Location of SingleLogoutService vs. AssertionConsumerService

[ww9rivers]

I am testing the generateServiceProviderMetadata function to generate a service provider metadata file.

import { readFile } from 'node:fs/promises';

export const key = await readFile('./server.key');
export const cert = await readFile('./server.crt');
export const idp_cert = await readFile('./idp.crt');

import { Strategy } from '@node-saml/passport-saml';

export const strategy = new Strategy(
	{
		host: 'sp.example.com',
    		path: '/sso/saml/acs',				// AssertionConsumerService
		logoutCallbackUrl: '/sso/saml/logout',		// SingleLogoutService
		publicCert: cert,				// SP's public cert
		issuer: 'example-service-provider',		// SP ID
		cert: idp_cert,					// IdP cert
    		entryPoint: 'https://idp.example.com/',		// IdP login
	},
	(profile, done) => {
		// Handle the authenticated user profile here
		console.log('Authenticated user:', profile);
		return done(null, profile);
	},
	(profile, done) => {
		// Handle the authenticated user profile here
		console.log('User logged out:', profile);
		return done(null, profile);
	}
);

console.log(strategy.generateServiceProviderMetadata(idp_cert, cert));

The result is below:

<?xml version="1.0"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="example-service-provider" ID="_842669b79174eeb881b76f96495bb457510f7532">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="/sso/saml/logout"/>
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://sp.example.com/sso/saml/acs"/>
  </SPSSODescriptor>
</EntityDescriptor>

How do I get AuthnRequestsSigned to be true?

Also, I assume that is what makes the metadata to include a KeyDescriptor element?

Thanks much for any insights!

[ww9rivers]

Figured it out: The SAML strategy needs to be created with a privateKey in the options. It doesn't even need to have a valid key, just something that's not undefined / null would be good enough for the metadata to be generated with what I want.

[cjbarth]

This should be addressed in more recent versions that include a direct function to generate metadata without first making a strategy.