Setu-TS
    Preparing search index...

    Interface SamlProvider

    A SAML 2.0 identity provider, for which this application acts as the service provider (M100f).

    Login is SP-initiated over the HTTP-Redirect binding and the response returns to the assertion consumer service over HTTP-POST. Assertions must be signed; IdP-initiated (unsolicited) responses, encrypted assertions and single logout are refused or not offered.

    0.8.0

    interface SamlProvider {
        acsUrl: string;
        entityId: string;
        failureRedirect?: string;
        idp: { certs: readonly string[]; entityId: string; ssoUrl: string };
        kind: "saml";
        module?: SamlModule;
        name: string;
        store?: ISamlRequestStore;
        toPrincipal(
            profile: SamlProfile,
        ): IPrincipal | Promise<IPrincipal | null> | null;
    }
    Index
    acsUrl entityId failureRedirect? idp kind module? name store?
    toPrincipal
    acsUrl: string

    The absolute assertion consumer service URL the IdP posts to. Its path must end with <basePath>/<name>/acs; the assertion's Recipient and the response's Destination must equal it.

    entityId: string

    This application's SP entity id. Sent as the AuthnRequest Issuer, required as the assertion's Audience, and published in the metadata.

    failureRedirect?: string

    Redirect here with a fixed ?error= code instead of answering 401. Same-origin absolute path.

    idp: { certs: readonly string[]; entityId: string; ssoUrl: string }

    The identity provider.

    Type Declaration

    • Readonlycerts: readonly string[]

      The IdP's signing certificates, PEM. More than one lets a key rotation overlap; an assertion signed by any of them verifies.

    • ReadonlyentityId: string

      The IdP's entity id; the assertion Issuer must equal it exactly.

    • ReadonlyssoUrl: string

      The IdP's single-sign-on URL for the HTTP-Redirect binding.

    kind: "saml"

    Discriminant.

    module?: SamlModule

    An injected SAML library module; skips the lazy @node-saml/node-saml import.

    name: string

    Kebab-case name, used in the route paths (/auth/<name>/login).

    store?: ISamlRequestStore

    Pending-request and assertion-replay store. Defaults to a MemorySamlRequestStore, which is correct for ONE replica only.

    Settings
    Member Visibility

    On This Page
    Properties
    Methods