app.js

/**
 * Module dependencies.
 */

const express             = require('express'),
      os                  = require('os'),
      fs                  = require('fs'),
      http                = require('http'),
      https               = require('https'),
      crypto              = require('crypto'),
      path                = require('path'),
      extend              = require('extend'),
      hbs                 = require('hbs'),
      logger              = require('morgan'),
      bodyParser          = require('body-parser'),
      session             = require('express-session'),
      yargs               = require('yargs/yargs'),
      xmlFormat           = require('xml-formatter'),
      samlp               = require('samlp'),
      Parser              = require('xmldom').DOMParser,
      SessionParticipants = require('samlp/lib/sessionParticipants'),
      SimpleProfileMapper = require('./lib/simpleProfileMapper.js');

/**
 * Globals
 */

const IDP_PATHS = {
  SSO: '/saml/sso',
  SLO: '/saml/slo',
  METADATA: '/metadata',
  SIGN_IN: '/signin',
  SIGN_OUT: '/signout',
  SETTINGS: '/settings',
  LOG_IN: '/login',
  ADMIN: '/admin'
}

const cryptTypes           = {
      certificate: /-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----/,
      'RSA private key': /-----BEGIN RSA PRIVATE KEY-----\n[^-]*\n-----END RSA PRIVATE KEY-----/,
      'public key': /-----BEGIN PUBLIC KEY-----\n[^-]*\n-----END PUBLIC KEY-----/,
    },
    KEY_CERT_HELP_TEXT = "Please generate a key-pair for the IdP using the following openssl command:\n" +
      "\topenssl req -x509 -new -newkey rsa:2048 -nodes -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider' -keyout idp-private-key.pem -out idp-public-cert.pem -days 7300";


function matchesCertType(value, type) {
  // console.info(`Testing ${cryptTypes[type].toString()} against "${value}"`);
  // console.info(`result: ${cryptTypes[type] && cryptTypes[type].test(value)}`);
  return cryptTypes[type] && cryptTypes[type].test(value);
}

function bufferFromString(value) {
  if (Buffer.hasOwnProperty('from')) {
    // node 6+
    return Buffer.from(value);
  } else {
    return new Buffer(value);
  }
}

function resolveFilePath(filePath) {
  var possiblePath;
  if (fs.existsSync(filePath)) {
    return filePath;
  }
  if (filePath.slice(0, 2) === '~/') {
    possiblePath = path.resolve(process.env.HOME, filePath.slice(2));
    if (fs.existsSync(possiblePath)) {
      return possiblePath;
    } else {
      // for ~/ paths, don't try to resolve further
      return filePath;
    }
  }
  ['.', __dirname].forEach(function (base) {
    possiblePath = path.resolve(base, filePath);
    if (fs.existsSync(possiblePath)) {
      return possiblePath;
    }
  });
  return null;
}

function makeCertFileCoercer(type, description, helpText) {
  return function certFileCoercer(value) {
    if (matchesCertType(value, type)) {
      return value;
    }

    const filePath = resolveFilePath(value);
    if (filePath) {
      return fs.readFileSync(filePath)
    }
    throw new Error(
      'Invalid ' + description + ', not a valid crypt cert/key or file path' +
      (helpText ? '\n' + helpText : '')
    )
  };
}

function getHashCode(str) {
  var hash = 0;
  if (str.length == 0) return hash;
  for (i = 0; i < str.length; i++) {
    char = str.charCodeAt(i);
    hash = ((hash<<5)-hash)+char;
    hash = hash & hash; // Convert to 32bit integer
  }
  return hash;
}

