Support HTTP-Redirect binding for IdP to SP SLO
See original GitHub issueFrom what I understand about SAML (which isn’t comprehensive), there is currently no way of using passport-saml
to generate a metadata file that will trigger the IdP to using HTTP-Redirect
to send an assertion to the SP in a SP-initiated flow (see https://github.com/bergie/passport-saml/blob/master/lib/passport-saml/saml.js#L939).
Am I missing something? Is it a hard fix to implement? I’d be happy to give a PR a shot, but any advice on stumbling blocks would be greatly appreciated.
Issue Analytics
- State:
- Created 7 years ago
- Comments:10 (6 by maintainers)
Top Results From Across the Web
Support HTTP-Redirect binding for IdP to SP SLO #191 - GitHub
Either the HTTP POST, or HTTP Artifact binding can be used to transfer the message to the service provider through the user agent....
Read more >HTTP-POST SingleLogoutService binding for IdP on a bridged ...
HTTP-POST is the default and most used binding to send a SAML response to an SP, while HTTP-Redirect is used by SPs to...
Read more >Single Logout Overview (SAML 2.0)
If the SP starts the process with HTTP-Redirect, the IdP can use SOAP with all SPs that support it. Switch to HTTP-Redirect binding...
Read more >How do I redirect to a specific page after a successful IdP or ...
Using the goto parameter with a SP initiated SLO and HTTP-Redirect binding: https://sp.example:8443/am/saml2/jsp/spSingleLogoutInit.jsp ?
Read more >IdP endpoint for SAML logout response after an IdP initiated ...
Note: It depends on the SP implementation which binding is used to send the LogoutResponse. Some use the same binding which was used...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@gregmsanderson yes, if you want to support both bindings you should map both methods (GET, POST) to your endpoint. the library will pull the SAML{Request, Response} from the body or from the query params of the request and everything should work just fine
The use case that brought me to this issue was actually for IDP to SP SLO, which according to the spec MAY use HTTP-Redirect binding… would you consider reopening this so as not to need a potentially duplicate issue for the support on the logout side?