Does passport-saml supports VMWare SSO?

[mayank-singh-oh]

Does passport-saml supports VMWare SSO?
Also does anyone has test account for it. I needed to test this and integrate this in my app,

[SO-ashusrivastava]

Anyone please provide any update.

[markstos]

Passport SAML supports SAML 2.0. Does VMware SSO support SAML 2.0?

[mayank-singh-oh]

Passport SAML supports SAML 2.0. Does VMware SSO support SAML 2.0?

Yes VMware is working with passport-saml v-3.1.0.
But not working with @node-saml/passport-saml v-4.0.4

[srd90]

If you want someone to help it would be good idea to provide more insight to your problem. E.g. stacktrace/error messages.

You mentioned that 3.1.0 works but 4.0.4 doesn't...which would implicate that you haven't gone through changes between those two version: https://github.com/node-saml/passport-saml/blob/v4.0.4/CHANGELOG.md

Note: you should read through also @node-saml/node-saml changelog (starting from @node-saml/passport-saml >= 4.0.0 core SAML functionality was splitted to that library. passport-saml used it under the hoods): https://github.com/node-saml/node-saml/blob/v4.0.5/CHANGELOG.md

For example about all configuration option with few exceptions are passed as-is from passport-saml to node-saml.

I bet that your problem is either with signatures like so many others had while migrating from < 4.0.0 to >= 4.0.0 see issues listed at this comment: #870 (comment) for more information.

Or you might have troubles with audience validation ( https://github.com/node-saml/node-saml/blob/v4.0.5/CHANGELOG.md#-major-changes-1 ).

[srd90]

One more thing: if you want to continue with deprecated 3.x series of passport-saml consider upgrading at least from 3.1.0 to 3.2.4.

At the moment you have version (3.1.0) which has this vulnerability which enables authentication bypass and privilege escalation scenarios (attacker is able sign in as any user with any assertions):

• GHSA-m974-647v-whv7
  • which was actually caused by
    GHSA-crh6-fp67-6883

In the context of your application (given the content that you have provided in this discussion it is probably somehow related to virtual machine management) consequences of authentication bypass and privilege escalation could be quite dramatic.