function defaultCommand(a) {
  return a
    .usage('\nSimple IdP for SAML 2.0 WebSSO & SLO Profile\n\n' +
      'Launches an IdP web server that mints SAML assertions or logout responses for a Service Provider (SP)\n\n' +
      'Usage:\n\t$0 run')
    .options({
      port: {
        description: 'IdP Web Server Listener Port',
        required: true,
        alias: 'p',
        default: 7000
      },
      cert: {
        description: 'IdP Signature PublicKey Certificate',
        required: true,
        default: './idp-public-cert.pem',
        coerce: makeCertFileCoercer('certificate', 'IdP Signature PublicKey Certificate', KEY_CERT_HELP_TEXT)
      },
      key: {
        description: 'IdP Signature PrivateKey Certificate',
        required: true,
        default: './idp-private-key.pem',
        coerce: makeCertFileCoercer('RSA private key', 'IdP Signature PrivateKey Certificate', KEY_CERT_HELP_TEXT)
      },
      issuer: {
        description: 'IdP Issuer URI',
        required: true,
        alias: 'iss',
        default: 'urn:example:idp'
      },
      acsUrl: {
        description: 'SP Assertion Consumer URL',
        required: false,
        alias: 'acs'
      },
      sloUrl: {
        description: 'SP Single Logout URL',
        required: false,
        alias: 'slo'
      },
      audience: {
        description: 'SP Audience URI',
        required: false,
        alias: 'aud'
      },
      serviceProviderId: {
        description: 'SP Issuer/Entity URI',
        required: false,
        alias: 'spId',
        string: true
      },
      relayState: {
        description: 'Default SAML RelayState for SAMLResponse',
        required: false,
        alias: 'rs'
      },
      disableRequestAcsUrl: {
        description: 'Disables ability for SP AuthnRequest to specify Assertion Consumer URL',
        required: false,
        boolean: true,
        alias: 'static',
        default: false
      },
      encryptAssertion: {
        description: 'Encrypts assertion with SP Public Key',
        required: false,
        boolean: true,
        alias: 'enc',
        default: false
      },
      encryptionCert: {
        description: 'SP Certificate (pem) for Assertion Encryption',
        required: false,
        string: true,
        alias: 'encCert',
        coerce: makeCertFileCoercer('certificate', 'Encryption cert')
      },
      encryptionPublicKey: {
        description: 'SP RSA Public Key (pem) for Assertion Encryption ' +
          '(e.g. openssl x509 -pubkey -noout -in sp-cert.pem)',
        required: false,
        string: true,
        alias: 'encKey',
        coerce: makeCertFileCoercer('public key', 'Encryption public key')
      },
      httpsPrivateKey: {
        description: 'Web Server TLS/SSL Private Key (pem)',
        required: false,
        string: true,
        coerce: makeCertFileCoercer('RSA private key')
      },
      httpsCert: {
        description: 'Web Server TLS/SSL Certificate (pem)',
        required: false,
        string: true,
        coerce: makeCertFileCoercer('certificate')
      },
      https: {
        description: 'Enables HTTPS Listener (requires httpsPrivateKey and httpsCert)',
        required: true,
        boolean: true,
        default: false
      },
      enableTLS1: {
        description: 'Enables TLS v1.0',
        required: true,
        boolean: true,
        default: false,
        alias: 'tls1'
      },
      signResponse: {
        description: 'Enables signing of responses',
        required: false,
        boolean: true,
        default: true,
        alias: 'signResponse'
      },
      configFile: {
        description: 'Path to a SAML attribute config file',
        required: true,
        default: require.resolve('./config.js'),
        alias: 'conf'
      },
      rollSession: {
        description: 'Create a new session for every authn request instead of reusing an existing session',
        required: false,
        boolean: true,
        default: false
      },
      authnContextClassRef: {
        description: 'Authentication Context Class Reference',
        required: false,
        string: true,
        default: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
        alias: 'acr'
      },
      authnContextDecl: {
        description: 'Authentication Context Declaration (XML FilePath)',
        required: false,
        string: true,
        alias: 'acd',
        coerce: function (value) {
          const filePath = resolveFilePath(value);
          if (filePath) {
            return fs.readFileSync(filePath, 'utf8')
          }
        }
      },
      checkProfiles: {
        description: 'Check profile existence in database',
        required: false,
        boolean: true,
        default: false,
        alias: 'check'
      },
      profileDatabase: {
        description: 'Path to profile\'s database file (JSON)',
        default: 'saml-idp-profiles.json',
        required: false,
        string: true,
        alias: 'pd'
      },
      adminGroup: {
        description: 'Name of administrator\'s group',
        default: 'admins',
        required: false,
        string: true,
        alias: 'admins',
        coerce: function (value) {
          return value.toLowerCase();
        }
      }
    })
    .example('\t$0 --acs http://acme.okta.com/auth/saml20/exampleidp --aud https://www.okta.com/saml2/service-provider/spf5aFRRXFGIMAYXQPNV', '')
    .check(function(argv, aliases) {
      if (argv.encryptAssertion) {
        if (argv.encryptionPublicKey === undefined) {
          return 'encryptionPublicKey argument is also required for assertion encryption';
        }
        if (argv.encryptionCert === undefined) {
          return 'encryptionCert argument is also required for assertion encryption';
        }
      }
      return true;
    })
    .check(function(argv, aliases) {
      if (argv.config) {
        return true;
      }
      const configFilePath = resolveFilePath(argv.configFile);

      if (!configFilePath) {
        return 'SAML attribute config file path "' + argv.configFile + '" is not a valid path.\n';
      }
      try {
        argv.config = require(configFilePath);
      } catch (error) {
        return 'Encountered an exception while loading SAML attribute config file "' + configFilePath + '".\n' + error;
      }
      return true;
    });
}

function loadConfiguration(args, options) {
  var bArgv;
  if (options) {
    bArgv = yargs(args).config(options);
  } else {
    bArgv = yargs(args).config('settings', function(settingsPathArg) {
      const settingsPath = resolveFilePath(settingsPathArg);
      return JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
    });
  }
  return bArgv;
}

function addUserCommand(y) {
  const configObj = require('./config.js');
  const options = {
    userName: {},
    password: {}
  };
  (configObj.metadata || []).forEach(function (item) {
    options[item.id] = {
      required: !item.optional,
      description: item.description,
      string: true
    };
  });
  options.userName.description = options.userName.description || '';
  options.userName.required = true;
  options.userName.string = true;
  options.password.description = options.password.description || 'User\'s password';
  options.password.required = true;
  options.password.string = true;
  options.password.coerce = getHashCode;
  options.profileDatabase = {
    description: 'Path to profile\'s database file (JSON)',
    default: 'saml-idp-profiles.json',
    required: false,
    string: true,
    alias: 'pd'
  };
  return y
    .options(options)
    .help();
}

