From 8178b64a39ace01b4b232dab23aaea0c52e7f065 Mon Sep 17 00:00:00 2001
From: Darcy Ye <darcyye@silverhand.io>
Date: Wed, 8 Jan 2025 17:14:26 +0800
Subject: [PATCH] feat(core): support configuration on nameIdFormat and
 encryption

---
 .../Settings.tsx                              |  4 +-
 .../SamlApplication/index.ts                  | 61 +++++++++++-----
 .../SamlApplication/utils.ts                  | 69 ++++++++++---------
 .../src/saml-applications/queries/index.ts    |  9 ++-
 .../src/locales/en/errors/application.ts      |  4 ++
 5 files changed, 91 insertions(+), 56 deletions(-)

diff --git a/packages/console/src/pages/ApplicationDetails/SamlApplicationDetailsContent/Settings.tsx b/packages/console/src/pages/ApplicationDetails/SamlApplicationDetailsContent/Settings.tsx
index e07990b4826..34cd27db8a8 100644
--- a/packages/console/src/pages/ApplicationDetails/SamlApplicationDetailsContent/Settings.tsx
+++ b/packages/console/src/pages/ApplicationDetails/SamlApplicationDetailsContent/Settings.tsx
@@ -322,7 +322,6 @@ function Settings({ data, mutateApplication, isDeleted }: Props) {
                 <Select
                   options={Object.values(NameIdFormat).map((format) => ({
                     value: format,
-                    // eslint-disable-next-line no-restricted-syntax
                     title: (
                       <span>
                         {t(nameIdFormatToOptionMap[format])}
@@ -330,7 +329,7 @@ function Settings({ data, mutateApplication, isDeleted }: Props) {
                           ({t(nameIdFormatToOptionDescriptionMap[format])})
                         </span>
                       </span>
-                    ) as React.ReactNode,
+                    ),
                   }))}
                   value={value}
                   onChange={onChange}
@@ -363,7 +362,6 @@ function Settings({ data, mutateApplication, isDeleted }: Props) {
                   error={errors.certificate?.message}
                   {...register('certificate', {
                     validate: (value) => {
-                      console.log('certificate value', value, !value);
                       if (!value) {
                         return t(
                           'application_details.saml_encryption_config.certificate_missing_error'
diff --git a/packages/core/src/saml-applications/SamlApplication/index.ts b/packages/core/src/saml-applications/SamlApplication/index.ts
index 6961920dfb9..4caaa333b71 100644
--- a/packages/core/src/saml-applications/SamlApplication/index.ts
+++ b/packages/core/src/saml-applications/SamlApplication/index.ts
@@ -2,9 +2,14 @@
 // TODO: refactor this file to reduce LOC
 import { parseJson } from '@logto/connector-kit';
 import { Prompt, QueryKey, ReservedScope, UserScope } from '@logto/js';
-import { type SamlAcsUrl, BindingType } from '@logto/schemas';
+import {
+  type SamlAcsUrl,
+  BindingType,
+  type NameIdFormat,
+  type SamlEncryption,
+} from '@logto/schemas';
 import { generateStandardId } from '@logto/shared';
-import { tryThat, appendPath, deduplicate } from '@silverhand/essentials';
+import { tryThat, appendPath, deduplicate, type Nullable, cond } from '@silverhand/essentials';
 import camelcaseKeys, { type CamelCaseKeys } from 'camelcase-keys';
 import { XMLValidator } from 'fast-xml-parser';
 import saml from 'samlify';
@@ -41,6 +46,23 @@ type ValidSamlApplicationDetails = {
   redirectUri: string;
   privateKey: string;
   certificate: string;
+  nameIdFormat: NameIdFormat;
+  encryption: Nullable<SamlEncryption>;
+};
+
+type SamlIdentityProviderConfig = {
+  entityId: string;
+  certificate: string;
+  singleSignOnUrl: string;
+  privateKey: string;
+  nameIdFormat: NameIdFormat;
+  encryptSamlAssertion: boolean;
+};
+
+type SamlServiceProviderConfig = {
+  entityId: string;
+  acsUrl: SamlAcsUrl;
+  certificate?: string;
 };
 
