZA1oHHZqi5l315BxXKWJqmmNmbDCFDo+/FYFCoHXliiLm9vqDbR1br6ByqeY0GfxyTPKHZxb2FSes30TffDknpMQd/8kA9YWaW5xDlu2ivWJI+sfcOJOMd6t+gcfXj58a5fP8Mwm6Y220KeZSvrVpEV2KDp9hln7fhhoxHZ7K/BYbidqdwLzeUQXpb6LIrxtKdug2FofS+ONs6yLIQRmrbCB7SVX1QA8JInMn+fzrGtZmFiHR0aFbyhiO78v/ufDa6S+XpYyp2b6D4SnzeggnobAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAJ2wcFVffFHSd9pj6RgoNHXZBsWp0HUZrNekiSbgomr4tSDefWtKb04nFIlRytfVs/k74wmbNiRCE8nDVBrBDFA/+Tv/3PowZXHjXKBofUuScTP4/Tw1N/ywf7V+XY5kV3VmLBL6ax+ULJauR/YGIIMsIc/rS2D04aAcScU9pqVh2ML7nTH7gFqYrxypavmVk6K94vLjs0ggF2TGp7tXCRjeOlPPJS+MOJHJhTBWYFWvBLclU3zcri3ws7GqJMpeiHa7rMoHV0onxWsZTZW57ybaIWKLt1goAooC7hq0rx7oNlOvrys5lllhBySYYC3ycqca/D0+GxXLcEr9QwP7TVw=",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
         },
         expectedStatusCode: 200,
         expectedNameIDStartsWith: "xavier",
@@ -81,8 +79,7 @@ describe("passport-saml /", function () {
             "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0\r\nYzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6\r\nbmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJSNjg5YjA3MzNiY2Nj\r\nYTIyYTEzN2UzNjU0ODMwMzEyMzMyOTQwYjFiZSIgVmVyc2lvbj0iMi4wIiBJ\r\nc3N1ZUluc3RhbnQ9IjIwMTQtMDUtMjhUMDA6MTY6MDhaIiBEZXN0aW5hdGlv\r\nbj0ie3JlY2lwaWVudH0iIEluUmVzcG9uc2VUbz0iX2E2ZmM0NmJlODRlMWUz\r\nY2YzYzUwIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9hcHAub25lbG9naW4uY29t\r\nL3NhbWwvbWV0YWRhdGEvMzcxNzU1PC9zYW1sOklzc3Vlcj48c2FtbHA6U3Rh\r\ndHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6\r\ndGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48\r\nc2FtbDpBc3NlcnRpb24geG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIw\r\nMDEvWE1MU2NoZW1hLWluc3RhbmNlIiBWZXJzaW9uPSIyLjAiIElEPSJwZngz\r\nYjYzYzdiZS1mZTg2LTYyZmQtOGNiNS0xNmFiNjI3M2VmYWEiIElzc3VlSW5z\r\ndGFudD0iMjAxNC0wNS0yOFQwMDoxNjowOFoiPjxzYW1sOklzc3Vlcj5odHRw\r\nczovL2FwcC5vbmVsb2dpbi5jb20vc2FtbC9tZXRhZGF0YS8zNzE3NTU8L3Nh\r\nbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cu\r\ndzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpD\r\nYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53\r\nMy5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1l\r\ndGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1s\r\nZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjcGZ4M2I2M2M3\r\nYmUtZmU4Ni02MmZkLThjYjUtMTZhYjYyNzNlZmFhIj48ZHM6VHJhbnNmb3Jt\r\ncz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcv\r\nMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJh\r\nbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94\r\nbWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRo\r\nb2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRz\r\naWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5EQ25QVFFZQmIxaEtzcGJlNmZn\r\nMVUzcTh4bjQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2Rz\r\nOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPmUwK2FGb21BMCtKQVkw\r\nZjl0S3F6SXVxSVZTU3c3TGlGVXNuZUVES1BCV2RpVHoxc01kZ3IvMnkxZTkr\r\ncmphUzJtUm1DaS92U1FMWTN6VFl6MGhwNm5KTlUxOStUV29YbzlrSFF5V1Q0\r\nS2tlUUw0WHMvZ1ovQW9LQzIwaUhWS3RwUHBzMElRME1sL3FSb291U2l0dDZT\r\nZi9XRHoyTFYvcFdjSDJoeDV0djN4U3czNmhLMk5RYzdxdzdyMW1FWG52Y2pY\r\nUmVZbzhyclZmN1hIR0d4Tm9SSUVJQ1VJaTExMHV2c1dlbVNYZjBaMGR5YjBG\r\nVllPV3VTc1FNRGx6TnBoZUFEQmlmRk80VVRmU0VoRlp2bjhrVkNHWlVJd3Ji\r\nT2haMmQvK1lFdGd5dVRnK3F0c2xnZnk0ZHdkNFR2RWNmdVJ6UVRhemVlZnBy\r\nU0Z5aVFja0FYT2pjdz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5m\r\nbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlFRnpDQ0F2\r\nK2dBd0lCQWdJVUZKc1VqUE03QW1Xdk50RXZVTFNIbFRUTWlMUXdEUVlKS29a\r\nSWh2Y05BUUVGQlFBd1dERUxNQWtHQTFVRUJoTUNWVk14RVRBUEJnTlZCQW9N\r\nQ0ZOMVluTndZV05sTVJVd0V3WURWUVFMREF4UGJtVk1iMmRwYmlCSlpGQXhI\r\nekFkQmdOVkJBTU1Gazl1WlV4dloybHVJRUZqWTI5MWJuUWdOREl6TkRrd0ho\r\nY05NVFF3TlRFek1UZ3dOakV5V2hjTk1Ua3dOVEUwTVRnd05qRXlXakJZTVFz\r\nd0NRWURWUVFHRXdKVlV6RVJNQThHQTFVRUNnd0lVM1ZpYzNCaFkyVXhGVEFU\r\nQmdOVkJBc01ERTl1WlV4dloybHVJRWxrVURFZk1CMEdBMVVFQXd3V1QyNWxU\r\nRzluYVc0Z1FXTmpiM1Z1ZENBME1qTTBPVENDQVNJd0RRWUpLb1pJaHZjTkFR\r\nRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFLckF6SmRZOUZ6Rkx0NWJsQXJKZlB6\r\nZ2k4N0VuRkdsVGZjVjVUMVRVRHdMQmxEa1kvMFpHS25NT3BmM0Q3aWUyQzRw\r\nUEZPSW1Pb2djTTVrcERETDdxeFRYWjFld1hWeWpCZE11MjlORzJDNk56V2VR\r\nVFVNVWppMDFFY0hrQzhvK1B0czhBTmlOT1ljanhFZXloRXl6SktnRWl6YmxZ\r\nek1NS3pkck9FVDZRdXFXbzNDODNLKzUrNWRzakRuMW9vS0dSd2ozSHZnc1lj\r\nRnJRbDlOb2pnUUZqb29id3NpRS83QStPSmhMcEJjeS9uU1Znbm9KYU1mck8r\r\nSnNudWtaUHp0Ym50THZPbDU2K1ZyYTBOOG41TkFZaGFTYXlQaXYvYXloalZn\r\namZYZDF0ak1WVE9pRGtuVU93aXpadUoxWTNRSDk0dlV0QmdwMFdCcEJTcy94\r\nTXlUczhDQXdFQUFhT0IyRENCMVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFV\r\nZERnUVdCQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0RDQmxRWURWUjBq\r\nQklHTk1JR0tnQlJRTzRXcE01Zld3eGliNDlXVHVKa2ZZRGJ4T0tGY3BGb3dX\r\nREVMTUFrR0ExVUVCaE1DVlZNeEVUQVBCZ05WQkFvTUNGTjFZbk53WVdObE1S\r\nVXdFd1lEVlFRTERBeFBibVZNYjJkcGJpQkpaRkF4SHpBZEJnTlZCQU1NRms5\r\ndVpVeHZaMmx1SUVGalkyOTFiblFnTkRJek5EbUNGQlNiRkl6ek93SmxyemJS\r\nTDFDMGg1VTB6SWkwTUE0R0ExVWREd0VCL3dRRUF3SUhnREFOQmdrcWhraUc5\r\ndzBCQVFVRkFBT0NBUUVBQ2REQUFvYVpGQ0VZNXBtZndiS3VLclh0TzVpRThs\r\nV3RpQ1BqQ1pFVXVUNmJYUk5jcXJkbnVWL0VBZlg5V1FvWGphbFBpMGVNNzh6\r\nS21idlJHU1RVSHdXdzQ5UkhqRmZlSlVLdkhOZU5uRmdUWERqRVBOaE12aDY5\r\na0htNDUzbEZSbUIra2s2eWp0WFJaYVFFd1M4VXVvMk90K2tyZ05ibDZvVEJa\r\nSjBBSEgxTXRaRUNEbG9tczFLbTd6c0s4d0FpNWk4VFZJS2tWcjViMlZsaHJM\r\nZ0ZNdnpaNVZpQXhJTUdCNnc0N3lZNFFHUUIvNVE4eWE5aEJzOXZrbit3dWJB\r\nK3lyNGoxNEpYWjdibFZLRFNUWXZhNjVFYStQcUh5cnArV25tbmJ3Mk9iUzdp\r\nV2V4aVR5MWpEM0cwUjJhdkRCRmpNOEZqNURiZnVmc0UxYjBVMTBSVHRnPT08\r\nL2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5m\r\nbz48L2RzOlNpZ25hdHVyZT48c2FtbDpTdWJqZWN0PjxzYW1sOk5hbWVJRCBG\r\nb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9y\r\nbWF0OnRyYW5zaWVudCI+cGxvZXJAc3Vic3BhY2Vzdy5jb208L3NhbWw6TmFt\r\nZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2Fz\r\naXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0\r\nQ29uZmlybWF0aW9uRGF0YSBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjhUMDA6\r\nMTk6MDhaIiBSZWNpcGllbnQ9IntyZWNpcGllbnR9IiBJblJlc3BvbnNlVG89\r\nIl9hNmZjNDZiZTg0ZTFlM2NmM2M1MCIvPjwvc2FtbDpTdWJqZWN0Q29uZmly\r\nbWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVm\r\nb3JlPSIyMDE0LTA1LTI4VDAwOjEzOjA4WiIgTm90T25PckFmdGVyPSIyMDE0\r\nLTA1LTI4VDAwOjE5OjA4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48\r\nc2FtbDpBdWRpZW5jZT57YXVkaWVuY2V9PC9zYW1sOkF1ZGllbmNlPjwvc2Ft\r\nbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1s\r\nOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wNS0yOFQwMDox\r\nNjowN1oiIFNlc3Npb25Ob3RPbk9yQWZ0ZXI9IjIwMTQtMDUtMjlUMDA6MTY6\r\nMDhaIiBTZXNzaW9uSW5kZXg9Il8zMGE0YWY1MC1jODJiLTAxMzEtZjhiNS03\r\nODJiY2I1NmZjYWEiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNv\r\nbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6\r\nY2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRo\r\nbkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpB\r\ndXRoblN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9u\r\nc2U+Cgo=\r\n",
         },
         config: {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
         },
         expectedStatusCode: 200,
@@ -99,11 +96,8 @@ describe("passport-saml /", function () {
           entryPoint: "https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO",
           cert:
             "MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
         },
         expectedStatusCode: 200,
         mockDate: "2014-06-02T17:48:56.820Z",
@@ -159,9 +153,7 @@ describe("passport-saml /", function () {
               if (response.statusCode == 200) {
                 userSerialized.should.be.true;
                 if (check.expectedNameIDStartsWith)
-                  profile.nameID.should.startWith(
-                    check.expectedNameIDStartsWith
-                  );
+                  profile.nameID.should.startWith(check.expectedNameIDStartsWith);
               }
               done();
             } catch (err2) {
@@ -246,8 +238,7 @@ describe("passport-saml /", function () {
           skipRequestCompression: true,
           entryPoint: "https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO",
           cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         },
         samlRequest: {
           SAMLRequest: fs.readFileSync(
@@ -297,34 +288,24 @@ describe("passport-saml /", function () {
               Destination: "https://wwwexampleIdp.com/saml",
             },
             "saml:Issuer": [
-              {
-                _: "onelogin_saml",
-                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-              },
+              { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
             ],
             "samlp:NameIDPolicy": [
               {
                 $: {
                   "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Format:
-                    "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                  Format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
                   AllowCreate: "true",
                 },
               },
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -345,34 +326,24 @@ describe("passport-saml /", function () {
               Destination: "https://wwwexampleIdp.com/saml",
             },
             "saml:Issuer": [
-              {
-                _: "onelogin_saml",
-                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-              },
+              { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
             ],
             "samlp:NameIDPolicy": [
               {
                 $: {
                   "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Format:
-                    "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                  Format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
                   AllowCreate: "true",
                 },
               },
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -417,17 +388,11 @@ describe("passport-saml /", function () {
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -472,17 +437,11 @@ describe("passport-saml /", function () {
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -568,16 +527,11 @@ describe("passport-saml /", function () {
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
                     _: "myAuthnContext",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -622,22 +576,15 @@ describe("passport-saml /", function () {
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
                     _: "myAuthnContext",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                   {
                     _: "myAuthnContext2",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -679,17 +626,11 @@ describe("passport-saml /", function () {
             ],
             "samlp:RequestedAuthnContext": [
               {
-                $: {
-                  "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol",
-                  Comparison: "exact",
-                },
+                $: { "xmlns:samlp": "urn:oasis:names:tc:SAML:2.0:protocol", Comparison: "exact" },
                 "saml:AuthnContextClassRef": [
                   {
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
-                    $: {
-                      "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
-                    },
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
                   },
                 ],
               },
@@ -698,8 +639,7 @@ describe("passport-saml /", function () {
         },
       },
       {
-        name:
-          "Remove NameIDPolicy, AuthnRequest, and AssertionConsumerServiceURL Config",
+        name: "Remove NameIDPolicy, AuthnRequest, and AssertionConsumerServiceURL Config",
         config: {
           identifierFormat: null,
           disableRequestedAuthnContext: true,
@@ -714,10 +654,7 @@ describe("passport-saml /", function () {
               Destination: "https://wwwexampleIdp.com/saml",
             },
             "saml:Issuer": [
-              {
-                _: "onelogin_saml",
-                $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-              },
+              { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
             ],
           },
         },
@@ -781,8 +718,7 @@ describe("passport-saml /", function () {
                     $: {
                       "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                   },
                 ],
               },
@@ -874,8 +810,7 @@ describe("passport-saml /", function () {
                     $: {
                       "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                   },
                 ],
               },
@@ -909,8 +844,7 @@ describe("passport-saml /", function () {
         },
       },
       {
-        name:
-          "Config with Scoping config without proxyCount, requesterId, getComplete",
+        name: "Config with Scoping config without proxyCount, requesterId, getComplete",
         config: {
           issuer: "http://exampleSp.com/saml",
           identifierFormat: "alternateIdentifier",
@@ -965,8 +899,7 @@ describe("passport-saml /", function () {
                     $: {
                       "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                   },
                 ],
               },
@@ -1053,8 +986,7 @@ describe("passport-saml /", function () {
                     $: {
                       "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                   },
                 ],
               },
@@ -1141,8 +1073,7 @@ describe("passport-saml /", function () {
                     $: {
                       "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion",
                     },
-                    _:
-                      "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+                    _: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                   },
                 ],
               },
@@ -1206,10 +1137,7 @@ describe("passport-saml /", function () {
 
