Redirect user to SP in a Shibboleth SP-initiated login via saml-passport in Node.js

Viewed 127

I am struggling to get the passport-saml module to redirect the client to the IDP. When calling the login-url, the connection times out.

Burp Suite Community Edition

Error No response received from remote server

Here's the code:

const dotenv = require('dotenv').config();
const passport = require('passport');
const saml = require('passport-saml');
var privateKey  = fs.readFileSync('cert/mydomain.tld.key', 'utf8');
var certificate = fs.readFileSync('cert/mydomain,tld.crt', 'utf8');

var options = {key: privateKey, cert: certificate};
var SamlStrategy = require('passport-saml').Strategy;

var shibbStrategy = new SamlStrategy( {
  callbackUrl: 'https://mydomain.tld/login/callback',
  entryPoint: 'https://idp.domain.tld/idp/profile/SAML2/Redirect/SSO',
  issuer: 'mydomain.tld',
  privateKey: process.env.SP_PRIVATEKEY,
  decryptionPvk: process.env.SP_CERTIFICATE,
  cert: fs.readFileSync('cert/maybe/idp-signing.crt', 'utf-8'),
  },
  function(profile, done) {
    findByEmail(profile.email, function(err, user) {
      if (err) {
        return done(err);
      }
      return done(null, user);
    });
  });

[...]
passport.use(shibbStrategy);
app.use(passport.initialize());
app.use(passport.session());

app.get('/Shibboleth.sso/Metadata',
  function(req, res) {
    const decryptionCert = fs.readFileSync('./cert/mydomain.tld.crt', 'utf-8');
    const signingCert = fs.readFileSync('./cert/mydomain.tld.crt', 'utf-8');
    res.type('application/xml');
    res.send((shibbStrategy.generateServiceProviderMetadata(decryptionCert, signingCert)));
  }
);

[...]
app.get('/Shibboleth.sso/Login', (req,res)=>{ passport.authenticate('saml', {
    successRedirect: '/login/success',
    failureRedirect: '/login/failure', failureFlash:true }),
    function(res,req){
        res.redirect('/')
    }
});

var httpsServer = https.createServer(options, app);
httpsServer.listen(process.env.PORT_HTTPS, () => console.log('Server started'));

// redirect HTTP server
const httpApp = express();
httpApp.all('*', (req, res) => res.redirect(300, 'https://mydomain.tld:'+process.env.PORT_HTTPS+req.originalUrl));
const httpServer = http.createServer(httpApp);
httpServer.listen(80, () => console.log(`HTTP server listening`));

Although having scanned through all Shibboleth and passport-saml related topics, including github repos that released their passport-saml config for their respective university, I did not manage to get any other behavior than the timeout. I also used tshark and Burp for capturing and tried to get some debug messages from Node, but being a Node newbie, it looks like a complete black box for me after calling the /Shibboleth.sso/Login path. I do know that the callback-path does not exist at the moment. I tried with existing paths before and do believe it does not make any difference right now.

  • Why is the server not responding?
  • Why is does my SP not redirect to the IDP?
  • What can I do to narrow down the problem?
  • How do I successfully initialize the Login-process?
0 Answers
Related