saml: make response/assertion compliant with SAML v2.0

[hpedrorodrigues]

Hey 👋🏻

First of all, thanks for working on this project! 🚀

Problem Description

I tried to use this project with Keycloak (KC as a service provider and later as an identity broker), but encountered a few issues along the way. So, decided to open this pull request in case it can help others.

Proposed changes

• Added a new getBaseUrl function to properly compute protocol + domain (and port). This is required to better support running this project on a local device.
  • For instance, when setting NEXT_PUBLIC_DUMMYIDP_CUSTOM_DOMAIN=localhost:3000, it tries to use HTTPS.
  • And when no NEXT_PUBLIC_DUMMYIDP_CUSTOM_DOMAIN is set, it doesn't use a valid "default" address.

• Added missing required attributes in both response (ID, IssueInstant, and Version) and assertion (IssueInstant and Version), and took the opportunity to add a few optional attributes as well (e.g., InResponseTo).
• Added missing required child elements to the response (Status).
• Added a new attribute statement for email. Even though most of the time it'll be equal to the Name ID, there are cases where IdPs use an external ID for Name ID, making it required to use a separate statement to pass/extract the email.
• Added an xml tag template function to make it a bit easier to write XMLs and reason about them.

Reference

I implemented these changes based on the SAML v2.0 specification and Keycloak's Server Administration Guide.

I also used samltool.io to check assertions (e.g., signature, etc.).

Versions

I tested these changes with the following versions:

• Google Chrome: 139.0.7258.128 (Official Build) (arm64)
• Keycloak: 26.3.2
• DummyIdP: default branch (last commit: 162dd87)

Fixes

#18

Notes

Please let me know if you have any concerns/feedback, and if this makes sense for the project.

[vercel]

@hpedrorodrigues is attempting to deploy a commit to the SSOReady Team on Vercel.

A member of the Team first needs to authorize it.

[hpedrorodrigues]

Hey @ucarion 👋🏻

Is there anything else I can do to move this forward?