Fix SAML logout: needs to specify InResponseTo

<samlp:LogoutResponse/> must contain the InResponseTo= attribute which contains the value from the <samlp:LogoutRequest>
RocketChat · Jun 11, 2020 · 0856142 · 0856142
1 parent cc6f220
commit 0856142
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/app/meteor-accounts-saml/server/saml_server.js b/app/meteor-accounts-saml/server/saml_server.js
@@ -592,6 +592,7 @@ const middleware = function(req, res, next) {
 						const { response } = _saml.generateLogoutResponse({
 							nameID: result.nameID,
 							sessionIndex: result.idpSession,
+							ID: result.ID,
 						});
 
 						_saml.logoutResponseToUrl(response, function(err, url) {

diff --git a/app/meteor-accounts-saml/server/saml_utils.js b/app/meteor-accounts-saml/server/saml_utils.js
@@ -111,16 +111,17 @@ SAML.prototype.generateAuthorizeRequest = function(req) {
 	return request;
 };
 
-SAML.prototype.generateLogoutResponse = function() {
+SAML.prototype.generateLogoutResponse = function(options) {
 	const id = `_${ this.generateUniqueID() }`;
 	const instant = this.generateInstant();
-
+	const inResponseTo = options.ID ? `InResponseTo="${ options.ID }" ` : '';
 
 	const response = `${ '<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"  '
 		+ 'ID="' }${ id }" `
 		+ 'Version="2.0" '
 		+ `IssueInstant="${ instant }" `
 		+ `Destination="${ this.options.idpSLORedirectURL }" `
+		+ inResponseTo
 		+ '>'
 		+ `<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">${ this.options.issuer }</saml:Issuer>`
 		+ '<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>'
@@ -389,6 +390,7 @@ SAML.prototype.validateLogoutRequest = function(samlRequest, callback) {
 		try {
 			const sessionNode = request.getElementsByTagNameNS('*', 'SessionIndex')[0];
 			const nameIdNode = request.getElementsByTagNameNS('*', 'NameID')[0];
+			const ID = request.getAttribute('ID');
 
 			if (!nameIdNode) {
 				throw new Error('SAML Logout Request: No NameID node found');
@@ -397,7 +399,7 @@ SAML.prototype.validateLogoutRequest = function(samlRequest, callback) {
 			const idpSession = sessionNode.childNodes[0].nodeValue;
 			const nameID = nameIdNode.childNodes[0].nodeValue;
 
-			return callback(null, { idpSession, nameID });
+			return callback(null, { idpSession, nameID, ID });
 		} catch (e) {
 			console.error(e);
 			debugLog(`Caught error: ${ e }`);