function removeUserCommand(y) {
  return y
    .options({
      userName: {
        required: true,
        string: true
      },
      profileDatabase: {
        description: 'Path to profile\'s database file (JSON)',
        default: 'saml-idp-profiles.json',
        required: false,
        string: true,
        alias: 'pd'
      }
    })
    .help();
}

function listUsersCommand(y) {
  return y
    .options({
      profileDatabase: {
        description: 'Path to profile\'s database file (JSON)',
        default: 'saml-idp-profiles.json',
        required: false,
        string: true,
        alias: 'pd'
      }
    })
    .help();
}

function addConnectionCommand(y) {
  const options = {
    issuer: {
      required: true,
      string: true,
      alias: 'i'
    },
    certificate: {
      required: false,
      string: true,
      alias: 'c',
      coerce: function certFileCoercer(value) {
        if (matchesCertType(value, 'certificate')) {
          return value;
        }
        if (matchesCertType(value, 'public key')) {
          return value;
        }
        const filePath = resolveFilePath(value);
        if (filePath) {
          const content = fs.readFileSync(filePath, 'utf8');
          if (matchesCertType(content, 'certificate')) {
            return content;
          }
          if (matchesCertType(content, 'public key')) {
            return content;
          }
        }
        throw new Error(
          'Invalid ' + value + ', not a valid crypt cert/key or file path'
        )
      }
    },
    profileDatabase: {
      description: 'Path to profile\'s database file (JSON)',
      default: 'saml-idp-profiles.json',
      required: false,
      string: true,
      alias: 'pd'
    }
  };
  return y
    .options(options)
    .help();
}

function removeConnectionCommand(y) {
  return y
    .options({
      issuer: {
        required: true,
        string: true,
        alias: 'i'
      },
      profileDatabase: {
        description: 'Path to profile\'s database file (JSON)',
        default: 'saml-idp-profiles.json',
        required: false,
        string: true,
        alias: 'pd'
      }
    })
    .help();
}

function listConnectionsCommand(y) {
  return y
    .options({
      profileDatabase: {
        description: 'Path to profile\'s database file (JSON)',
        default: 'saml-idp-profiles.json',
        required: false,
        string: true,
        alias: 'pd'
      }
    })
    .help();
}

function addUser(dbPath, userName, password, attributes) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8')) || {};
  }
  if (!db.users) {
    db.users = [];
  }
  const [existedUser] = db.users.filter(u => {
    return (u.userName || '').toLowerCase() === (userName || '').toLowerCase();
  });
  if (!existedUser) {
    const user = {};
    Object.keys((attributes || {})).forEach(function (key) {
      user[key] = attributes[key];
    });
    user.userName = userName;
    user.password = password;
    db.users.push(user);
    fs.writeFileSync(dbPath, JSON.stringify(db));
    console.log('User added');
    return 0;
  } else {
    console.log('User already exists');
    return 1;
  }
}

function editUser(dbPath, userName, password, attributes) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8')) || {};
  }
  if (!db.users) {
    db.users = [];
  }
  const [existedUser] = db.users.filter(u => {
    return (u.userName || '').toLowerCase() === (userName || '').toLowerCase();
  });
  if (existedUser) {
    const index = db.users.indexOf(existedUser);
    Object.keys((attributes || {})).forEach(function (key) {
      existedUser[key] = attributes[key];
    });
    existedUser.userName = userName;
    existedUser.password = password || existedUser.password;
    db.users.splice(index, 1, existedUser);
    fs.writeFileSync(dbPath, JSON.stringify(db));
    console.log('User modified');
    return 0;
  } else {
    console.log('Unknown user');
    return 1;
  }
}

function removeUser(dbPath, userName) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  if (!db.users) {
    db.users = [];
  }
  const [existedUser] = db.users.filter(u => {
    return (u.userName || '').toLowerCase() === (userName || '').toLowerCase();
  });
  if (existedUser) {
    const index = db.users.indexOf(existedUser);
    if (index >= 0) {
      db.users.splice(index, 1);
    }
    fs.writeFileSync(dbPath, JSON.stringify(db));
    console.log('User removed');
    return 0;
  } else {
    console.log('User not found');
    return 1;
  }
}

function listUsers(dbPath) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  console.log((db.users || []).length, 'users');
  (db.users || []).forEach(user => {
    const attrs = [];
    Object.keys(user).forEach(key => {
      if (key !== 'password') {
        attrs.push(user[key]);
      }
    });
    console.log(attrs.join(' '));
  });
}

function getUser(dbPath, userName, password) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  return (db.users || []).filter(u => {
    return (u.userName || '').toLowerCase() === (userName || '').toLowerCase() &&
      u.password.toString() === password.toString();
  })[0];
}

function findUser(dbPath, userName) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  return (db.users || []).filter(u => {
    return (u.userName || '').toLowerCase() === (userName || '').toLowerCase()
  })[0];
}

function getUsers(dbPath) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  return (db.users || []);
}

function getIssuerWithoutLastSlash(i) {
  if (i[i.length - 1] === '/') {
    return i.substr(0, i.length - 1).toLowerCase();
  }
  return i.toLowerCase();
}

