From d589a0488d088bf8b0a2cb83f94d76b4d22093c4 Mon Sep 17 00:00:00 2001
From: secustor <sebastian@poxhofer.at>
Date: Tue, 6 Feb 2024 10:09:52 +0100
Subject: [PATCH] expose new needed configuration options

Signed-off-by: secustor <sebastian@poxhofer.at>
---
 .changeset/tasty-oranges-rescue.md            |  9 ++++-
 .../src/providers/saml/provider.ts            | 39 +++++++++----------
 2 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/.changeset/tasty-oranges-rescue.md b/.changeset/tasty-oranges-rescue.md
index cc57aaffad..be1a0a2bcc 100644
--- a/.changeset/tasty-oranges-rescue.md
+++ b/.changeset/tasty-oranges-rescue.md
@@ -1,5 +1,10 @@
 ---
-'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-auth-backend': minor
 ---
 
-migrate from 'passport-saml' to '@node-saml/passport-saml'
+migrate from 'passport-saml' to '@node-saml/passport-saml'  
+This comes with breaking changes to config options:
+
+- `audience` is no mandatory
+- `wantAuthnResponseSigned` is now exposed and defaults to `true`
+- `wantAssertionsSigned` is now exposed and defaults to `true`
diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts
index 0c09f1e987..0da55ed3e4 100644
--- a/plugins/auth-backend/src/providers/saml/provider.ts
+++ b/plugins/auth-backend/src/providers/saml/provider.ts
@@ -15,7 +15,7 @@
  */
 
 import express from 'express';
-import { SamlConfig } from '@node-saml/passport-saml';
+import { SamlConfig, VerifiedCallback } from '@node-saml/passport-saml';
 import {
   Strategy as SamlStrategy,
   Profile as SamlProfile,
@@ -24,7 +24,6 @@ import {
 import {
   executeFrameHandlerStrategy,
   executeRedirectStrategy,
-  PassportDoneCallback,
 } from '../../lib/passport';
 import {
   AuthProviderRouteHandlers,
@@ -62,22 +61,19 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this.strategy = new SamlStrategy(
-      { ...options },
-      ((
-        fullProfile: SamlProfile,
-        done: PassportDoneCallback<SamlAuthResult>,
-      ) => {
-        // TODO: There's plenty more validation and profile handling to do here,
-        //       this provider is currently only intended to validate the provider pattern
-        //       for non-oauth auth flows.
-        // TODO: This flow doesn't issue an identity token that can be used to validate
-        //       the identity of the user in other backends, which we need in some form.
-        done(undefined, { fullProfile });
-      }) as VerifyWithoutRequest,
-      // TODO: Validate logout
-      () => {},
-    );
+
+    const verifier: VerifyWithoutRequest = (
+      profile: SamlProfile | null,
+      done: VerifiedCallback,
+    ) => {
+      // TODO: There's plenty more validation and profile handling to do here,
+      //       this provider is currently only intended to validate the provider pattern
+      //       for non-oauth auth flows.
+      // TODO: This flow doesn't issue an identity token that can be used to validate
+      //       the identity of the user in other backends, which we need in some form.
+      done(null, { fullProfile: profile });
+    };
+    this.strategy = new SamlStrategy(options, verifier, verifier);
   }
 
   async start(req: express.Request, res: express.Response): Promise<void> {
@@ -174,7 +170,7 @@ export const saml = createAuthProviderIntegration({
         callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
         entryPoint: config.getString('entryPoint'),
         logoutUrl: config.getOptionalString('logoutUrl'),
-        audience: config.getOptionalString('audience'),
+        audience: config.getString('audience'),
         issuer: config.getString('issuer'),
         cert: config.getString('cert'),
         privateKey: config.getOptionalString('privateKey'),
@@ -186,7 +182,10 @@ export const saml = createAuthProviderIntegration({
           | undefined,
         digestAlgorithm: config.getOptionalString('digestAlgorithm'),
         acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),
-
+        wantAuthnResponseSigned: config.getOptionalBoolean(
+          'wantAuthnResponseSigned',
+        ),
+        wantAssertionsSigned: config.getOptionalBoolean('wantAssertionsSigned'),
         appUrl: globalConfig.appUrl,
         authHandler,
         signInResolver: options?.signIn?.resolver,