SAML: support Microsoft Entra ID with configurable authentication-context and response-signature options - #27
Open
aconite33 wants to merge 3 commits into
Open
SAML: support Microsoft Entra ID with configurable authentication-context and response-signature options#27aconite33 wants to merge 3 commits into
aconite33 wants to merge 3 commits into
Conversation
…ck errors Pass cfg.disableRequestedAuthnContext through to node-saml so identity providers that enforce multi-factor authentication or passwordless sign-in (for example, Entra ID) can opt out of the default requested authentication context. The value defaults to node-saml's existing behavior, so current deployments are unaffected unless they set it. Log Util.serializeError(err) in ERROR_SAML_CALLBACK instead of the raw error object. The raw object serialized to an empty object and hid the failure reason.
Pass cfg.wantAuthnResponseSigned through to node-saml. In node-saml v5, this option defaults to true, which rejects the assertion with an "Invalid document signature" error when the response wrapper is unsigned. Identity providers such as Entra ID sign only the assertion by default, so this option allows an operator to accept assertion-only signing. The assertion signature stays required, because wantAssertionsSigned still defaults to true, so this change never accepts an unsigned assertion. The value defaults to node-saml's behavior, so current deployments are unaffected unless they set it.
Describe the SAML provider fields, including the new disableRequestedAuthnContext and wantAuthnResponseSigned options, and add a Microsoft Entra ID section. The section covers the Entity ID and Reply URL to register, the signing certificate format, and the two Entra defaults that need attention.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This change allows the SAML connector to work with Microsoft Entra ID, and with other identity providers that enforce multi-factor authentication or sign only the assertion, without weakening signature validation. It adds two optional per-provider settings, improves an error log, and documents the Entra ID setup.
Background
The node-saml v5 release tightened two defaults that a default Entra ID SAML application does not satisfy. First, node-saml requests the
PasswordProtectedTransportauthentication context with exact matching. Entra rejects the sign-in with AADSTS75011 when the user completes multi-factor or passwordless authentication, because the method no longer matches the requested context. Second, node-saml requires the SAML response to be signed. Entra signs the assertion but not the response wrapper by default, so validation fails with theInvalid document signatureerror even though the assertion is correctly signed. The connector had no way to adjust either behavior, so a default Entra ID application could not complete login.Changes
disableRequestedAuthnContextfrom the provider config to node-saml. When set totrue, CryptPad stops requesting a specific authentication context and allows the identity provider to apply its own policy, including multi-factor and passwordless authentication.wantAuthnResponseSignedfrom the provider config to node-saml. When set tofalse, CryptPad accepts a signed assertion inside an unsigned response. The assertion signature stays required, because node-saml still defaultswantAssertionsSignedtotrue, so an unsigned assertion is never accepted.Compatibility
Both new options default to node-saml's existing behavior when a provider does not set them, so current deployments are unaffected. Operators who can sign the response at the identity provider should leave
wantAuthnResponseSignedunset to keep requiring a signed response.Testing
Verified an end-to-end SAML login against Microsoft Entra ID: the sign-in completed with multi-factor authentication, the account was created, and the drive loaded. Setting the Entra Signing Option to sign the response and removing
wantAuthnResponseSignedalso kept login working with the response signature required.