import { mock } from 'jest-mock-extended'; import { SamlValidator } from '../saml-validator'; describe('saml-validator', () => { const validator = new SamlValidator(mock()); const VALID_CERTIFICATE = 'MIIC8DCCAdigAwIBAgIQf+iroClVKohAtsyk0Ne13TANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yNDExMTMxMDEwNTNaFw0yNzExMTMxMDEwNTNaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwE8Ad1OMQKfaHi6YrsEcmMNwIAQ86h7JmnuABf5xLNd27jaMF4FVxHbEtC/BYxtcmwld5zbkCVXQ6PT6VoeYIjHMVnptFXg15EGgjnqpxWsjLDQNoSdSQu8VhG+8Yb5M7KPt+UEZfsRZVrgqMjdSEMVrOzPMD8KMB7wnghYX6npcZhn7D5w/F9gVDpI1Um8M/FIUKYVSYFjky1i24WvKmcBf71mAacZp48Zuj5by/ELIb6gAjpW5xpd02smpLthy/Yo4XDIQQurFOfjqyZd8xAZu/SfPsbjtymWw59tgd9RdYISl6O/241kY9h6Ojtx6WShOVDi6q+bJrfj9Z8WKcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCiVxiQ9KpjihliQzIW45YO0EvRJtoPtyVAh9RiSGozbTl4otfrUJf8nbRtj7iZBRuuW4rrtRAH5kDb+i1wNUUQED2Pl/l4x5cN0oBytP3GSymq6NJx1gUOBO1BrNY+c3r5yHOUyj5qpbw9UkqpG1AqQkLLeZqB/yVCyOBQT7SKTbXVYhGefFM/+6z0/rGsWZN5OF6/2NC06ws1v4In28Atgpg4XxFh5TL7rPMJ11ca5MN9lHJoIUsvls053eQBcd7vJneqzd904B6WtPld6KOJK4dzIt9edHzPhaz158awWwx3iHsMn1Y/T0WVy5/4ZTzxY/i4U3t1Yt8ktxewVJYT'; beforeAll(async () => { await validator.init(); }); describe('validateMetadata', () => { test('successfully validates metadata containing ws federation tags', async () => { // ARRANGE const metadata = ` hoeupPMPzijHu6caNarGYjsG0eKm4DOFUhjo0bPo0Ls= DQnnT/5se4dqYN86R35MCdbyKVl64lGPLSIVrxFxrOQ9YRK1br7Z1Bt1/LQD4f92z+GwAl+9tZTWhuoy6OGHCV6LlqBEztW43KnlCKw6eaNg4/6NluzJ/XeknXYLURDnfFVyGbLQAYWGND4Qm8CUXO/GjGfWTZuArvrDDC36/2FA41jKXtf1InxGFx1Bbaskx3n3KCFFth/V9knbnc1zftEe022aQluPRoGccROOI4ZeLUFL6+1gYlxjx0gFIOTRiuvrzR765lHNrF7iZ4aD+XukqtkGEtxTkiLoB+Bnr8Fd7IF5rV5FKTZWSxo+ZFcLimrDGtFPItVrC/oKRc+MGA== ${VALID_CERTIFICATE} ${VALID_CERTIFICATE} Name The mutable display name of the user. Subject An immutable, globally unique, non-reusable identifier of the user that is unique to the application for which a token is issued. Given Name First name of the user. Surname Last name of the user. Display Name Display name of the user. Nick Name Nick name of the user. Authentication Instant The time (UTC) when the user is authenticated to Windows Azure Active Directory. Authentication Method The method that Windows Azure Active Directory uses to authenticate users. ObjectIdentifier Primary identifier for the user in the directory. Immutable, globally unique, non-reusable. TenantId Identifier for the user's tenant. IdentityProvider Identity provider for the user. Email Email address of the user. Groups Groups of the user. External Access Token Access token issued by external identity provider. External Access Token Expiration UTC expiration time of access token issued by external identity provider. External OpenID 2.0 Identifier OpenID 2.0 identifier issued by external identity provider. GroupsOverageClaim Issued when number of user's group claims exceeds return limit. Role Claim Roles that the user or Service Principal is attached to RoleTemplate Id Claim Role template id of the Built-in Directory Roles that the user is a member of https://login.microsoftonline.com/random-issuer/wsfed https://login.microsoftonline.com/random-issuer/wsfed ${VALID_CERTIFICATE} https://sts.windows.net/random-issuer/ https://login.microsoftonline.com/random-issuer/wsfed https://login.microsoftonline.com/random-issuer/wsfed ${VALID_CERTIFICATE} `; // ACT const result = await validator.validateMetadata(metadata); // ASSERT expect(result).toBe(true); }); test('rejects invalid metadata', async () => { // ARRANGE // Invalid because required children are missing const metadata = ` `; // ACT const result = await validator.validateMetadata(metadata); // ASSERT expect(result).toBe(false); }); test('rejects malformed XML metadata', async () => { // ARRANGE const metadata = ` ${VALID_CERTIFICATE} `; // Missing closing tags // ACT const result = await validator.validateMetadata(metadata); // ASSERT expect(result).toBe(false); }); test('rejects metadata missing SingleSignOnService', async () => { // ARRANGE const metadata = ` ${VALID_CERTIFICATE} `; // ACT const result = await validator.validateMetadata(metadata); // ASSERT expect(result).toBe(false); }); test('rejects metadata with invalid X.509 certificate', async () => { // ARRANGE const metadata = ` INVALID_CERTIFICATE `; // ACT const result = await validator.validateMetadata(metadata); // ASSERT expect(result).toBe(false); }); }); describe('validateResponse', () => { test('successfully validates response', async () => { // ARRANGE const response = ` https://sts.windows.net/random-issuer/ https://sts.windows.net/random-issuer/ random_digest cmFuZG9tX3NpZ25hdHVyZQo= cmFuZG9tX3NpZ25hdHVyZQo= random_name_id http://localhost:5678/rest/sso/saml/metadata random-issuer 4663f730-51c5-4490-a38a-19dda804865a Danny n8n mail Danny Martini danny@n8n.io random_name_id Danny Martini danny@n8n.io urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified `; // ACT const result = await validator.validateResponse(response); // ASSERT expect(result).toBe(true); }); test('rejects invalid response', async () => { // ARRANGE // Invalid because required children are missing const response = ` `; // ACT const result = await validator.validateResponse(response); // ASSERT expect(result).toBe(false); }); test('rejects expired SAML response', async () => { // ARRANGE const response = ` https://sts.windows.net/random-issuer/ https://sts.windows.net/random-issuer/ random_name_id // Expired http://localhost:5678/rest/sso/saml/metadata `; // ACT const result = await validator.validateResponse(response); // ASSERT expect(result).toBe(false); }); }); });