function addConnection(dbPath, issuer, certificate) {
  let db = {
    users: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8')) || {};
  }
  if (!db.connections) {
    db.connections = [];
  }
  const i = getIssuerWithoutLastSlash(issuer);
  const [existedConnection] = db.connections.filter(c => {
    return getIssuerWithoutLastSlash(c.issuer) === i;
  });
  if (!existedConnection) {
    const connection = {
      issuer,
      certificate
    };
    db.connections.push(connection);
    fs.writeFileSync(dbPath, JSON.stringify(db));
    console.log('Connection added');
  } else {
    console.log('Connection already exists');
  }
}

function removeConnection(dbPath, issuer) {
  let db = {
    connections: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  if (!db.connections) {
    db.connections = [];
  }
  const i = getIssuerWithoutLastSlash(issuer);
  const [existedConnection] = db.connections.filter(c => {
    return getIssuerWithoutLastSlash(c.issuer) === i;
  });
  if (existedConnection) {
    const index = db.connections.indexOf(existedConnection);
    if (index >= 0) {
      db.connections.splice(index, 1);
    }
    fs.writeFileSync(dbPath, JSON.stringify(db));
    console.log('Connection removed');
  } else {
    console.log('Connection not found');
  }
}

function listConnections(dbPath) {
  let db = {
    connections: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  console.log(`${(db.connections || []).length} connections`);
  (db.connections || []).forEach(connection => {
    console.log(`Issuer:\t${connection.issuer}`);
    if (connection.certificate) {
      console.log('Certificate:');
      console.log(connection.certificate);
    }
    console.log();
  });
}

function getConnection(dbPath, issuer) {
  let db = {
    connections: []
  };
  if (fs.existsSync(dbPath)) {
    db = JSON.parse(fs.readFileSync(dbPath, 'utf-8'));
  }
  const i = getIssuerWithoutLastSlash(issuer);
  return (db.connections || []).filter(c => {
    return getIssuerWithoutLastSlash(c.issuer) === i;
  })[0];
}

/**
 * Arguments
 */
function processArgs(args, options) {
  var baseArgv = loadConfiguration(args, options);
  return baseArgv
    .command(['run', '$0'], 'Launches an IdP web server that mints SAML assertions or logout responses for a Service Provider (SP)', defaultCommand, (argv) => {
      return _runServer(argv);
    })
    .command('add-user <userName> <password>', 'Add user to database', addUserCommand, (argv) => {
      const attributes = {};
      const configObj = require('./config.js');
      (configObj.metadata || []).forEach(function (item) {
        if (['userName', 'password'].indexOf(item.id) === -1) {
          attributes[item.id] = argv[item.id];
        }
      });
      addUser(argv.profileDatabase, argv.userName, argv.password, attributes);
    })
    .command('remove-user <userName>', 'Remove user form database', removeUserCommand, (argv) => {
      removeUser(argv.profileDatabase, argv.userName);
    })
    .command('list-users', 'List users', listUsersCommand, (argv) => {
      listUsers(argv.profileDatabase);
    })
    .command('add-connection <issuer>', 'Add connection to database', addConnectionCommand, (argv) => {
      addConnection(argv.profileDatabase, argv.issuer, argv.certificate);
    })
    .command('remove-connection <issuer>', 'Remove connection form database', removeConnectionCommand, (argv) => {
      removeConnection(argv.profileDatabase, argv.issuer);
    })
    .command('list-connections', 'List connections', listConnectionsCommand, (argv) => {
      listConnections(argv.profileDatabase);
    })
    .help()
    .wrap(baseArgv.terminalWidth())
    .argv;
}


function _runServer(argv) {
  const app = express();
  const {constants} = crypto;
  const secureOptions = argv.enableTLS1 ? { } : { secureOptions: constants.SSL_OP_NO_TLSv1 };
  const httpServer = argv.https ?
    https.createServer({ key: argv.httpsPrivateKey, cert: argv.httpsCert, ...secureOptions }, app) :
    http.createServer(app);
  const blocks = {};

  console.log();
  console.log('Listener Port:\n\t' + argv.port);
  console.log('HTTPS Enabled:\n\t' + argv.https);
  console.log('TLS1 Enabled:\n\t' + argv.enableTLS1);
  console.log();
  console.log('[IdP]');
  console.log();
  console.log('Issuer URI:\n\t' + argv.issuer);
  console.log('Sign Response Message:\n\t' + argv.signResponse);
  console.log('Encrypt Assertion:\n\t' + argv.encryptAssertion);
  console.log('Authentication Context Class Reference:\n\t' + argv.authnContextClassRef);
  console.log('Authentication Context Declaration:\n\n' + argv.authnContextDecl);
  console.log('Default RelayState:\n\t' + argv.relayState);
  console.log();
  console.log('[SP]');
  console.log();
  console.log('Issuer URI:\n\t' + argv.serviceProviderId);
  console.log('Audience URI:\n\t' + argv.audience);
  console.log('ACS URL:\n\t' + argv.acsUrl);
  console.log('SLO URL:\n\t' + argv.sloUrl);
  console.log('Trust ACS URL in Request:\n\t' + !argv.disableRequestAcsUrl);
  console.log();

  console.log();


