allow to set a saml client certificate

Signed-off-by: Simeon Keske <git@n0emis.eu>

lib/config/default.js

@@ -143,6 +143,7 @@ module.exports = {
   saml: {
     idpSsoUrl: undefined,
     idpCert: undefined,
+    clientCert: undefined,
     issuer: undefined,
     identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
     disableRequestedAuthnContext: false,

lib/config/environment.js

@@ -120,6 +120,7 @@ module.exports = {
   saml: {
     idpSsoUrl: process.env.CMD_SAML_IDPSSOURL,
     idpCert: process.env.CMD_SAML_IDPCERT,
+    clientCert: process.env.CMD_SAML_CLIENTCERT,
     issuer: process.env.CMD_SAML_ISSUER,
     identifierFormat: process.env.CMD_SAML_IDENTIFIERFORMAT,
     disableRequestedAuthnContext: toBooleanConfig(process.env.CMD_SAML_DISABLEREQUESTEDAUTHNCONTEXT),

lib/web/auth/saml/index.js

@@ -17,6 +17,7 @@ passport.use(new SamlStrategy({
   entryPoint: config.saml.idpSsoUrl,
   issuer: config.saml.issuer || config.serverURL,
   cert: fs.readFileSync(config.saml.idpCert, 'utf-8'),
+  privateCert: config.saml.clientCert === undefined ? undefined : fs.readFileSync(config.saml.clientCert, 'utf-8'),
   identifierFormat: config.saml.identifierFormat,
   disableRequestedAuthnContext: config.saml.disableRequestedAuthnContext
 }, function (user, done) {