         app.get(
           "/login",
-          passport.authenticate("saml", {
-            samlFallback: "login-request",
-            session: false,
-          }),
+          passport.authenticate("saml", { samlFallback: "login-request", session: false }),
           function (req, res) {
             res.status(200).send("200 OK");
           }
@@ -1234,17 +1162,11 @@ describe("passport-saml /", function () {
               var encodedSamlRequest;
               if (check.config.authnRequestBinding === "HTTP-POST") {
                 response.statusCode.should.equal(200);
-                body.should.match(
-                  /<!DOCTYPE html>[^]*<input.*name="SAMLRequest"[^]*<\/html>/
-                );
-                encodedSamlRequest = body.match(
-                  /<input.*name="SAMLRequest" value="([^"]*)"/
-                )[1];
+                body.should.match(/<!DOCTYPE html>[^]*<input.*name="SAMLRequest"[^]*<\/html>/);
+                encodedSamlRequest = body.match(/<input.*name="SAMLRequest" value="([^"]*)"/)[1];
               } else {
                 response.statusCode.should.equal(302);
-                var query = response.headers.location.match(
-                  /^[^\?]*\?(.*)$/
-                )[1];
+                var query = response.headers.location.match(/^[^\?]*\?(.*)$/)[1];
                 encodedSamlRequest = querystring.parse(query).SAMLRequest;
               }
 