  /**
   * IdP Configuration
   */

  SimpleProfileMapper.prototype.metadata = argv.config.metadata;

  const idpOptions = {
    issuer:                 argv.issuer,
    serviceProviderId:      argv.serviceProviderId || argv.audience,
    cert:                   argv.cert,
    key:                    argv.key,
    audience:               argv.audience,
    recipient:              argv.acsUrl,
    destination:            argv.acsUrl,
    acsUrl:                 argv.acsUrl,
    sloUrl:                 argv.sloUrl,
    RelayState:             argv.relayState,
    allowRequestAcsUrl:     !argv.disableRequestAcsUrl,
    digestAlgorithm:        'sha256',
    signatureAlgorithm:     'rsa-sha256',
    signResponse:           argv.signResponse,
    encryptAssertion:       argv.encryptAssertion,
    encryptionCert:         argv.encryptionCert,
    encryptionPublicKey:    argv.encryptionPublicKey,
    encryptionAlgorithm:    'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
    keyEncryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
    lifetimeInSeconds:      3600,
    authnContextClassRef:   argv.authnContextClassRef,
    authnContextDecl:       argv.authnContextDecl,
    includeAttributeNameFormat: true,
    profileMapper:          SimpleProfileMapper,
    postEndpointPath:       IDP_PATHS.SSO,
    redirectEndpointPath:   IDP_PATHS.SSO,
    logoutEndpointPaths:    argv.sloUrl ?
                            {
                              redirect: IDP_PATHS.SLO,
                              post: IDP_PATHS.SLO
                            } : {},
    getUserFromRequest:     function(req) { return req.user; },
    getPostURL:             function (audience, authnRequestDom, req, callback) {
                              return callback(null, (req.authnRequest && req.authnRequest.acsUrl) ?
                                req.authnRequest.acsUrl :
                                argv.acsUrl);
                            },
    transformAssertion:     function(assertionDom) {
                              if (argv.authnContextDecl) {
                                var declDoc;
                                try {
                                  declDoc = new Parser().parseFromString(argv.authnContextDecl);
                                } catch(err){
                                  console.log('Unable to parse Authentication Context Declaration XML', err);
                                }
                                if (declDoc) {
                                  const authnContextDeclEl = assertionDom.createElementNS('urn:oasis:names:tc:SAML:2.0:assertion', 'saml:AuthnContextDecl');
                                  authnContextDeclEl.appendChild(declDoc.documentElement);
                                  const authnContextEl = assertionDom.getElementsByTagName('saml:AuthnContext')[0];
                                  authnContextEl.appendChild(authnContextDeclEl);
                                }
                              }
                            },
    responseHandler:        function(response, opts, req, res, next) {
                              console.log();
                              console.log(`Sending SAMLResponse to ${opts.postUrl} with RelayState ${opts.RelayState} =>\n`);
                              console.log(xmlFormat(response.toString(), {indentation: '  '}));
                              console.log();
                              res.render('samlresponse', {
                                appearance: req.appearance,
                                AcsUrl: opts.postUrl,
                                SAMLResponse: response.toString('base64'),
                                RelayState: opts.RelayState
                              });
                            }
  }

  /**
   * App Environment
   */

  app.set('port', process.env.PORT || argv.port);
  app.set('views', path.join(__dirname, 'views'));

  /**
   * View Engine
   */

  app.set('view engine', 'hbs');
  app.set('view options', { layout: 'layout' })
  app.engine('handlebars', hbs.__express);

  // Register Helpers
  hbs.registerHelper('extend', function(name, context) {
    var block = blocks[name];
    if (!block) {
      block = blocks[name] = [];
    }

    block.push(context.fn(this));
  });

  hbs.registerHelper('block', function(name) {
    const val = (blocks[name] || []).join('\n');
    // clear the block
    blocks[name] = [];
    return val;
  });


  hbs.registerHelper('select', function(selected, options) {
    return options.fn(this).replace(
      new RegExp(' value=\"' + selected + '\"'), '$& selected="selected"');
  });

  hbs.registerHelper('getProperty', function(attribute, context) {
    return context[attribute];
  });

  hbs.registerHelper('serialize', function(context) {
    return new Buffer(JSON.stringify(context)).toString('base64');
  });

  hbs.registerHelper('arrayLength', function(array, plus) {
    return array.length + plus;
  });

  /**
   * Middleware
   */

  app.use(logger(':date> :method :url - {:referrer} => :status (:response-time ms)', {
    skip: function (req, res)
      {
        return req.path.startsWith('/bower_components') || req.path.startsWith('/css')
      }
  }));
  app.use(bodyParser.urlencoded({extended: true}));
  app.use(express.static(path.join(__dirname, 'public')));
  app.use(session({
    secret: 'The universe works on a math equation that never even ever really ends in the end',
    resave: false,
    saveUninitialized: true,
    name: 'idp_sid',
    cookie: { maxAge: 60 * 60 * 1000 }
  }));