 // Used to check whether xml content is valid in format.
@@ -68,6 +90,8 @@ const validateSamlApplicationDetails = (
     privateKey,
     certificate,
     secret,
+    nameIdFormat,
+    encryption,
   } = details;
 
   assertThat(acsUrl, 'application.saml.acs_url_required');
@@ -84,6 +108,8 @@ const validateSamlApplicationDetails = (
     redirectUri: redirectUris[0],
     privateKey,
     certificate,
+    nameIdFormat,
+    encryption,
   };
 };
 
@@ -112,12 +138,9 @@ const buildSamlIdentityProvider = ({
   certificate,
   singleSignOnUrl,
   privateKey,
-}: {
-  entityId: string;
-  certificate: string;
-  singleSignOnUrl: string;
-  privateKey: string;
-}): saml.IdentityProviderInstance => {
+  nameIdFormat,
+  encryptSamlAssertion,
+}: SamlIdentityProviderConfig): saml.IdentityProviderInstance => {
   // eslint-disable-next-line new-cap
   return saml.IdentityProvider({
     entityID: entityId,
@@ -133,12 +156,9 @@ const buildSamlIdentityProvider = ({
       },
     ],
     privateKey,
-    isAssertionEncrypted: false,
+    isAssertionEncrypted: encryptSamlAssertion,
     loginResponseTemplate: buildLoginResponseTemplate(),
-    nameIDFormat: [
-      saml.Constants.namespace.format.emailAddress,
-      saml.Constants.namespace.format.persistent,
-    ],
+    nameIDFormat: [nameIdFormat],
   });
 };
 
@@ -193,10 +213,12 @@ export class SamlApplication {
   }
 
   public get sp(): saml.ServiceProviderInstance {
+    const { certificate: encryptCert, ...rest } = this.buildSpConfig();
     this._sp ||= buildSamlServiceProvider({
-      ...this.buildSpConfig(),
+      ...rest,
       certificate: this.details.certificate,
       isWantAuthnRequestsSigned: this.idp.entityMeta.isWantAuthnRequestsSigned(),
+      ...cond(encryptCert && { encryptCert }),
     });
     return this._sp;
   }
@@ -234,7 +256,8 @@ export class SamlApplication {
       null,
       'post',
       userInfo,
-      this.createSamlTemplateCallback(userInfo)
+      this.createSamlTemplateCallback(userInfo),
+      this.details.encryption?.encryptThenSign
     );
 
     // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
@@ -360,6 +383,7 @@ export class SamlApplication {
       );
 
       const { nameIDFormat } = this.idp.entitySetting;
+      assertThat(nameIDFormat, 'application.saml.name_id_format_required');
       const { NameIDFormat, NameID } = buildSamlAssertionNameId(user, nameIDFormat);
 
       const id = `ID_${generateStandardId()}`;
@@ -406,19 +430,22 @@ export class SamlApplication {
       };
     };
 
-  private buildIdpConfig() {
+  private buildIdpConfig(): SamlIdentityProviderConfig {
     return {
       entityId: buildSamlIdentityProviderEntityId(this.tenantEndpoint, this.samlApplicationId),
       privateKey: this.details.privateKey,
       certificate: this.details.certificate,
       singleSignOnUrl: buildSingleSignOnUrl(this.tenantEndpoint, this.samlApplicationId),
+      nameIdFormat: this.details.nameIdFormat,
+      encryptSamlAssertion: this.details.encryption?.encryptAssertion ?? false,
     };
   }
 