@@ -1318,8 +1240,7 @@ describe("passport-saml /", function () {
 
           request(requestOpts, function (err, response, body) {
             try {
-              var encodedSamlResponse = querystring.parse(this.uri.query)
-                .SAMLResponse;
+              var encodedSamlResponse = querystring.parse(this.uri.query).SAMLResponse;
               // An error will exist because the endpoint we're trying to log out of doesn't exist,
               // but we can still test to make sure that everything is behaving as it should.
               // should.not.exist(err);
@@ -1395,10 +1316,7 @@ describe("passport-saml /", function () {
             Destination: "foo",
           },
           "saml:Issuer": [
-            {
-              _: "onelogin_saml",
-              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-            },
+            { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
           ],
           "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
         },
@@ -1438,10 +1356,7 @@ describe("passport-saml /", function () {
             Destination: "foo",
           },
           "saml:Issuer": [
-            {
-              _: "onelogin_saml",
-              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-            },
+            { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
           ],
           "saml:NameID": [
             {
@@ -1495,9 +1410,7 @@ describe("passport-saml /", function () {
           "saml:Issuer": ["onelogin_saml"],
           "samlp:Status": [
             {
-              "samlp:StatusCode": [
-                { $: { Value: "urn:oasis:names:tc:SAML:2.0:status:Success" } },
-              ],
+              "samlp:StatusCode": [{ $: { Value: "urn:oasis:names:tc:SAML:2.0:status:Success" } }],
             },
           ],
         },
@@ -1529,17 +1442,11 @@ describe("passport-saml /", function () {
             Destination: "foo",
           },
           "saml:Issuer": [
-            {
-              _: "onelogin_saml",
-              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-            },
+            { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
           ],
           "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
           "saml2p:SessionIndex": [
-            {
-              _: "session-id",
-              $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" },
-            },
+            { _: "session-id", $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" } },
           ],
         },
       };
@@ -1579,17 +1486,11 @@ describe("passport-saml /", function () {
             Destination: "foo",
           },
           "saml:Issuer": [
-            {
-              _: "onelogin_saml",
-              $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" },
-            },
+            { _: "onelogin_saml", $: { "xmlns:saml": "urn:oasis:names:tc:SAML:2.0:assertion" } },
           ],
           "saml:NameID": [{ _: "bar", $: { Format: "foo" } }],
           "saml2p:SessionIndex": [
-            {
-              _: "session-id",
-              $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" },
-            },
+            { _: "session-id", $: { "xmlns:saml2p": "urn:oasis:names:tc:SAML:2.0:protocol" } },
           ],
         },
       };
@@ -1629,19 +1530,13 @@ describe("passport-saml /", function () {
           __dirname + "/static/testshib encryption cert.pem",
           "utf-8"
         );
-        var metadata = samlObj.generateServiceProviderMetadata(
-          decryptionCert,
-          signingCert
-        );
+        var metadata = samlObj.generateServiceProviderMetadata(decryptionCert, signingCert);
         // splits are to get a nice diff if they don't match for some reason
         metadata.split("\n").should.eql(expectedMetadata.split("\n"));
 
         // verify that we are exposed through Strategy as well
         var strategy = new SamlStrategy(samlConfig, function () {});
-        metadata = strategy.generateServiceProviderMetadata(
-          decryptionCert,
-          signingCert
-        );
+        metadata = strategy.generateServiceProviderMetadata(decryptionCert, signingCert);
         metadata.split("\n").should.eql(expectedMetadata.split("\n"));
       }
 
@@ -1649,11 +1544,8 @@ describe("passport-saml /", function () {
         var samlConfig = {
           issuer: "http://example.serviceprovider.com",
           callbackUrl: "http://example.serviceprovider.com/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expected metadata.xml",
@@ -1667,8 +1559,7 @@ describe("passport-saml /", function () {
         var samlConfig = {
           issuer: "http://example.serviceprovider.com",
           callbackUrl: "http://example.serviceprovider.com/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expected metadata without key.xml",
@@ -1684,11 +1575,8 @@ describe("passport-saml /", function () {
           protocol: "http://",
           host: "example.serviceprovider.com",
           path: "/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expected metadata.xml",
@@ -1704,8 +1592,7 @@ describe("passport-saml /", function () {
           protocol: "http://",
           host: "example.serviceprovider.com",
           path: "/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expected metadata without key.xml",
@@ -1721,22 +1608,15 @@ describe("passport-saml /", function () {
           protocol: "http://",
           host: "example.serviceprovider.com",
           path: "/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
-          privateCert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key"
-          ),
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
+          privateCert: fs.readFileSync(__dirname + "/static/acme_tools_com.key"),
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expectedMetadataWithBothKeys.xml",
           "utf-8"
         );
-        var signingCert = fs
-          .readFileSync(__dirname + "/static/acme_tools_com.cert")
-          .toString();
+        var signingCert = fs.readFileSync(__dirname + "/static/acme_tools_com.cert").toString();
 
         testMetadata(samlConfig, expectedMetadata, signingCert);
       });
@@ -1747,20 +1627,15 @@ describe("passport-saml /", function () {
           protocol: "http://",
           host: "example.serviceprovider.com",
           path: "/saml/callback",
-          identifierFormat:
-            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          decryptionPvk: fs.readFileSync(
-            __dirname + "/static/testshib encryption pvk.pem"
-          ),
+          identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
           privateKey: fs.readFileSync(__dirname + "/static/acme_tools_com.key"),
         };
         var expectedMetadata = fs.readFileSync(
           __dirname + "/static/expectedMetadataWithBothKeys.xml",
           "utf-8"
         );
-        var signingCert = fs
-          .readFileSync(__dirname + "/static/acme_tools_com.cert")
-          .toString();
+        var signingCert = fs.readFileSync(__dirname + "/static/acme_tools_com.cert").toString();
 
         testMetadata(samlConfig, expectedMetadata, signingCert);
       });
@@ -1771,9 +1646,7 @@ describe("passport-saml /", function () {
         issuer: "http://example.serviceprovider.com",
         callbackUrl: "http://example.serviceprovider.com/saml/callback",
         identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-        decryptionPvk: fs.readFileSync(
-          __dirname + "/static/testshib encryption pvk.pem"
-        ),
+        decryptionPvk: fs.readFileSync(__dirname + "/static/testshib encryption pvk.pem"),
         logoutCallbackUrl: "http://example.serviceprovider.com/logout",
       };
 
@@ -1790,19 +1663,13 @@ describe("passport-saml /", function () {
     it("#certToPEM should generate valid certificate", function (done) {
       var samlConfig = {
         entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
-        cert:
-          "-----BEGIN CERTIFICATE-----" +
-          TEST_CERT +
-          "-----END CERTIFICATE-----",
+        cert: "-----BEGIN CERTIFICATE-----" + TEST_CERT + "-----END CERTIFICATE-----",
         acceptedClockSkewMs: -1,
       };
       var samlObj = new SAML(samlConfig);
       var certificate = samlObj.certToPEM(samlConfig.cert);
 
