team2_server/node_modules/adal-node/lib/wstrust-response.js

/*
 * @copyright
 * Copyright © Microsoft Open Technologies, Inc.
 *
 * All Rights Reserved
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http: *www.apache.org/licenses/LICENSE-2.0
 *
 * THIS CODE IS PROVIDED *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS
 * OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
 * ANY IMPLIED WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A
 * PARTICULAR PURPOSE, MERCHANTABILITY OR NON-INFRINGEMENT.
 *
 * See the Apache License, Version 2.0 for the specific language
 * governing permissions and limitations under the License.
 */
'use strict';

var xmldom = require('xmldom');

var xmlutil = require('./xmlutil');

var Logger = require('./log').Logger;

var WSTrustVersion = require('./constants').WSTrustVersion;

var select = xmlutil.xpathSelect;
var DOMParser = xmldom.DOMParser;

// A regular expression for finding the SAML Assertion in an RSTR.  Used to remove the SAML
// assertion when logging the RSTR.
var assertionRegEx = /RequestedSecurityToken.*?((<.*?:Assertion.*?>).*<\/.*?Assertion>).*?/;

/**
 * Creates a log message that contains the RSTR scrubbed of the actual SAML assertion.
 * @private
 * @return {string} A log message.
 */
function scrubRSTRLogMessage(RSTR) {
  var scrubbedRSTR = null;

  var singleLineRSTR = RSTR.replace(/(\r\n|\n|\r)/gm,'');

  var matchResult = assertionRegEx.exec(singleLineRSTR);
  if (null === matchResult) {
    // No Assertion was matched so just return the RSTR as is.
    scrubbedRSTR = singleLineRSTR;
  } else {
    var samlAssertion = matchResult[1];
    var samlAssertionStartTag = matchResult[2];

    scrubbedRSTR = singleLineRSTR.replace(samlAssertion, samlAssertionStartTag + 'ASSERTION CONTENTS REDACTED</saml:Assertion>');
  }

  return 'RSTR Response: ' + scrubbedRSTR;
}

/**
 * Creates a new WSTrustResponse instance.
 * @constructor
 * @private
 * @param {object} callContext Contains any context information that applies to the request.
 * @param {string} response   A soap response from a WS-Trust request.
 * @param {sting}  wstrustVersion The version for the WS-Trust request. 
 */
function WSTrustResponse(callContext, response, wstrustVersion) {
  this._log = new Logger('WSTrustResponse', callContext._logContext);
  this._callContext = callContext;
  this._response = response;
  this._dom = null;
  this._errorCode = null;
  this._faultMessage = null;
  this._tokenType = null;
  this._token = null;
  this._wstrustVersion = wstrustVersion;

  this._log.verbose(function(){return scrubRSTRLogMessage(response);});
}

/**
 * If the soap response contained a soap fault then this property will contain the fault
 * error code.  Otherwise it will return null
 * @instance
 * @type {string}
 * @memberOf WSTrustResponse
 * @name errorCode
 */
Object.defineProperty(WSTrustResponse.prototype, 'errorCode', {
  get: function() {
    return this._errorCode;
  }
});

/**
 * @property {string} FaultMessage If the soap resopnse contained a soap fault with a fault message then it will
 * be returned by this property.
 * @instance
 * @type {string}
 * @memberOf WSTrustResponse
 * @name faultMessage
 */
Object.defineProperty(WSTrustResponse.prototype, 'faultMessage', {
  get: function() {
    return this._faultMessage;
  }
});

/**
 * @property {string} TokenType If the soap resonse contained a token then this property will contain
 * the token type uri
 * @instance
 * @type {string}
 * @memberOf WSTrustResponse
 * @name tokenType
 */
Object.defineProperty(WSTrustResponse.prototype, 'tokenType', {
  get: function() {
    return this._tokenType;
  }
});

/**
 * @property {string} Token If the soap response contained a token then this property will hold that token.
 * @instance
 * @type {string}
 * @memberOf WSTrustResponse
 * @name token
 */
Object.defineProperty(WSTrustResponse.prototype, 'token', {
  get: function() {
    return this._token;
  }
});

    // Sample error message
    //<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    //   <s:Header>
    //    <a:Action s:mustUnderstand="1">http://www.w3.org/2005/08/addressing/soap/fault</a:Action>
    //  - <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    //      <u:Timestamp u:Id="_0">
    //      <u:Created>2013-07-30T00:32:21.989Z</u:Created>
    //      <u:Expires>2013-07-30T00:37:21.989Z</u:Expires>
    //      </u:Timestamp>
    //    </o:Security>
    //    </s:Header>
    //  <s:Body>
    //    <s:Fault>
    //      <s:Code>
    //        <s:Value>s:Sender</s:Value>
    //        <s:Subcode>
    //        <s:Value xmlns:a="http://docs.oasis-open.org/ws-sx/ws-trust/200512">a:RequestFailed</s:Value>
    //        </s:Subcode>
    //      </s:Code>
    //      <s:Reason>
    //      <s:Text xml:lang="en-US">MSIS3127: The specified request failed.</s:Text>
    //      </s:Reason>
    //    </s:Fault>
    // </s:Body>
    //</s:Envelope>

