Update README to clarify that saml.cert requires a PEM-encoded x509 c… #133
Conversation
Format was confirmed by checking test data here: https://github.com/bergie/passport-saml/blob/master/test/tests.js
README.md
Outdated
| @@ -117,12 +117,18 @@ Authentication requests sent by Passport-SAML can be signed using RSA-SHA1. To s | |||
| privateCert: fs.readFileSync('./cert.pem', 'utf-8') | |||
| ``` | |||
|
|
|||
| It is a good idea to validate the incoming SAML Responses. For this, you can provide the Identity Provider's certificate using the `cert` confguration key: | |||
| It is a good idea to validate the incoming SAML Responses. For this, you can provide the Identity Provider's PEM-encoded X.509 certificate using the `cert` confguration key. The "BEGIN CERTIFICATE" and "END CERTIFICATE" lines should be stripped out and the certificate should be provided on a single line. | |||
|
|
|||
There was a problem hiding this comment.
Thanks for this info. This is very useful.
There was a problem hiding this comment.
You are welcome. Hopefully the contribution will get merged so it will be easier for other people to find.
|
👍 |
|
@markstos I was considering a fix for this that would, instead of constraining format, fix the cert-to-PEM conversion so that any provided format containing the body of the certificate (with or without newlines and the BEGIN/END lines) would work correctly. Thoughts? |
|
@pdspicer supporting the BEGIN/END lines and linebreaks would we a welcome addition. |
|
In that case I will close this PR once that change is made available, sound good? |
|
Yep.
…On Thu, Mar 30, 2017 at 10:36 AM, Paul Spicer ***@***.***> wrote:
In that case I will close this PR once that change is made available,
sound good?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#133 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AABk5ZEe0Cb-udn29jSNBQjM6kiTUa9kks5rq73ggaJpZM4HFHL4>
.
--
Mark Stosberg
Senior Systems Engineer
RideAmigos
|
|
I went ahead and merged this. When @pdspicer follows through to make the code more flexible about the cert format, we can update the README to match. |
…ertificate.