Class RelyingParty

constructor

• new RelyingParty(
      config: ResolvedConfig,
      idp: IdpMetadata | undefined,
      options?: RelyingPartyOptions,
  ): RelyingParty

  Parameters

  • config: ResolvedConfig
  • idp: IdpMetadata | undefined
  • options: RelyingPartyOptions = {}

  Returns RelyingParty

Readonlyconfig

idp

• get idp(): IdpMetadata

  The identity provider, as its metadata describes it.

  Returns IdpMetadata

Staticcreate

• create(
      config: WsFedConfig,
      options?: RelyingPartyOptions & { baseDir?: string },
  ): Promise<RelyingParty>

  Builds a relying party from a configuration object and loads the identity provider's metadata.

  Parameters

  • config: WsFedConfig
  • options: RelyingPartyOptions & { baseDir?: string } = {}

  Returns Promise<RelyingParty>

StaticfromFile

• fromFile(
      path: string,
      overrides?: Partial<WsFedConfig>,
      options?: RelyingPartyOptions,
  ): Promise<RelyingParty>

  Builds a relying party from a JSON configuration file and loads the identity provider's metadata.

  Parameters

  • path: string
  • overrides: Partial<WsFedConfig> = {}
  • options: RelyingPartyOptions = {}

  Returns Promise<RelyingParty>

handleReply

• handleReply(request: ReplyRequest, options?: ReplyOptions): Promise<WsFedLogin>

  Reads and validates the sign-in response at the reply URL: a POST of wa=wsignin1.0, wresult (a WS-Trust RequestSecurityTokenResponse holding a signed SAML 2.0 assertion) and wctx. Returns who signed in; throws a WsFedError otherwise.

  Parameters

  • request: ReplyRequest
  • options: ReplyOptions = {}

  Returns Promise<WsFedLogin>

isSignOutCleanup

• isSignOutCleanup(request: ReplyRequest): boolean

  Whether a request at the reply URL is the identity provider's sign-out cleanup (wa=wsignoutcleanup1.0, or wsignout1.0 from one that sends that instead): end this browser's session, and answer with an image or an empty 200, because the identity provider loads it as an image.

  Parameters

  • request: ReplyRequest

  Returns boolean

login

• login(options?: LoginOptions): LoginRequest

  A wsignin1.0 request. Redirect the browser to url, and keep id with that browser.

  Parameters

  • options: LoginOptions = {}

  Returns LoginRequest

logout

• logout(options?: { reply?: string }): string

  The URL that signs the person out at the identity provider (wsignout1.0), and then offers reply.

  Parameters

  • options: { reply?: string } = {}

  Returns string

metadata

• metadata(): string

  This relying party's federation metadata. Serve it, or give it to the identity provider.

  Returns string

refreshMetadata

• refreshMetadata(): Promise<IdpMetadata>

  (Re)reads the identity provider's metadata from where the configuration says it is. Call it to pick up a key rollover.

  Returns Promise<IdpMetadata>