-  private buildSpConfig() {
+  private buildSpConfig(): SamlServiceProviderConfig {
     return {
       entityId: this.details.entityId,
       acsUrl: this.details.acsUrl,
+      certificate: this.details.encryption?.certificate,
     };
   }
 }
diff --git a/packages/core/src/saml-applications/SamlApplication/utils.ts b/packages/core/src/saml-applications/SamlApplication/utils.ts
index 9980b033146..d4adaf15023 100644
--- a/packages/core/src/saml-applications/SamlApplication/utils.ts
+++ b/packages/core/src/saml-applications/SamlApplication/utils.ts
@@ -1,7 +1,10 @@
-// TODO: refactor this file to reduce LOC
-import saml from 'samlify';
+import { generateStandardId } from '@logto/shared';
 
+import RequestError from '#src/errors/RequestError/index.js';
 import { type IdTokenProfileStandardClaims } from '#src/sso/types/oidc.js';
+import assertThat from '#src/utils/assert-that.js';
+
+import { NameIdFormat } from '#src/packages/schemas/lib/index.js';
 
 /**
  * Determines the SAML NameID format and value based on the user's claims and IdP's NameID format.
@@ -13,43 +16,41 @@ import { type IdTokenProfileStandardClaims } from '#src/sso/types/oidc.js';
  */
 export const buildSamlAssertionNameId = (
   user: IdTokenProfileStandardClaims,
-  idpNameIDFormat?: string | string[]
+  idpNameIDFormat: string[]
 ): { NameIDFormat: string; NameID: string } => {
-  if (idpNameIDFormat) {
-    // Get the first name ID format
-    const format = Array.isArray(idpNameIDFormat) ? idpNameIDFormat[0] : idpNameIDFormat;
-    // If email format is specified, try to use email first
-    if (
-      format === saml.Constants.namespace.format.emailAddress &&
-      user.email &&
-      user.email_verified
-    ) {
-      return {
-        NameIDFormat: format,
-        NameID: user.email,
-      };
-    }
-    // For other formats or when email is not available, use sub
-    if (format === saml.Constants.namespace.format.persistent) {
-      return {
-        NameIDFormat: format,
-        NameID: user.sub,
-      };
-    }
-  }
-  // No nameIDFormat specified, use default logic
-  // Use email if available
-  if (user.email && user.email_verified) {
+  // Get the first name ID format
+  const format = Array.isArray(idpNameIDFormat) ? idpNameIDFormat[0] : idpNameIDFormat;
+
+  // If email format is specified, try to use email first
+  if (format === NameIdFormat.EmailAddress) {
+    assertThat(user.email, 'application.saml.missing_email_address');
+    assertThat(user.email_verified, 'application.saml.email_address_unverified');
     return {
-      NameIDFormat: saml.Constants.namespace.format.emailAddress,
+      NameIDFormat: format,
       NameID: user.email,
     };
   }
-  // Fallback to persistent format with user.sub
-  return {
-    NameIDFormat: saml.Constants.namespace.format.persistent,
-    NameID: user.sub,
-  };
+
+  // For persistent and unspecified formats, we use Logto user ID.
+  if (format === NameIdFormat.Persistent || format === NameIdFormat.Unspecified) {
+    return {
+      NameIDFormat: format,
+      NameID: user.sub,
+    };
+  }
+
+  // For transient format, we generate a random ID.
+  if (format === NameIdFormat.Transient) {
+    return {
+      NameIDFormat: format,
+      NameID: generateStandardId(),
+    };
+  }
+
+  throw new RequestError({
+    code: 'application.saml.unsupported_name_id_format',
+    details: { idpNameIDFormat, user },
+  });
 };
 
