extract sessionIndex from LogoutRequest (#501)

tngan · Jan 20, 2023 · 215ed88 · 215ed88
1 parent 87aa1cf
commit 215ed88
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 4 deletions.
diff --git a/src/extractor.ts b/src/extractor.ts
@@ -165,6 +165,11 @@ export const logoutRequestFields: ExtractorFields = [
     localPath: ['LogoutRequest', 'NameID'],
     attributes: []
   },
+  {
+    key: 'sessionIndex',
+    localPath: ['LogoutRequest', 'SessionIndex'],
+    attributes: []
+  },
   {
     key: 'signature',
     localPath: ['LogoutRequest', 'Signature'],

diff --git a/test/flow.ts b/test/flow.ts
@@ -973,7 +973,7 @@ test('send login response with [custom template] encrypted signed assertion + si
 
 // simulate idp-init slo
 test('idp sends a redirect logout request without signature and sp parses it', async t => {
-  const { id, context } = idp.createLogoutRequest(sp, 'redirect', { logoutNameID: '[email protected]' });
+  const { id, context } = idp.createLogoutRequest(sp, 'redirect', { logoutNameID: '[email protected]', sessionIndex: '_664ade6a050f55a2c7cb2fb0571df7280365c0c7' });
   const query = url.parse(context).query;
   t.is(query!.includes('SAMLRequest='), true);
   t.is(typeof id, 'string');
@@ -985,14 +985,15 @@ test('idp sends a redirect logout request without signature and sp parses it', a
   t.is(result.sigAlg, null);
   t.is(typeof samlContent, 'string');
   t.is(extract.nameID, '[email protected]');
+  t.is(extract.sessionIndex, '_664ade6a050f55a2c7cb2fb0571df7280365c0c7')
   t.is(extract.signature, null);
   t.is(typeof extract.request.id, 'string');
   t.is(extract.request.destination, 'https://sp.example.org/sp/slo');
   t.is(extract.issuer, 'https://idp.example.com/metadata');
 });
 
 test('idp sends a redirect logout request with signature and sp parses it', async t => {
-  const { id, context } = idp.createLogoutRequest(spWantLogoutReqSign, 'redirect', { logoutNameID: '[email protected]' });
+  const { id, context } = idp.createLogoutRequest(spWantLogoutReqSign, 'redirect', { logoutNameID: '[email protected]', sessionIndex: '_664ade6a050f55a2c7cb2fb0571df7280365c0c7' });
   const query = url.parse(context).query;
   t.is(query!.includes('SAMLRequest='), true);
   t.is(query!.includes('SigAlg='), true);
@@ -1007,34 +1008,37 @@ test('idp sends a redirect logout request with signature and sp parses it', asyn
   const octetString = Object.keys(originalURL.query).map(q => q + '=' + encodeURIComponent(originalURL.query[q] as string)).join('&');
   const { extract } = await spWantLogoutReqSign.parseLogoutRequest(idp, 'redirect', { query: { SAMLRequest, Signature, SigAlg }, octetString});
   t.is(extract.nameID, '[email protected]');
+  t.is(extract.sessionIndex, '_664ade6a050f55a2c7cb2fb0571df7280365c0c7')
   t.is(extract.issuer, 'https://idp.example.com/metadata');
   t.is(typeof extract.request.id, 'string');
   t.is(extract.request.destination, 'https://sp.example.org/sp/slo');
   t.is(extract.signature, null); // redirect binding doesn't embed the signature
 });
 
 test('idp sends a post logout request without signature and sp parses it', async t => {
-  const { relayState, type, entityEndpoint, id, context } = idp.createLogoutRequest(sp, 'post', { logoutNameID: '[email protected]' }) as PostBindingContext;
+  const { relayState, type, entityEndpoint, id, context } = idp.createLogoutRequest(sp, 'post', { logoutNameID: '[email protected]', sessionIndex: '_664ade6a050f55a2c7cb2fb0571df7280365c0c7' }) as PostBindingContext;
   t.is(typeof id, 'string');
   t.is(typeof context, 'string');
   t.is(typeof entityEndpoint, 'string');
   t.is(type, 'SAMLRequest');
   const { extract } = await sp.parseLogoutRequest(idp, 'post', { body: { SAMLRequest: context } });
   t.is(extract.nameID, '[email protected]');
+  t.is(extract.sessionIndex, '_664ade6a050f55a2c7cb2fb0571df7280365c0c7')
   t.is(extract.issuer, 'https://idp.example.com/metadata');
   t.is(typeof extract.request.id, 'string');
   t.is(extract.request.destination, 'https://sp.example.org/sp/slo');
   t.is(extract.signature, null);
 });
 
 test('idp sends a post logout request with signature and sp parses it', async t => {
-  const { relayState, type, entityEndpoint, id, context } = idp.createLogoutRequest(spWantLogoutReqSign, 'post', { logoutNameID: '[email protected]' }) as PostBindingContext;
+  const { relayState, type, entityEndpoint, id, context } = idp.createLogoutRequest(spWantLogoutReqSign, 'post', { logoutNameID: '[email protected]', sessionIndex: '_664ade6a050f55a2c7cb2fb0571df7280365c0c7' }) as PostBindingContext;
   t.is(typeof id, 'string');
   t.is(typeof context, 'string');
   t.is(typeof entityEndpoint, 'string');
   t.is(type, 'SAMLRequest');
   const { extract } = await spWantLogoutReqSign.parseLogoutRequest(idp, 'post', { body: { SAMLRequest: context } });
   t.is(extract.nameID, '[email protected]');
+  t.is(extract.sessionIndex, '_664ade6a050f55a2c7cb2fb0571df7280365c0c7')
   t.is(extract.issuer, 'https://idp.example.com/metadata');
   t.is(extract.request.destination, 'https://sp.example.org/sp/slo');
   t.is(typeof extract.request.id, 'string');