chore(deps): replace passport-saml with @node-saml/passport-saml

`passport-saml` was deprecated and replaced by `@node-saml/passport-saml`
since version 4.0.0.

Relates-to: #18083
Signed-off-by: Patrick Jungermann <Patrick.Jungermann@gmail.com>

plugins/auth-backend/package.json

@@ -47,6 +47,7 @@
     "@backstage/types": "workspace:^",
     "@davidzemon/passport-okta-oauth": "^0.0.5",
     "@google-cloud/firestore": "^6.0.0",
+    "@node-saml/passport-saml": "^4.0.4",
     "@types/express": "^4.17.6",
     "@types/passport": "^1.0.3",
     "compression": "^1.7.4",
@@ -77,7 +78,6 @@
     "passport-microsoft": "^1.0.0",
     "passport-oauth2": "^1.6.1",
     "passport-onelogin-oauth": "^0.0.1",
-    "passport-saml": "^3.1.2",
     "uuid": "^8.0.0",
     "winston": "^3.2.1",
     "yn": "^4.0.0"

plugins/auth-backend/src/providers/saml/provider.ts

@@ -15,16 +15,16 @@
  */
 
 import express from 'express';
-import { SamlConfig } from 'passport-saml/lib/passport-saml/types';
+import { SamlConfig } from '@node-saml/passport-saml';
 import {
-  Strategy as SamlStrategy,
   Profile as SamlProfile,
+  Strategy as SamlStrategy,
+  VerifiedCallback,
   VerifyWithoutRequest,
-} from 'passport-saml';
+} from '@node-saml/passport-saml';
 import {
   executeFrameHandlerStrategy,
   executeRedirectStrategy,
-  PassportDoneCallback,
 } from '../../lib/passport';
 import {
   AuthProviderRouteHandlers,
@@ -62,17 +62,18 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this.strategy = new SamlStrategy({ ...options }, ((
-      fullProfile: SamlProfile,
-      done: PassportDoneCallback<SamlAuthResult>,
+    const verifier: VerifyWithoutRequest = (
+      profile: SamlProfile | null,
+      done: VerifiedCallback,
     ) => {
       // TODO: There's plenty more validation and profile handling to do here,
       //       this provider is currently only intended to validate the provider pattern
       //       for non-oauth auth flows.
       // TODO: This flow doesn't issue an identity token that can be used to validate
       //       the identity of the user in other backends, which we need in some form.
-      done(undefined, { fullProfile });
-    }) as VerifyWithoutRequest);
+      done(null, { fullProfile: profile });
+    };
+    this.strategy = new SamlStrategy(options, verifier, verifier);
   }
 
   async start(req: express.Request, res: express.Response): Promise<void> {