Issue with a logout request

[mudebbela]

So I am creating an Idp using firebase and passport-saml. I keep getting this error:

TypeError: Cannot read properties of undefined (reading '$') at SAML.verifyLogoutRequest (/home/martin/Code/jointhru/ed-app-thru-portal/functions/node_modules/@node-saml/node-saml/lib/saml.js:681:46) at SAML.validateRedirectAsync (/home/martin/Code/jointhru/ed-app-thru-portal/functions/node_modules/@node-saml/node-saml/lib/saml.js:625:20)

now the error has to do with the code looking for LogoutRequest value from the incoming request. my request is not coming with that. I am creating this request a SP called edApp.com. Is it normal that the request doesnt have one normally? is there something I am missing?

These lines give me the error:

verifyLogoutRequest(doc) { this.verifyIssuer(doc.LogoutRequest); const nowMs = new Date().getTime(); const conditions = doc.LogoutRequest.$; const conErr = this.checkTimestampsValidityError(nowMs, conditions.NotBefore, conditions.NotOnOrAfter); if (conErr) { throw conErr; } }

since the LogoutRequest is null it is throwing an error

This is what the request looks like:

https://link.to.saml.server/?SAMLRequest=nVNNj9MwEP0rke%2F53HRhraar0ApRaYGqLRy4oFl7lhocO3icbvn3OGmz9MD20FOkmTfP896bTO8PjY726EhZU7E8ydj9bErQ6JbXnd%2BZNf7ukHwUYIb40KhY5wy3QIq4gQaJe8E39ccHXiQZb531VljNouWiYt8xy8qbMpdvy9vytnhTFCUULPo6PhgmApCow6UhD8aHUlbcxNldnOXbIuPlhE%2FyZJLdfWPR6kT9ThmpzI%2FLezweQcQ%2FbLerePV5s2VRTYTOh4fn1lDXoNug2yuBX9YPFdt53xJPU2hVghLaNhG2SYls3KuOBWj9COJX%2BtMq43euY9EiGKMM%2BEHJON5AeMFI3CfaCki0T1HGgS3uZ%2BLWOg867SgWaLwDnac9e9227Gg7H8xwZ35flgmjJDZ7ESAbZf5JmKZnvGO2nwLRcrGyWok%2F12T73roG%2FOvoPMmHipLx0wDl2IDStZQOiUISWtvnuUPwWDHvOmTpuNrp4lAO9xeS8ni46v7mtmnBKerTwQMIP1p8TjzXwcE1Pl1j%2BEWY4KKnDuVV%2BDxbJ%2FvzRRGEbR0Y6i%2FhFM3%2F9pkde6%2FY8dI9%2F0dnfwE%3D

[srd90]

If you run content of your URL's SAMLRequest query parameter through this ”pipeline”:

1. urldecode (e.g.: https://www.urldecoder.org/ )
2. base64 decode
3. inflate (e.g. https://www.samltool.com/decode.php which decodes and inflates)
4. xml pretty print (e.g. https://www.samltool.com/prettyprint.php )

the result is:

<?xml version="1.0"?>
<samlp:AuthnRequest
  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
  ID="_e004341d8464627224a2"
  Version="2.0"
  IssueInstant="2023-09-01T20:45:51.509Z"
  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
  AssertionConsumerServiceURL="https://api.edapp.com/sso-saml-callback/jointhru"
  Destination="https://martindev.loca.lt/ed-app-thru-portal/us-central1/samlApp"
>
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://admin.edapp.com</saml:Issuer>
  <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
  <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact">
    <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
  </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

due some reason you are feeding authnentication request to passport-saml. Passport-saml is not IdP. It - passport-saml - is not capable to handle authn requests. It only sends those to IdP. Only SAML request type that passport-saml has support is LogoutRequest i.e. IdP initiated SLO case (and that support does not handle all the cases out of the box (#419)). So because passport-saml only knows one SAML request type message (LogoutRequest) and without looking at passport-saml implementation I assume that passport-saml assumes that request is LogoutRequest.

If you want to implement IdP you have to look for some other SAML library.

NOTE: you should not paste any SAML messages as-is to internet. Especially do not paste encoded or decoded unsanitized authentication responses. Instead use e.g. tools provided by linux (base64, xmllint, etc.) to do aforementioned stuff locally or use e.g. saml plugins with your browser. I took liberty to paste your message to aforementioned services because you had already exposed it to whole world and based on length it was not going to be authentication response with possible sensitive information (and because I do not have access to bash or any programming language at the time of writing this comment).

[mudebbela]

Okay thank you!!!... maybe beyond the scope of this q and a but do you have any recommendations for js libraries I could use to create an idp??