 export const generateAutoSubmitForm = (actionUrl: string, samlResponse: string): string => {
diff --git a/packages/core/src/saml-applications/queries/index.ts b/packages/core/src/saml-applications/queries/index.ts
index 2ad6039f103..df9f84c95f9 100644
--- a/packages/core/src/saml-applications/queries/index.ts
+++ b/packages/core/src/saml-applications/queries/index.ts
@@ -34,7 +34,10 @@ export type SamlApplicationDetails = Pick<
   Application,
   'id' | 'secret' | 'name' | 'description' | 'customData' | 'oidcClientMetadata'
 > &
-  Pick<SamlApplicationConfig, 'attributeMapping' | 'entityId' | 'acsUrl'> &
+  Pick<
+    SamlApplicationConfig,
+    'attributeMapping' | 'entityId' | 'acsUrl' | 'encryption' | 'nameIdFormat'
+  > &
   NullableObject<SamlApplicationSecretDetails>;
 
 const samlApplicationDetailsGuard = Applications.guard
@@ -51,6 +54,8 @@ const samlApplicationDetailsGuard = Applications.guard
       attributeMapping: true,
       entityId: true,
       acsUrl: true,
+      nameIdFormat: true,
+      encryption: true,
     })
   )
   .merge(
@@ -66,7 +71,7 @@ const samlApplicationDetailsGuard = Applications.guard
 export const createSamlApplicationQueries = (pool: CommonQueryMethods) => {
   const getSamlApplicationDetailsById = async (id: string): Promise<SamlApplicationDetails> => {
     const result = await pool.one(sql`
-      select ${fields.id} as id, ${fields.secret} as secret, ${fields.name} as name, ${fields.description} as description, ${fields.customData} as custom_data, ${fields.oidcClientMetadata} as oidc_client_metadata, ${samlApplicationConfigsFields.attributeMapping} as attribute_mapping, ${samlApplicationConfigsFields.entityId} as entity_id, ${samlApplicationConfigsFields.acsUrl} as acs_url, ${samlApplicationSecretsFields.privateKey} as private_key, ${samlApplicationSecretsFields.certificate} as certificate, ${samlApplicationSecretsFields.active} as active, ${samlApplicationSecretsFields.expiresAt} as expires_at
+      select ${fields.id} as id, ${fields.secret} as secret, ${fields.name} as name, ${fields.description} as description, ${fields.customData} as custom_data, ${fields.oidcClientMetadata} as oidc_client_metadata, ${samlApplicationConfigsFields.attributeMapping} as attribute_mapping, ${samlApplicationConfigsFields.entityId} as entity_id, ${samlApplicationConfigsFields.acsUrl} as acs_url, ${samlApplicationConfigsFields.encryption} as encryption, ${samlApplicationConfigsFields.nameIdFormat} as name_id_format, ${samlApplicationSecretsFields.privateKey} as private_key, ${samlApplicationSecretsFields.certificate} as certificate, ${samlApplicationSecretsFields.active} as active, ${samlApplicationSecretsFields.expiresAt} as expires_at
       from ${table}
       left join ${samlApplicationConfigsTable} on ${fields.id}=${samlApplicationConfigsFields.applicationId}
       left join ${samlApplicationSecretsTable} on ${fields.id}=${samlApplicationSecretsFields.applicationId}
diff --git a/packages/phrases/src/locales/en/errors/application.ts b/packages/phrases/src/locales/en/errors/application.ts
index 89b692332c3..d052df37994 100644
--- a/packages/phrases/src/locales/en/errors/application.ts
+++ b/packages/phrases/src/locales/en/errors/application.ts
@@ -28,6 +28,10 @@ const application = {
     can_not_delete_active_secret: 'Can not delete the active secret.',
     no_active_secret: 'No active secret found.',
     entity_id_required: 'Entity ID is required to generate metadata.',
+    name_id_format_required: 'Name ID format is required.',
+    unsupported_name_id_format: 'Unsupported name ID format.',
+    missing_email_address: 'User does not have an email address.',
+    email_address_unverified: 'User email address is not verified.',
     invalid_certificate_pem_format: 'Invalid PEM certificate format',
     acs_url_required: 'Assertion Consumer Service URL is required.',
     private_key_required: 'Private key is required.',