/**
 * Attempts to parse an error from the soap response.  If there is one then it
 * will fill in the error related properties.  Otherwsie it will do nothing.
 * @private
 * @returns {bool} true if an error was found and parsed in the response.
 */
WSTrustResponse.prototype._parseError = function() {
  var errorFound = false;

  var faultNode = select(this._dom, '//s:Envelope/s:Body/s:Fault/s:Reason');
  if (faultNode.length) {
    this._faultMessage = xmlutil.serializeNodeChildren(faultNode[0]);

    if (this._faultMessage) {
      errorFound = true;
    }
  }

  // Subcode has minoccurs=0 and maxoccurs=1(default) according to the http://www.w3.org/2003/05/soap-envelope
  // Subcode may have another subcode as well. This is only targetting at top level subcode.
  // Subcode value may have different messages not always uses http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd.
  // text inside the value is not possible to select without prefix, so substring is necessary
  var subcodeNode = select(this._dom, '//s:Envelope/s:Body/s:Fault/s:Code/s:Subcode/s:Value');
  if (1 < subcodeNode.length) {
    throw this._log.createError('Found too many fault code values:' + subcodeNode.length);
  }

  if (subcodeNode.length) {
    var errorCode = subcodeNode[0].firstChild.data;
    this._errorCode = (errorCode.split(':'))[1];
    errorFound = true;
  }

  return errorFound;
};

/**
 * Attempts to parse a token from the soap response.  If there is one then it will fill in the
 * token related properties.  Otherwise it does nothing.
 * @private
 * @throws {Error} If the response is not parseable, or too many tokens are found.
 */
WSTrustResponse.prototype._parseToken = function() {
  var xPath = this._wstrustVersion === WSTrustVersion.WSTRUST2005 ? '//s:Envelope/s:Body/t:RequestSecurityTokenResponse/t:TokenType' : '//s:Envelope/s:Body/wst:RequestSecurityTokenResponseCollection/wst:RequestSecurityTokenResponse/wst:TokenType';

  var tokenTypeNodes = select(this._dom, xPath);
  if (!tokenTypeNodes.length) {
    this._log.warn('No TokenType elements found in RSTR');
  }

  for (var i = 0, length = tokenTypeNodes.length; i < length; i++) {
    if (this._token) {
      this._log.warn('Found more than one returned token.  Using the first.');
      break;
    }

    var tokenTypeNode = tokenTypeNodes[i];
    var tokenType = xmlutil.findElementText(tokenTypeNode);
    if (!tokenType) {
      this._log.warn('Could not find token type in RSTR token');
    }

    var securityTokenPath = this._wstrustVersion === WSTrustVersion.WSTRUST2005 ? 't:RequestedSecurityToken' : 'wst:RequestedSecurityToken';
    var requestedTokenNode = select(tokenTypeNode.parentNode, securityTokenPath);
    if (1 < requestedTokenNode) {
      throw this._log.createError('Found too many RequestedSecurityToken nodes for token type: ' + tokenType);
    }
    if (!requestedTokenNode.length) {
      this._log.warn('Unable to find RequestsSecurityToken element associated with TokenType element: ' + tokenType);
      continue;
    }

    var token = xmlutil.serializeNodeChildren(requestedTokenNode[0]);
    if (!token) {
      this._log.warn('Unable to find token associated with TokenType element: ' + tokenType);
      continue;
    }

    this._token = token;
    this._tokenType = tokenType;

    this._log.info('Found token of type: ' + this._tokenType);
  }

  if (!this._token) {
    throw this._log.createError('Unable to find any tokens in RSTR.');
  }
};

/**
 * This method parses the soap response that was passed in at construction.
 * @throws {Error} If the server returned an error, or there was any failure to parse the response.
 */
WSTrustResponse.prototype.parse = function() {
  if (!this._response) {
    throw this._log.createError('Received empty RSTR response body.');
  }

  try {
    try {
      var options = {
        errorHandler : this._log.error
      };
      this._dom = new DOMParser(options).parseFromString(this._response);
    } catch (err) {
      throw this._log.createError('Failed to parse RSTR in to DOM', err, true);
    }

    var errorFound = this._parseError();

    if (errorFound) {
      var stringErrorCode = this.ErrorCode || 'NONE';
      var stringFaultMessage = this.FaultMessage || 'NONE';
      throw this._log.createError('Server returned error in RSTR - ErrorCode: ' + stringErrorCode + ' : FaultMessage: ' + stringFaultMessage, true);
    }

    this._parseToken();
  } catch (err) {
    delete this._dom;
    throw err;
  }
};

module.exports = WSTrustResponse;