Summary
- Detect a SAML HTTP-POST binding in
FederationResponse.idpURL (httpMethod == "POST" + a SAMLRequest param) and rewrite it to the SAML HTTP-Redirect (GET) binding, which the identity provider also accepts.
- Re-encode the
SAMLRequest from base64(uncompressed XML) to base64(raw-DEFLATE(XML)) and form-urlencode the whole query so base64 characters (+ / =) survive as %2B %2F %3D.
- Add
usesPostBinding and isSAMLRequest computed properties on FederationResponse to make the branching explicit and testable.
- Add regression coverage for the conversion, the encoding, and the pass-through cases.
Context
idpURL always built a GET-style URL and appended requestParams as query items. For orgs whose IdP expects the SAML request via an HTTP form POST (i.e. Microsoft Entra) the resulting URL is malformed and the IdP rejects it with AADSTS750056: SAMLRequest message was not properly base64-encoded, so federated sign-in never completes.
This Pr is a initial draft on the Solution 2 from #4, we rebuild a compliant GET request from the existing POST based parameters if, and only if, the SAMLRequest parameter is present. This is to ensure that we do not break other non SAML-based auth flows that do not require a reencode.
I also added a custom form-urlencode based encoding step for the url parameters as this is the expected coding scheme for SAML GET url parameters (for some reason) and decoding of some typically url allowed characters (i.e. +) break on ms entra side. For normal requests it should not matter, url encoding these characters is always possible just not required.
Verification
- Tested with a Microsoft Entra federated account, both the xcodes CLI and the Xcodes GUI worked for me when built against my fork of loginkit.
Scope / limitations
This targets the specific case from #4 the SAML HTTP-POST binding and has so far only been tested with Microsoft Entra.
It probably does not cover every httpMethod == "POST" federated scenario.
non-SAML POST flows are intentionally left as pass-through and are not converted. Other SAML IdPs that use the POST binding should work (the conversion follows the standard redirect binding) but haven't been verified. Feedback from users on other identity providers would be welcome.
Closes #4
Related: XcodesOrg/XcodesApp#857