  /**
   * View Handlers
   */

  const showUser = function (req, res, next) {
    if (!req.user) {
      const error = req.session.authError || req.query.error;
      const authnRequest = req.session.authnRequest;
      req.session.authError = null;
      req.session.authnRequest = null;
      res.render('login', {
        appearance: req.appearance,
        user: req.user || {},
        participant: req.participant,
        metadata: req.metadata,
        idp: req.idp.options,
        paths: IDP_PATHS,
        authnRequest: req.authnRequest || authnRequest,
        error: error,
        source: req.query.source
      });
    } else {
      res.render('user', {
        appearance: req.appearance,
        user: req.user,
        participant: req.participant,
        metadata: req.metadata,
        authnRequest: req.authnRequest,
        idp: req.idp.options,
        paths: IDP_PATHS
      });
    }
  }

  /**
   * Shared Handlers
   */

  const getCredentialsForSAMLRequest = (issuer, sessionIndex, nameId, callback) => {
    if (argv.checkProfiles && issuer) {
      console.log('Check issuer:', issuer);
      const connection = getConnection(argv.profileDatabase, issuer);
      if (connection && connection.certificate) {
        console.log('Connection found. Certificate:');
        console.log(connection.certificate);
        console.log();
        callback(null, {cert: connection.certificate});
      } else if (connection) {
        callback(null, null);
      } else {
        callback(new Error(`Unknown issuer: ${issuer}`), null);
      }
      return;
    }
    callback(null, null);
  };

  const parseSamlRequest = function(req, res, next) {
    console.log();
    samlp.parseRequest(
      req,
      {getCredentials: getCredentialsForSAMLRequest},
      function(err, data) {
        if (err) {
          return res.render('error', {
            appearance: req.appearance,
            message: 'SAML AuthnRequest Parse Error: ' + err.message,
            error: err
          });
        }
        if (data) {
          req.authnRequest = {
            relayState: req.query.RelayState || req.body.RelayState,
            id: data.id,
            issuer: data.issuer,
            destination: data.destination,
            acsUrl: data.assertionConsumerServiceURL,
            forceAuthn: data.forceAuthn === 'true'
          };
          console.log('Received AuthnRequest => \n', req.authnRequest);
        }
        return showUser(req, res, next);
      })
  };

  const getSessionIndex = function(req) {
    if (req && req.session) {
      return Math.abs(getHashCode(req.session.id)).toString();
    }
  }

  const getParticipant = function(req) {
    return {
      serviceProviderId: req.idp.options.serviceProviderId,
      sessionIndex: getSessionIndex(req),
      nameId: req.user.userName,
      nameIdFormat: req.user.nameIdFormat,
      serviceProviderLogoutURL: req.idp.options.sloUrl
    }
  }

  const parseLogoutRequest = function(req, res, next) {
    if (!req.idp.options.sloUrl) {
      return res.render('error', {
        appearance: req.appearance,
        message: 'SAML Single Logout Service URL not defined for Service Provider'
      });
    };

    console.log('Processing SAML SLO request for participant => \n', req.participant);

    return samlp.logout({
      issuer:                 req.idp.options.issuer,
      cert:                   req.idp.options.cert,
      key:                    req.idp.options.key,
      digestAlgorithm:        req.idp.options.digestAlgorithm,
      signatureAlgorithm:     req.idp.options.signatureAlgorithm,
      sessionParticipants:    new SessionParticipants(
      [
        req.participant
      ]),
      clearIdPSession: function(callback) {
        console.log('Destroying session ' + req.session.id + ' for participant', req.participant);
        req.session.destroy();
        callback();
      }
    })(req, res, next);
  }

  /**
   * Routes
   */

  app.use(function(req, res, next){
    if (argv.rollSession) {
      req.session.regenerate(function(err) {
        return next();
      });
    } else {
      next()
    }
  });

  app.use(function(req, res, next){
    if (!argv.checkProfiles) {
      req.user = argv.config.user;
    }
    req.appearance = argv.config.appearance;
    req.metadata = argv.config.metadata;
    req.idp = { options: idpOptions };
    if (!argv.checkProfiles) {
      req.participant = getParticipant(req);
    }
    next();
  });

  app.get(['/', '/idp', IDP_PATHS.SSO], parseSamlRequest);
  app.post(['/', '/idp', IDP_PATHS.SSO], parseSamlRequest);

  app.get(IDP_PATHS.SLO, parseLogoutRequest);
  app.post(IDP_PATHS.SLO, parseLogoutRequest);

  if (argv.checkProfiles) {
    app.post([IDP_PATHS.LOG_IN], function(req, res, next) {
      const user = getUser(argv.profileDatabase, req.body.userName, getHashCode(req.body.password));
      if (user) {
        console.log('User found');
        req.session.authError = null;
        (argv.config.metadata || []).forEach(metadataItem => {
          if (!user.hasOwnProperty(metadataItem.id)) {
            user[metadataItem.id] = '';
          }
        });
        req.user = user;
        req.participant = getParticipant(req);
        const authOptions = extend({}, req.idp.options);
        if (req.body.hasOwnProperty('_authnRequest')) {
          const buffer = new Buffer(req.body['_authnRequest'], 'base64');
          req.authnRequest = JSON.parse(buffer.toString('utf8'));
          // Apply AuthnRequest Params
          authOptions.inResponseTo = req.authnRequest.id;
          if (req.authnRequest.acsUrl) {
            authOptions.acsUrl = req.authnRequest.acsUrl;
            authOptions.recipient = req.authnRequest.acsUrl;
            authOptions.destination = req.authnRequest.acsUrl;
            authOptions.audience = req.authnRequest.issuer;
            authOptions.forceAuthn = req.authnRequest.forceAuthn;
          }
          if (req.authnRequest.relayState) {
            authOptions.RelayState = req.authnRequest.relayState;
          }
        }
        req.session.currentUser = user.userName;
        if (req.body.source === 'administration') {
          res.redirect(IDP_PATHS.ADMIN);
          return;
        }
        if (!authOptions.encryptAssertion) {
          delete authOptions.encryptionCert;
          delete authOptions.encryptionPublicKey;
        }
        // Set Session Index
        authOptions.sessionIndex = getSessionIndex(req);