-      if (
-        certificate.match(/BEGIN/g).length == 1 &&
-        certificate.match(/END/g).length == 1
-      ) {
+      if (certificate.match(/BEGIN/g).length == 1 && certificate.match(/END/g).length == 1) {
         done();
       } else {
         done("Certificate should have only 1 BEGIN and 1 END block");
@@ -1812,20 +1679,15 @@ describe("passport-saml /", function () {
     describe("validatePostResponse checks /", function () {
       it("response with junk content should explain the XML or base64 is not valid", function (done) {
         var samlObj = new SAML({ cert: TEST_CERT });
-        samlObj.validatePostResponse(
-          { SAMLResponse: "BOOM" },
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match(
-                /SAMLResponse is not valid base64-encoded XML/
-              );
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse({ SAMLResponse: "BOOM" }, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match(/SAMLResponse is not valid base64-encoded XML/);
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("response with error status message should generate appropriate error", function (done) {
         var xml =
@@ -1833,25 +1695,19 @@ describe("passport-saml /", function () {
         var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlObj = new SAML({
-          cert:
-            "-----BEGIN CERTIFICATE-----" +
-            TEST_CERT +
-            "-----END CERTIFICATE-----",
+          cert: "-----BEGIN CERTIFICATE-----" + TEST_CERT + "-----END CERTIFICATE-----",
         });
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match(/Responder/);
-              err.message.should.match(/Required NameID format not supported/);
-              should.exist(err.statusXml);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match(/Responder/);
+            err.message.should.match(/Required NameID format not supported/);
+            should.exist(err.statusXml);
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("response with error status code should generate appropriate error", function (done) {
@@ -1860,31 +1716,24 @@ describe("passport-saml /", function () {
         var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlObj = new SAML({});
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match(/Responder/);
-              err.message.should.match(/InvalidNameIDPolicy/);
-              should.exist(err.statusXml);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match(/Responder/);
+            err.message.should.match(/InvalidNameIDPolicy/);
+            should.exist(err.statusXml);
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("accept response with an attributeStatement element without attributeValue", function (done) {
-        var fakeClock = sinon.useFakeTimers(
-          Date.parse("2015-08-31T08:55:00+00:00")
-        );
+        var fakeClock = sinon.useFakeTimers(Date.parse("2015-08-31T08:55:00+00:00"));
         var container = {
           SAMLResponse: fs
-            .readFileSync(
-              __dirname + "/static/response-with-uncomplete-attribute.xml"
-            )
+            .readFileSync(__dirname + "/static/response-with-uncomplete-attribute.xml")
             .toString("base64"),
         };
         var samlObj = new SAML();
@@ -1894,9 +1743,7 @@ describe("passport-saml /", function () {
             should.not.exist(err);
             profile.issuer.should.eql("https://evil-corp.com");
             profile.nameID.should.eql("vincent.vega@evil-corp.com");
-            should(profile)
-              .have.property("evil-corp.egroupid")
-              .eql("vincent.vega@evil-corp.com");
+            should(profile).have.property("evil-corp.egroupid").eql("vincent.vega@evil-corp.com");
             // attributes without attributeValue child should be ignored
             should(profile).not.have.property("evilcorp.roles");
 
@@ -1920,43 +1767,32 @@ describe("passport-saml /", function () {
         var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
           validateInResponseTo: true,
         };
         var samlObj = new SAML(samlConfig);
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("Invalid signature");
+          } catch (err2) {
+            done(err2);
+          }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
             try {
               should.exist(err);
-              err.message.should.match("Invalid signature");
+              err.message.should.match("InResponseTo is not valid");
+              done();
             } catch (err2) {
               done(err2);
             }
-            samlObj.validatePostResponse(
-              container,
-              function (err, profile, logout) {
-                try {
-                  should.exist(err);
-                  err.message.should.match("InResponseTo is not valid");
-                  done();
-                } catch (err2) {
-                  done(err2);
-                }
-              }
-            );
-          }
-        );
+          });
+        });
       });
 
       describe("validatePostResponse xml signature checks /", function () {
@@ -1969,8 +1805,7 @@ describe("passport-saml /", function () {
         });
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
         };
         it("valid onelogin xml document should validate", function (done) {
@@ -1983,18 +1818,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(samlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.not.exist(err);
-                profile.nameID.should.startWith("ploer");
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("onelogin xml document with altered assertion should fail", function (done) {
@@ -2007,18 +1839,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(samlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.exist(err);
-                err.message.should.match(/Invalid signature/);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Invalid signature/);
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("onelogin xml document with duplicate altered assertion should fail", function (done) {
@@ -2034,18 +1863,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(samlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.exist(err);
-                err.message.should.match(/Invalid signature/);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Invalid signature/);
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("onelogin xml document with extra unsigned & altered assertion should fail", function (done) {
@@ -2059,18 +1885,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(samlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.exist(err);
-                err.message.should.match(/Invalid signature/);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Invalid signature/);
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("onelogin xml document with extra nexted assertion should fail", function (done) {
@@ -2087,18 +1910,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(samlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.exist(err);
-                err.message.should.match(/Invalid signature/);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.exist(err);
+              err.message.should.match(/Invalid signature/);
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("multiple certs should validate with one of the certs", function (done) {
@@ -2115,18 +1935,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(multiCertSamlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.not.exist(err);
-                profile.nameID.should.startWith("ploer");
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("cert as a function should validate with the returned cert", function (done) {
@@ -2145,18 +1962,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(functionCertSamlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.not.exist(err);
-                profile.nameID.should.startWith("ploer");
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("cert as a function should validate with one of the returned certs", function (done) {
@@ -2175,18 +1989,15 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(functionMultiCertSamlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                should.not.exist(err);
-                profile.nameID.should.startWith("ploer");
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              should.not.exist(err);
+              profile.nameID.should.startWith("ploer");
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("cert as a function should return an error if the cert function returns an error", function (done) {
@@ -2206,17 +2017,14 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML(functionErrorCertSamlConfig);
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              try {
-                err.should.eql(errorToReturn);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            try {
+              err.should.eql(errorToReturn);
+              done();
+            } catch (err2) {
+              done(err2);
             }
-          );
+          });
         });
 
         it("XML AttributeValue should return object", function (done) {
@@ -2247,19 +2055,16 @@ describe("passport-saml /", function () {
           var base64xml = Buffer.from(xml).toString("base64");
           var container = { SAMLResponse: base64xml };
           var samlObj = new SAML();
-          samlObj.validatePostResponse(
-            container,
-            function (err, profile, logout) {
-              should.not.exist(err);
-              const eptid = profile["urn:oid:1.3.6.1.4.1.5923.1.1.1.10"];
-              const nameid = eptid["NameID"][0];
-              nameid._.should.eql(nameid_opaque_string);
-              nameid.$.NameQualifier.should.equal(nameQualifier);
-              nameid.$.SPNameQualifier.should.equal(spNameQualifier);
-              nameid.$.Format.should.equal(format);
-              done();
-            }
-          );
+          samlObj.validatePostResponse(container, function (err, profile, logout) {
+            should.not.exist(err);
+            const eptid = profile["urn:oid:1.3.6.1.4.1.5923.1.1.1.10"];
+            const nameid = eptid["NameID"][0];
+            nameid._.should.eql(nameid_opaque_string);
+            nameid.$.NameQualifier.should.equal(nameQualifier);
+            nameid.$.SPNameQualifier.should.equal(spNameQualifier);
+            nameid.$.Format.should.equal(format);
+            done();
+          });
         });
       });
 
@@ -2280,14 +2085,11 @@ describe("passport-saml /", function () {
         var base64xml = Buffer.from(xml).toString("base64");
         var container = { SAMLResponse: base64xml };
         var samlObj = new SAML();
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            should.not.exist(err);
-            should(profile["attributeName"]).be.undefined();
-            done();
-          }
-        );
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          should.not.exist(err);
+          should(profile["attributeName"]).be.undefined();
+          done();
+        });
       });
     });
 
