Provide more informations about creating the service

Hello, I’m confusing with the whole setup.

What I want ? I want a user from my application to connect to an ADFS via SAML2 :

What I’ve done so far:

• I have an ADDS and an ADFS working properly.
  • I added the relying party trust and the callback url on the ADFS

So, what I understand so far is that my ADFS will be the Identity provider ? And my application will be the Service Provider ?

// for now, I fetch the https://<adfs>/FederationMetadata/2007-06/FederationMetadata.xml
const idp = saml.IdentityProvider({
    metadata,
}); // I believe the package will do the job in order to setup the IDP correctly am I right ?

What I’m missing is the configuration for the service provider ?

const sp = saml.ServiceProvider({
    dataEncryptionAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
    requestSignatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
    metadata, // using the same Metadata object from the ADFS- I don't know for know what should I put in there ?
});
const url = sp.createLoginRequest(idp, 'redirect'); // this create a request that won't be accepted by our ADFS.

On the ADFS

An error appear each time I sent a SAML request, saying that :

What metadata I’m suppose to provide for my SP ? And witch certificate or private key I’m suppose to give in order to make it work ?

I’m still confuse about how this work, if someone can help me. 😞

[tngan]

@rolljee

So, what I understand so far is that my ADFS will be the Identity provider ? And my application will be the Service Provider ?

Answer is yes.

From my understanding, you are trying to do the SP-initiated SSO, right ?

For your configuration of service provider, you can use this online tool to build your metadata.

There are a lot of options to make the service works, feel free to send your message to [e-mail] if you don’t want to expose the business secret here, using this pgp key for email encryption if you want.

[rolljee]

@tngan I mean redirect binding for adfs response not for request 😃

Using this piece of code, i managed to decrypt any response incomming from an adfs redirect binding.

import atob from 'atob';
import inflate from 'tiny-inflate';

const authnRequest = String(params.query.SAMLResponse) + String(params.query.Signature);
const strData = atob(authnRequest);
const charData = strData.split('').map(function (x) { return x.charCodeAt(0); });
const compressedBuffer = new Buffer(charData);
const outputBuffer = new Buffer(compressedBuffer.length * 1000); // GZip max compression ratio
const output = String(inflate(compressedBuffer, outputBuffer));