        // Keep calm and Single Sign On
        console.log('Sending SAML Response\nUser => \n%s\nOptions => \n',
          JSON.stringify(req.user, null, 2), authOptions);
        samlp.auth(authOptions)(req, res, next);
      } else {
        console.log('User not found');
        req.user = {
          email: req.body.email,
          error: 'Wrong e-mail or password'
        };
        req.session.authError = 'Incorrect user name or password';
        if (req.body.hasOwnProperty('_authnRequest')) {
          const buffer = new Buffer(req.body['_authnRequest'], 'base64');
          req.session.authnRequest = JSON.parse(buffer.toString('utf8'));
        }
        res.redirect('/');
      }
    });
  }

  app.post(IDP_PATHS.SIGN_IN, function(req, res) {
    const authOptions = extend({}, req.idp.options);
    Object.keys(req.body).forEach(function(key) {
      var buffer;
      if (key === '_authnRequest') {
        buffer = new Buffer(req.body[key], 'base64');
        req.authnRequest = JSON.parse(buffer.toString('utf8'));

        // Apply AuthnRequest Params
        authOptions.inResponseTo = req.authnRequest.id;
        if (req.idp.options.allowRequestAcsUrl && req.authnRequest.acsUrl) {
          authOptions.acsUrl = req.authnRequest.acsUrl;
          authOptions.recipient = req.authnRequest.acsUrl;
          authOptions.destination = req.authnRequest.acsUrl;
          authOptions.forceAuthn = req.authnRequest.forceAuthn;
        }
        if (req.authnRequest.relayState) {
          authOptions.RelayState = req.authnRequest.relayState;
        }
      } else {
        req.user[key] = req.body[key];
      }
    });

    if (!authOptions.encryptAssertion) {
      delete authOptions.encryptionCert;
      delete authOptions.encryptionPublicKey;
    }

    // Set Session Index
    authOptions.sessionIndex = getSessionIndex(req);

    // Keep calm and Single Sign On
    console.log('Sending SAML Response\nUser => \n%s\nOptions => \n',
      JSON.stringify(req.user, null, 2), authOptions);
    samlp.auth(authOptions)(req, res);
  });

  app.get(IDP_PATHS.METADATA, function(req, res, next) {
    samlp.metadata(req.idp.options)(req, res);
  });

  app.post(IDP_PATHS.METADATA, function(req, res, next) {
    if (req.body && req.body.attributeName && req.body.displayName) {
      var attributeExists = false;
      const attribute = {
        id: req.body.attributeName,
        optional: true,
        displayName: req.body.displayName,
        description: req.body.description || '',
        multiValue: req.body.valueType === 'multi'
      };

      req.metadata.forEach(function(entry) {
        if (entry.id === req.body.attributeName) {
          entry = attribute;
          attributeExists = true;
        }
      });

      if (!attributeExists) {
        req.metadata.push(attribute);
      }
      console.log("Updated SAML Attribute Metadata => \n", req.metadata)
      res.status(200).end();
    }
  });

  app.get(IDP_PATHS.SIGN_OUT, function(req, res, next) {
    if (req.idp.options.sloUrl) {
      console.log('Initiating SAML SLO request for user: ' + req.user.userName +
      ' with sessionIndex: ' + getSessionIndex(req));
      res.redirect(IDP_PATHS.SLO);
    } else {
      console.log('SAML SLO is not enabled for SP, destroying IDP session');
      req.session.destroy(function(err) {
        if (err) {
          throw err;
        }
        res.redirect('back');
      })
    }
  });

  function userIsAdmin (user) {
    return (user.groups || '').split(',').map(g => g.trim().toLowerCase()).indexOf(argv.adminGroup) >= 0;
  }

  app.get([IDP_PATHS.ADMIN], function (req, res, next) {
    const user = findUser(argv.profileDatabase, req.session.currentUser);
    if (!user) {
      res.redirect('/?source=administration');
      return;
    } else if (!userIsAdmin(user)) {
      res.redirect('/?source=administration&error=' + encodeURIComponent('You have no permissions to manage users'));
      return;
    }
    res.render('administration/users', {
      paths: IDP_PATHS,
      appearance: req.appearance,
      idp: req.idp.options,
      layout: 'administration/layout',
      users: getUsers(argv.profileDatabase),
      metadata: req.metadata
    });
  });