@@ -2305,10 +2107,7 @@ describe("passport-saml /", function () {
           entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateCert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateCert: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
@@ -2323,18 +2122,12 @@ describe("passport-saml /", function () {
         };
         samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require("querystring").parse(
-              require("url").parse(url).query
-            );
-            qry.SigAlg.should.match(
-              "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
-            );
+            var qry = require("querystring").parse(require("url").parse(url).query);
+            qry.SigAlg.should.match("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
             qry.Signature.should.match(
               "hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA=="
             );
-            qry.customQueryStringParam.should.match(
-              "CustomQueryStringParamValue"
-            );
+            qry.customQueryStringParam.should.match("CustomQueryStringParamValue");
             done();
           } catch (err2) {
             done(err2);
@@ -2346,10 +2139,7 @@ describe("passport-saml /", function () {
           entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateKey: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateKey: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
@@ -2364,18 +2154,12 @@ describe("passport-saml /", function () {
         };
         samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require("querystring").parse(
-              require("url").parse(url).query
-            );
-            qry.SigAlg.should.match(
-              "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
-            );
+            var qry = require("querystring").parse(require("url").parse(url).query);
+            qry.SigAlg.should.match("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
             qry.Signature.should.match(
               "hel9NaoLU0brY/VhrQsY+lTtuAbTsT/ul6nZ/eVlSMXQRaKn5LTbKadzxmPghX7s4xoHwdah+yZHK/0u4StYSj4b5MKcqbsJapVr2R7H90z8YfGfR2C/G0Gng721YV9Da6VBzKg8Was91zQotgsMpZ9pGX1kPKi6cgFwPwM4NEFugn8AYgXEriNvO5+Q23K/MdBT2bgwRTj2FQCWTuQcgwbyWHXoquHztZ0lbh8UhY5BfQRv7c6D9XPkQEMMQFQeME4PIEg3JnynwFZk5wwhkphMd5nXxau+zt7Nfp4fRm0G8WYnxV1etBnWimwSglZVaSHFYeQBRsC2wvKSiVS8JA=="
             );
-            qry.customQueryStringParam.should.match(
-              "CustomQueryStringParamValue"
-            );
+            qry.customQueryStringParam.should.match("CustomQueryStringParamValue");
             done();
           } catch (err2) {
             done(err2);
@@ -2387,10 +2171,7 @@ describe("passport-saml /", function () {
           entryPoint: "",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateCert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateCert: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           signatureAlgorithm: "sha256",
@@ -2408,9 +2189,7 @@ describe("passport-saml /", function () {
         samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
           try {
             should.exist(err);
-            err.message.should.eql(
-              '"entryPoint" config parameter is required for signed messages'
-            );
+            err.message.should.eql('"entryPoint" config parameter is required for signed messages');
             done();
           } catch (err2) {
             done(err2);
@@ -2422,10 +2201,7 @@ describe("passport-saml /", function () {
           entryPoint: "",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateKey: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateKey: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           signatureAlgorithm: "sha256",
@@ -2443,9 +2219,7 @@ describe("passport-saml /", function () {
         samlObj.requestToUrl(request, null, "authorize", {}, function (err) {
           try {
             should.exist(err);
-            err.message.should.eql(
-              '"entryPoint" config parameter is required for signed messages'
-            );
+            err.message.should.eql('"entryPoint" config parameter is required for signed messages');
             done();
           } catch (err2) {
             done(err2);
@@ -2457,10 +2231,7 @@ describe("passport-saml /", function () {
           entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateCert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateCert: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
@@ -2475,18 +2246,12 @@ describe("passport-saml /", function () {
         };
         samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require("querystring").parse(
-              require("url").parse(url).query
-            );
-            qry.SigAlg.should.match(
-              "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
-            );
+            var qry = require("querystring").parse(require("url").parse(url).query);
+            qry.SigAlg.should.match("http://www.w3.org/2000/09/xmldsig#rsa-sha1");
             qry.Signature.should.match(
               "MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q=="
             );
-            qry.customQueryStringParam.should.match(
-              "CustomQueryStringParamValue"
-            );
+            qry.customQueryStringParam.should.match("CustomQueryStringParamValue");
             done();
           } catch (err2) {
             done(err2);
@@ -2498,10 +2263,7 @@ describe("passport-saml /", function () {
           entryPoint: "https://adfs.acme_tools.com/adfs/ls/",
           issuer: "acme_tools_com",
           callbackUrl: "https://relyingparty/adfs/postResponse",
-          privateKey: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.key",
-            "utf-8"
-          ),
+          privateKey: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "utf-8"),
           authnContext:
             "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
           identifierFormat: null,
@@ -2516,18 +2278,12 @@ describe("passport-saml /", function () {
         };
         samlObj.getAuthorizeUrl({}, {}, function (err, url) {
           try {
-            var qry = require("querystring").parse(
-              require("url").parse(url).query
-            );
-            qry.SigAlg.should.match(
-              "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
-            );
+            var qry = require("querystring").parse(require("url").parse(url).query);
+            qry.SigAlg.should.match("http://www.w3.org/2000/09/xmldsig#rsa-sha1");
             qry.Signature.should.match(
               "MeFo+LjufxP5A+sCRwzR/YH/RV6W14aYSFjUdie62JxkI6hDcVhoSZQUJ3wtWMhL59gJj05tTFnXAZRqUQVsavyy41cmUZVeCsat0gaHBQOILXpp9deB0iSJt1EVQTOJkVx8uu2/WYu/bBiH7w2bpwuCf1gJhlqZb/ca3B6yjHSMjnnVfc2LbNPWHpE5464lrs79VjDXf9GQWfrBr95dh3P51IAb7C+77KDWQUl9WfZfyyuEgS83vyZ0UGOxT4AObJ6NOcLs8+iidDdWJJkBaKQev6U+AghCjLQUYOrflivLIIyqATKu2q9PbOse6Phmnxok50+broXSG23+e+742Q=="
             );
-            qry.customQueryStringParam.should.match(
-              "CustomQueryStringParamValue"
-            );
+            qry.customQueryStringParam.should.match("CustomQueryStringParamValue");
             done();
           } catch (err2) {
             done(err2);
@@ -2539,8 +2295,7 @@ describe("passport-saml /", function () {
     describe("getAdditionalParams checks /", function () {
       it("should not pass any additional params by default", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
         var samlObj = new SAML(samlConfig);
 
@@ -2552,8 +2307,7 @@ describe("passport-saml /", function () {
 
       it("should not pass any additional params by default apart from the RelayState in request query", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
         var samlObj = new SAML(samlConfig);
 
@@ -2570,8 +2324,7 @@ describe("passport-saml /", function () {
 
       it("should not pass any additional params by default apart from the RelayState in request body", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
         };
         var samlObj = new SAML(samlConfig);
 
@@ -2588,8 +2341,7 @@ describe("passport-saml /", function () {
 
       it("should pass additional params with all operations if set in additionalParams", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
             queryParam: "queryParamValue",
           },
@@ -2605,22 +2357,16 @@ describe("passport-saml /", function () {
 
       it('should pass additional params with "authorize" operations if set in additionalAuthorizeParams', function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalAuthorizeParams: {
             queryParam: "queryParamValue",
           },
         };
         var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams(
-          {},
-          "authorize"
-        );
+        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, "authorize");
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({
-          queryParam: "queryParamValue",
-        });
+        additionalAuthorizeParams.should.containEql({ queryParam: "queryParamValue" });
 
         var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         additionalLogoutParams.should.be.empty;
@@ -2628,31 +2374,24 @@ describe("passport-saml /", function () {
 
       it('should pass additional params with "logout" operations if set in additionalLogoutParams', function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalLogoutParams: {
             queryParam: "queryParamValue",
           },
         };
         var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams(
-          {},
-          "authorize"
-        );
+        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, "authorize");
         additionalAuthorizeParams.should.be.empty;
 
         var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({
-          queryParam: "queryParamValue",
-        });
+        additionalLogoutParams.should.containEql({ queryParam: "queryParamValue" });
       });
 
       it("should merge additionalLogoutParams and additionalAuthorizeParams with additionalParams", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
             queryParam1: "queryParamValue",
           },
@@ -2665,10 +2404,7 @@ describe("passport-saml /", function () {
         };
         var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams(
-          {},
-          "authorize"
-        );
+        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, "authorize");
         Object.keys(additionalAuthorizeParams).should.have.length(2);
         additionalAuthorizeParams.should.containEql({
           queryParam1: "queryParamValue",
@@ -2685,8 +2421,7 @@ describe("passport-saml /", function () {
 
       it("should merge run-time params additionalLogoutParams and additionalAuthorizeParams with additionalParams", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
             queryParam1: "queryParamValue",
           },
@@ -2731,8 +2466,7 @@ describe("passport-saml /", function () {
 
       it("should prioritize additionalLogoutParams and additionalAuthorizeParams over additionalParams", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
             queryParam: "queryParamValue",
           },
@@ -2745,26 +2479,18 @@ describe("passport-saml /", function () {
         };
         var samlObj = new SAML(samlConfig);
 