  app.post([IDP_PATHS.ADMIN], function (req, res, next) {
    const user = findUser(argv.profileDatabase, req.session.currentUser);
    if (!user) {
      res.status(440).send('Session expired');
      return;
    } else if (!userIsAdmin(user)) {
      res.status(440).send('You have no permissions to manage users');
      return;
    }
    if (req.body && req.body.userName) {
      try {
        if ((req.body.isNew || !!req.body.password || !!req.body.confirmPassword) &&
          req.body.password !== req.body.confirmPassword) {
          res.status(500).send('Passwords are different! Please, confirm password');
          return;
        }
        const user = findUser(argv.profileDatabase, req.body.userName);
        if (user && req.body.isNew) {
          res.status(500).send('User with user name "' + req.body.userName + '" already exists.');
          return;
        }
        const attributes = req.body;
        const userName = req.body.userName;
        const password = req.body.password;
        const isNew = req.body.isNew;
        delete attributes.userName;
        delete attributes.password;
        delete attributes.confirmPassword;
        delete attributes.isNew;
        let result = 0;
        if (isNew) {
          result = addUser(argv.profileDatabase, userName, getHashCode(password), attributes);
        } else {
          console.log(password, getHashCode(password));
          result = editUser(argv.profileDatabase, userName, password ? getHashCode(password) : undefined, attributes);
        }
        if (result === 0) {
          res.sendStatus(200).end();
        } else if (result === 1) {
          if (isNew) {
            res.status(500).send('User with user name "' + req.body.userName + '" already exists.');
          } else {
            res.status(500).send('User with user name "' + req.body.userName + '" not found.');
          }
        } else {
          if (isNew) {
            res.status(500).send('Error creating user');
          } else {
            res.status(500).send('Error modifying user');
          }
        }
      } catch (error) {
        res.status(500).send(error.message);
      }
    }
  });

  app.delete([IDP_PATHS.ADMIN], function (req, res, next) {
    const user = findUser(argv.profileDatabase, req.session.currentUser);
    if (!user) {
      res.status(440).send('Session expired');
      return;
    } else if (!userIsAdmin(user)) {
      res.status(440).send('You have no permissions to manage users');
      return;
    }
    if (req.body && req.body.userName) {
      try {
        const result = removeUser(argv.profileDatabase, req.body.userName);;
        if (result === 0) {
          res.sendStatus(200).end();
        } else if (result === 1) {
          res.status(500).send('User with user name "' + req.body.userName + '" not found.');
        } else {
          res.status(500).send('Error removing user');
        }
      } catch (error) {
        res.status(500).send(error.message);
      }
    }
  });

  app.get([IDP_PATHS.SETTINGS], function(req, res, next) {
    res.render('settings', {
      appearance: req.appearance,
      idp: req.idp.options
    });
  });

  app.post([IDP_PATHS.SETTINGS], function(req, res, next) {
    Object.keys(req.body).forEach(function(key) {
      switch(req.body[key].toLowerCase()){
        case "true": case "yes": case "1":
          req.idp.options[key] = true;
          break;
        case "false": case "no": case "0":
          req.idp.options[key] = false;
          break;
        default:
          req.idp.options[key] = req.body[key];
          break;
      }

      if (req.body[key].match(/^\d+$/)) {
        req.idp.options[key] = parseInt(req.body[key], '10');
      }
    });

    console.log('Updated IdP Configuration => \n', req.idp.options);
    res.redirect('/');
  });

  // catch 404 and forward to error handler
  app.use(function(req, res, next) {
    const err = new Error('Route Not Found');
    err.status = 404;
    next(err);
  });

  // development error handler
  app.use(function(err, req, res, next) {
    if (err) {
      res.status(err.status || 500);
      res.render('error', {
          appearance: req.appearance,
          message: err.message,
          error: err
      });
    }
  });

  /**
   * Start IdP Web Server
   */

  console.log('starting idp server on port %s', app.get('port'));

  httpServer.listen(app.get('port'), function() {
    const scheme   = argv.https ? 'https' : 'http',
        address  = httpServer.address(),
        hostname = os.hostname();
        baseUrl  = address.address === '0.0.0.0' || address.address === '::' ?
          scheme + '://' + hostname + ':' + address.port :
          scheme + '://localhost:' + address.port;

    console.log();
    console.log('SAML IdP Metadata URL: ');
    console.log('\t=> ' + baseUrl + IDP_PATHS.METADATA);
    console.log();
    console.log('SSO Bindings: ');
    console.log();
    console.log('\turn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST');
    console.log('\t\t=> ' + baseUrl + IDP_PATHS.SSO);
    console.log('\turn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect');
    console.log('\t\t=> ' + baseUrl + IDP_PATHS.SSO);
    console.log();
    if (argv.sloUrl) {
      console.log('SLO Bindings: ');
      console.log();
      console.log('\turn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST');
      console.log('\t\t=> ' + baseUrl + IDP_PATHS.SLO);
      console.log('\turn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect');
      console.log('\t\t=> ' + baseUrl + IDP_PATHS.SLO);
      console.log();
    }
    console.log('idp server ready');
    console.log('\t=> ' + baseUrl);
    console.log();
  });
}

function runServer(options) {
  const args = defaultCommand(loadConfiguration([], options));
  return _runServer(args.argv);
}

function main () {
  processArgs(process.argv.slice(2));
}

module.exports = {
  runServer,
  main,
};

if (require.main === module) {
  main();
}