-        var additionalAuthorizeParams = samlObj.getAdditionalParams(
-          {},
-          "authorize"
-        );
+        var additionalAuthorizeParams = samlObj.getAdditionalParams({}, "authorize");
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({
-          queryParam: "queryParamValueAuthorize",
-        });
+        additionalAuthorizeParams.should.containEql({ queryParam: "queryParamValueAuthorize" });
 
         var additionalLogoutParams = samlObj.getAdditionalParams({}, "logout");
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({
-          queryParam: "queryParamValueLogout",
-        });
+        additionalLogoutParams.should.containEql({ queryParam: "queryParamValueLogout" });
       });
 
       it("should prioritize run-time params over all other params", function () {
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           additionalParams: {
             queryParam: "queryParamValue",
           },
@@ -2788,9 +2514,7 @@ describe("passport-saml /", function () {
           options.additionalParams
         );
         Object.keys(additionalAuthorizeParams).should.have.length(1);
-        additionalAuthorizeParams.should.containEql({
-          queryParam: "queryParamRuntimeValue",
-        });
+        additionalAuthorizeParams.should.containEql({ queryParam: "queryParamRuntimeValue" });
 
         var additionalLogoutParams = samlObj.getAdditionalParams(
           {},
@@ -2798,9 +2522,7 @@ describe("passport-saml /", function () {
           options.additionalParams
         );
         Object.keys(additionalLogoutParams).should.have.length(1);
-        additionalLogoutParams.should.containEql({
-          queryParam: "queryParamRuntimeValue",
-        });
+        additionalLogoutParams.should.containEql({ queryParam: "queryParamRuntimeValue" });
       });
 
       it("should check the value of the option `RACComparison`", function () {
@@ -2812,13 +2534,8 @@ describe("passport-saml /", function () {
         var validComparisonTypes = ["exact", "minimum", "maximum", "better"],
           samlObjValidComparisonType;
         validComparisonTypes.forEach(function (RACComparison) {
-          samlObjValidComparisonType = new SAML({
-            RACComparison: RACComparison,
-          });
-          should.equal(
-            samlObjValidComparisonType.options.RACComparison,
-            RACComparison
-          );
+          samlObjValidComparisonType = new SAML({ RACComparison: RACComparison });
+          should.equal(samlObjValidComparisonType.options.RACComparison, RACComparison);
         });
       });
     });
@@ -2845,8 +2562,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
           validateInResponseTo: true,
         };
@@ -2855,27 +2571,20 @@ describe("passport-saml /", function () {
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            should.not.exist(err);
-            profile.nameID.should.startWith("ploer");
-            samlObj.cacheProvider.get(requestId, function (err, value) {
-              try {
-                should.not.exist(value);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
-            });
-          }
-        );
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          should.not.exist(err);
+          profile.nameID.should.startWith("ploer");
+          samlObj.cacheProvider.get(requestId, function (err, value) {
+            try {
+              should.not.exist(value);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
+          });
+        });
       });
 
       it("onelogin xml document without InResponseTo from request should fail", function (done) {
@@ -2890,8 +2599,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
           validateInResponseTo: true,
         };
@@ -2899,18 +2607,15 @@ describe("passport-saml /", function () {
 
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match("InResponseTo is not valid");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("InResponseTo is not valid");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("xml document with SubjectConfirmation InResponseTo from request should be valid", function (done) {
@@ -2921,8 +2626,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert:
             "MIIC7TCCAdmgAwIBAgIQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rlc3RTVFMwHhcNMTQwNDE2MTIyMTEwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0U1RTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmhReamVYbeOWwrrAvHPvS9KKBwv4Tj7wOSGDXbNgfjhSvVyXsnpYRcuoJkvE8b9tCjFTbXCfbhnaVrpoXaWFtP1YvUIZvCJGdOOTXltMNDlNIaFmsIsomza8IyOHXe+3xHWVtxO8FG3qnteSkkVIQuAvBqpPfQtxrXCZOlbQZm7q69QIQ64JvLJfRwHN1EywMBVwbJgrV8gBdE3RITI76coSOK13OBTlGtB0kGKLDrF2JW+5mB+WnFR7GlXUj+V0R9WStBomVipJEwr6Q3fU0deKZ5lLw0+qJ0T6APInwN5TIN/AbFCHd51aaf3zEP+tZacQ9fbZqy9XBAtL2pCAJQIDAQABo0cwRTBDBgNVHQEEPDA6gBDECazhZ8Ar+ULXb0YTs5MvoRQwEjEQMA4GA1UEAxMHVGVzdFNUU4IQuIdqos+9yKBC4oygbhtdfzAJBgUrDgMCHQUAA4IBAQAioMSOU9QFw+yhVxGUNK0p/ghVsHnYdeOE3vSRhmFPsetBt8S35sI4QwnQNiuiEYqp++FabiHgePOiqq5oeY6ekJik1qbs7fgwnaQXsxxSucHvc4BU81x24aKy6jeJzxmFxo3mh6y/OI1peCMSH48iUzmhnoSulp0+oAs3gMEFI0ONbgAA/XoAHaVEsrPj10i3gkztoGdpH0DYUe9rABOJxX/3mNF+dCVJG7t7BoSlNAWlSDErKciNNax1nBskFqNWNIKzUKBIb+GVKkIB2QpATMQB6Oe7inUdT9kkZ/Q7oPBATZk+3mFsIoWr8QRFSqvToOhun7EY2/VtuiV1d932",
           validateInResponseTo: true,
@@ -2932,27 +2636,20 @@ describe("passport-saml /", function () {
         fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            should.not.exist(err);
-            profile.nameID.should.startWith("UIS/jochen-work");
-            samlObj.cacheProvider.get(requestId, function (err, value) {
-              try {
-                should.not.exist(value);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
-            });
-          }
-        );
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          should.not.exist(err);
+          profile.nameID.should.startWith("UIS/jochen-work");
+          samlObj.cacheProvider.get(requestId, function (err, value) {
+            try {
+              should.not.exist(value);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
+          });
+        });
       });
 
       it("xml document with SubjectConfirmation and missing InResponseTo from request should not be valid", function (done) {
@@ -2963,8 +2660,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert:
             "MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/",
           validateInResponseTo: true,
@@ -2974,24 +2670,17 @@ describe("passport-saml /", function () {
         fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.eql("InResponseTo is missing from response");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.eql("InResponseTo is missing from response");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("xml document with SubjectConfirmation and missing InResponseTo from request should be not problematic if not validated", function (done) {
@@ -3002,8 +2691,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert:
             "MIICrjCCAZYCCQDWybyUsLVkXzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDFA5hY21lX3Rvb2xzLmNvbTAeFw0xNTA4MTgwODQ3MzZaFw0yNTA4MTcwODQ3MzZaMBkxFzAVBgNVBAMUDmFjbWVfdG9vbHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlyT+OzEymhaZFNfx4+HFxZbBP3egvcUgPvGa7wWCV7vyuCauLBqwO1FQqzaRDxkEihkHqmUz63D25v2QixLxXyqaFQ8TxDFKwYATtSL7x5G2Gww56H0L1XGgYdNW1akPx90P+USmVn1Wb//7AwU+TV+u4jIgKZyTaIFWdFlwBhlp4OBEHCyYwngFgMyVoCBsSmwb4if7Mi5T746J9ZMQpC+ts+kfzley59Nz55pa5fRLwu4qxFUv2oRdXAf2ZLuxB7DPQbRH82/ewZZ8N4BUGiQyAwOsHgp0sb9JJ8uEM/qhyS1dXXxjo+kxsI5HXhxp4P5R9VADuOquaLIo8ptIrQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBW/Y7leJnV76+6bzeqqi+buTLyWc1mASi5LVH68mdailg2WmGfKlSMLGzFkNtg8fJnfaRZ/GtxmSxhpQRHn63ZlyzqVrFcJa0qzPG21PXPHG/ny8pN+BV8fk74CIb/+YN7NvDUrV7jlsPxNT2rQk8G2fM7jsTMYvtz0MBkrZZsUzTv4rZkF/v44J/ACDirKJiE+TYArm70yQPweX6RvYHNZLSzgg4o+hoyBXo5BGQetAjmcIhC6ZOwN3iVhGjp0YpWM0pkqStPy3sIR0//LZbskWWlSRb0fX1c4632Xb+zikfec4DniYV6CxkB2U+plHpOX1rt1R+UiTEIhTSXPNt/",
           validateInResponseTo: false,
@@ -3013,28 +2701,21 @@ describe("passport-saml /", function () {
         fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            should.not.exist(err);
-            profile.nameID.should.startWith("UIS/jochen-work");
-            samlObj.cacheProvider.get(requestId, function (err, value) {
-              try {
-                should.exist(value);
-                value.should.eql("2014-06-05T12:07:07.662Z");
-                done();
-              } catch (err2) {
-                done(err2);
-              }
-            });
-          }
-        );
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          should.not.exist(err);
+          profile.nameID.should.startWith("UIS/jochen-work");
+          samlObj.cacheProvider.get(requestId, function (err, value) {
+            try {
+              should.exist(value);
+              value.should.eql("2014-06-05T12:07:07.662Z");
+              done();
+            } catch (err2) {
+              done(err2);
+            }
+          });
+        });
       });
 
       it("xml document with multiple AttributeStatements should have all attributes present on profile", function (done) {
@@ -3045,8 +2726,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert:
             "MIIDtTCCAp2gAwIBAgIJAKg4VeVcIDz1MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTUwODEzMDE1NDIwWhcNMTUwOTEyMDE1NDIwWjBFMQswCQYDVQQGEwJVUzETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxG3ouM7U+fXbJt69X1H6d4UNg/uRr06pFuU9RkfIwNC+yaXyptqB3ynXKsL7BFt4DCd0fflRvJAx3feJIDp16wN9GDVHcufWMYPhh2j5HcTW/j9JoIJzGhJyvO00YKBt+hHy83iN1SdChKv5y0iSyiPP5GnqFw+ayyHoM6hSO0PqBou1Xb0ZSIE+DHosBnvVna5w2AiPY4xrJl9yZHZ4Q7DfMiYTgstjETio4bX+6oLiBnYktn7DjdEslqhffVme4PuBxNojI+uCeg/sn4QVLd/iogMJfDWNuLD8326Mi/FE9cCRvFlvAiMSaebMI3zPaySsxTK7Zgj5TpEbmbHI9wIDAQABo4GnMIGkMB0GA1UdDgQWBBSVGgvoW4MhMuzBGce29PY8vSzHFzB1BgNVHSMEbjBsgBSVGgvoW4MhMuzBGce29PY8vSzHF6FJpEcwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAKg4VeVcIDz1MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAJu1rqs+anD74dbdwgd3CnqnQsQDJiEXmBhG2leaGt3ve9b/9gKaJg2pyb2NyppDe1uLqh6nNXDuzg1oNZrPz5pJL/eCXPl7FhxhMUi04TtLf8LeNTCIWYZiFuO4pmhohHcv8kRvYR1+6SkLTC8j/TZerm7qvesSiTQFNapa1eNdVQ8nFwVkEtWl+JzKEM1BlRcn42sjJkijeFp7DpI7pU+PnYeiaXpRv5pJo8ogM1iFxN+SnfEs0EuQ7fhKIG9aHKi7bKZ7L6SyX7MDIGLeulEU6lf5D9BfXNmcMambiS0pXhL2QXajt96UBq8FT2KNXY8XNtR4y6MyyCzhaiZZcc8=",
           validateInResponseTo: true,
@@ -3056,35 +2736,26 @@ describe("passport-saml /", function () {
         fakeClock = sinon.useFakeTimers(Date.parse("2014-06-05T12:07:07.662Z"));
 
         // Mock the SAML request being passed through Passport-SAML
-        samlObj.cacheProvider.save(
-          requestId,
-          new Date().toISOString(),
-          function () {}
-        );
+        samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            should.not.exist(err);
-            profile.nameID.should.startWith("UIS/jochen-work");
-            profile["vz::identity"].should.equal("UIS/jochen-work");
-            profile["vz::subjecttype"].should.equal("UIS user");
-            profile["vz::account"].should.equal(
-              "e9aba0c4-ece8-4b44-9526-d24418aa95dc"
-            );
-            profile["vz::org"].should.equal("testorg");
-            profile["vz::name"].should.equal("Test User");
-            profile["net::ip"].should.equal("::1");
-            samlObj.cacheProvider.get(requestId, function (err, value) {
-              try {
-                should.not.exist(value);
-                done();
-              } catch (err2) {
-                done(err2);
-              }
-            });
-          }
-        );
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          should.not.exist(err);
+          profile.nameID.should.startWith("UIS/jochen-work");
+          profile["vz::identity"].should.equal("UIS/jochen-work");
+          profile["vz::subjecttype"].should.equal("UIS user");
+          profile["vz::account"].should.equal("e9aba0c4-ece8-4b44-9526-d24418aa95dc");
+          profile["vz::org"].should.equal("testorg");
+          profile["vz::name"].should.equal("Test User");
+          profile["net::ip"].should.equal("::1");
+          samlObj.cacheProvider.get(requestId, function (err, value) {
+            try {
+              should.not.exist(value);
+              done();
+            } catch (err2) {
+              done(err2);
+            }
+          });
+        });
       });
 
       describe("InResponseTo server cache expiration tests /", function () {
@@ -3098,11 +2769,7 @@ describe("passport-saml /", function () {
           var samlObj = new SAML(samlConfig);
 
           // Mock the SAML request being passed through Passport-SAML
-          samlObj.cacheProvider.save(
-            requestId,
-            new Date().toISOString(),
-            function () {}
-          );
+          samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
           setTimeout(function () {
             samlObj.cacheProvider.get(requestId, function (err, value) {
@@ -3127,24 +2794,12 @@ describe("passport-saml /", function () {
           };
           var samlObj = new SAML(samlConfig);
 
-          samlObj.cacheProvider.save(
-            expiredRequestId1,
-            new Date().toISOString(),
-            function () {}
-          );
-          samlObj.cacheProvider.save(
-            expiredRequestId2,
-            new Date().toISOString(),
-            function () {}
-          );
+          samlObj.cacheProvider.save(expiredRequestId1, new Date().toISOString(), function () {});
+          samlObj.cacheProvider.save(expiredRequestId2, new Date().toISOString(), function () {});
 
           setTimeout(function () {
             // Add one more that shouldn't expire
-            samlObj.cacheProvider.save(
-              requestId,
-              new Date().toISOString(),
-              function () {}
-            );
+            samlObj.cacheProvider.save(requestId, new Date().toISOString(), function () {});
 
             samlObj.cacheProvider.get(expiredRequestId1, function (err, value) {
               should.not.exist(value);
@@ -3202,18 +2857,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:09Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.not.exist(err);
-              profile.nameID.should.startWith("ploer");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.not.exist(err);
+            profile.nameID.should.startWith("ploer");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with current time equal to NotBefore (plus default clock skew)  time should validate", function (done) {
@@ -3231,18 +2883,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:08Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.not.exist(err);
-              profile.nameID.should.startWith("ploer");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.not.exist(err);
+            profile.nameID.should.startWith("ploer");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with current time before NotBefore time should fail", function (done) {
@@ -3260,18 +2909,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:13:07Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match("SAML assertion not yet valid");
-              done();
-            } catch (erro2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("SAML assertion not yet valid");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with current time equal to NotOnOrAfter (minus default clock skew) time should fail", function (done) {
@@ -3289,18 +2935,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:19:08Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match("SAML assertion expired");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("SAML assertion expired");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with current time after NotOnOrAfter time (minus default clock skew) should fail", function (done) {
@@ -3318,18 +2961,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:19:09Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match("SAML assertion expired");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("SAML assertion expired");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with current time after NotOnOrAfter time with accepted clock skew equal to -1 should pass", function (done) {
@@ -3343,8 +2983,7 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           cert: TEST_CERT,
           acceptedClockSkewMs: -1,
         };
@@ -3354,18 +2993,15 @@ describe("passport-saml /", function () {
         fakeClock.restore();
         fakeClock = sinon.useFakeTimers(Date.parse("2014-05-28T00:20:09Z"));
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.not.exist(err);
-              profile.nameID.should.startWith("ploer");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.not.exist(err);
+            profile.nameID.should.startWith("ploer");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with audience and no AudienceRestriction should not pass", function (done) {
@@ -3379,27 +3015,21 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           audience: "http://sp.example.com",
           acceptedClockSkewMs: -1,
         };
         var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match(
-                "SAML assertion has no AudienceRestriction"
-              );
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("SAML assertion has no AudienceRestriction");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with audience not matching AudienceRestriction should not pass", function (done) {
@@ -3413,25 +3043,21 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           audience: "http://sp.example.com",
           acceptedClockSkewMs: -1,
         };
         var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.exist(err);
-              err.message.should.match("SAML assertion audience mismatch");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.exist(err);
+            err.message.should.match("SAML assertion audience mismatch");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("onelogin xml document with audience matching AudienceRestriction should pass", function (done) {
@@ -3445,25 +3071,21 @@ describe("passport-saml /", function () {
         var container = { SAMLResponse: base64xml };
 
         var samlConfig = {
-          entryPoint:
-            "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
+          entryPoint: "https://app.onelogin.com/trust/saml2/http-post/sso/371755",
           audience: "http://sp.example.com",
           acceptedClockSkewMs: -1,
         };
         var samlObj = new SAML(samlConfig);
 
-        samlObj.validatePostResponse(
-          container,
-          function (err, profile, logout) {
-            try {
-              should.not.exist(err);
-              profile.nameID.should.startWith("ploer");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validatePostResponse(container, function (err, profile, logout) {
+          try {
+            should.not.exist(err);
+            profile.nameID.should.startWith("ploer");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
     });
   });
@@ -3581,10 +3203,7 @@ describe("passport-saml /", function () {
   it("validatePostRequest errors for encrypted nameID with wrong decryptionPvk", function (done) {
     var samlObj = new SAML({
       cert: fs.readFileSync(__dirname + "/static/cert.pem", "ascii"),
-      decryptionPvk: fs.readFileSync(
-        __dirname + "/static/acme_tools_com.key",
-        "ascii"
-      ),
+      decryptionPvk: fs.readFileSync(__dirname + "/static/acme_tools_com.key", "ascii"),
     });
     var body = {
       SAMLRequest: fs.readFileSync(
@@ -3693,10 +3312,7 @@ describe("passport-saml /", function () {
       var samlObj;
       beforeEach(function () {
         samlObj = new SAML({
-          cert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.cert",
-            "ascii"
-          ),
+          cert: fs.readFileSync(__dirname + "/static/acme_tools_com.cert", "ascii"),
           idpIssuer: "http://localhost:20000/saml2/idp/metadata.php",
         });
         this.request = Object.assign({}, require("./static/idp_slo_redirect"));
@@ -3709,100 +3325,76 @@ describe("passport-saml /", function () {
         var body = {
           SAMLRequest: "asdf",
         };
-        samlObj.validateRedirect(
-          body,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(body, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if idpIssuer is set and issuer is wrong", function (done) {
         samlObj.options.idpIssuer = "foo";
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql(
-                "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
-              );
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql(
+              "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
+            );
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if request has expired", function (done) {
         this.clock.restore();
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql("SAML assertion expired");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql("SAML assertion expired");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if request has a bad signature", function (done) {
         this.request.Signature = "foo";
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql("Invalid signature");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql("Invalid signature");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("returns profile for valid signature including session index", function (done) {
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err, profile) {
-            try {
-              should.not.exist(err);
-              profile.should.eql({
-                ID: "_8f0effde308adfb6ae7f1e29b414957fc320f5636f",
-                issuer: "http://localhost:20000/saml2/idp/metadata.php",
-                nameID: "stavros@workable.com",
-                nameIDFormat:
-                  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
-                sessionIndex: "_00bf7b2d5d9d3c970217eecefb1194bef3362a618e",
-              });
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err, profile) {
+          try {
+            should.not.exist(err);
+            profile.should.eql({
+              ID: "_8f0effde308adfb6ae7f1e29b414957fc320f5636f",
+              issuer: "http://localhost:20000/saml2/idp/metadata.php",
+              nameID: "stavros@workable.com",
+              nameIDFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+              sessionIndex: "_00bf7b2d5d9d3c970217eecefb1194bef3362a618e",
+            });
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
     });
     describe("sp slo", function () {
       var samlObj;
       beforeEach(function () {
         samlObj = new SAML({
-          cert: fs.readFileSync(
-            __dirname + "/static/acme_tools_com.cert",
-            "ascii"
-          ),
+          cert: fs.readFileSync(__dirname + "/static/acme_tools_com.cert", "ascii"),
           idpIssuer: "http://localhost:20000/saml2/idp/metadata.php",
           validateInResponseTo: true,
         });
@@ -3828,54 +3420,40 @@ describe("passport-saml /", function () {
       });
       it("errors if idpIssuer is set and wrong issuer", function (done) {
         samlObj.options.idpIssuer = "foo";
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql(
-                "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
-              );
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql(
+              "Unknown SAML issuer. Expected: foo Received: http://localhost:20000/saml2/idp/metadata.php"
+            );
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if unsuccessful", function (done) {
         this.request = require("./static/sp_slo_redirect_failure");
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql(
-                "Bad status code: urn:oasis:names:tc:SAML:2.0:status:Requester"
-              );
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql("Bad status code: urn:oasis:names:tc:SAML:2.0:status:Requester");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if InResponseTo is not found", function (done) {
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql("InResponseTo is not valid");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql("InResponseTo is not valid");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
       it("errors if bad signature", function (done) {
         samlObj.cacheProvider.save(
@@ -3884,19 +3462,15 @@ describe("passport-saml /", function () {
           function () {}
         );
         this.request.Signature = "foo";
-        samlObj.validateRedirect(
-          this.request,
-          this.request.originalQuery,
-          function (err) {
-            try {
-              should.exist(err);
-              err.message.should.eql("Invalid signature");
-              done();
-            } catch (err2) {
-              done(err2);
-            }
+        samlObj.validateRedirect(this.request, this.request.originalQuery, function (err) {
+          try {
+            should.exist(err);
+            err.message.should.eql("Invalid signature");
+            done();
+          } catch (err2) {
+            done(err2);
           }
-        );
+        });
       });
 
       it("returns true for valid signature", function (done) {
diff --git a/tsconfig.json b/tsconfig.json
index 92c79a77..53f83e82 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -6,9 +6,7 @@
     // "incremental": true,                   /* Enable incremental compilation */
     "target": "es2018" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019', 'ES2020', or 'ESNEXT'. */,
     "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', 'es2020', or 'ESNext'. */,
-    "lib": [
-      "es2018"
-    ] /* Specify library files to be included in the compilation. */,
+    "lib": ["es2018"] /* Specify library files to be included in the compilation. */,
     "allowJs": true /* Allow javascript files to be compiled. */,
     // "checkJs": true,                       /* Report errors in .js files. */
     // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */