certFingerprint is missing ?

[craph]

Hello everyone,

Is it possible to specify cert fingerprint instead of cert file ?

Thank you very much.

Best regards,

[craph]

in previous version of passport-saml there was an option called certFingerprint why this option is missing now ?

[markstos]

What evidence do you have that such an option existed?

[craph]

Hi, I'm sorry, I made a mistake 😞
I was looking for this option instead of having to set the certificate file because I have seen some application using cert fingerprint instead of cert. And I was thinking they were using passport-saml (my bad).
I'm really sorry for having said that this option existed.

Despite of this, may be is it a feasible feature ? Or am I wrong ?

Best regards,

[markstos]

By chance, did an AI suggest the certFingerprint feature existed here?

At this time, there are not plans to add support cert fingerprint. I imagine there is some increased security risk, due to some small chance to manufacture a hack that involves two things working working with the same fingerprint that's expected to be unique.

To make a persuasive argument argument, consider checking if the SAML spec references these, provide examples of specific other implementations that support this, and research any potential security implications of using fingerprints instead of full certs.

[craph]

Again I want to apologize about my assumption about the existence of this option, it was a mistake.

I tried to ask an AI how to implement SAML SSO authentication in JS project and told me that I can use passport-saml.js And gave me some code sample. And after, that I asked if it was possible to use fingerprint instead of cert file. the answer was yes and just replace the cert by certFingerprint. The AI was wrong, and me also. Really sorry.

This "option", the usage of the fingerprint is documented for example, in this GitLab documentation https://docs.gitlab.com/integration/saml/#configure-saml-support-in-gitlab
After digging more, I found that they use omniauth-saml that is based on ruby-saml.

For other example, from Okta, they have this documentation : https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html

In this documentation too, we can see Zendesk using fingerprint https://auth0.com/blog/how-saml-authentication-works/

And also Youtrack from JetBrains talks about fingerprints configuration in there documentation : https://www.jetbrains.com/help/youtrack/cloud/saml-authentication-module.html#sample-procedure-okta

At the moment, I haven't found spec references about fingerprint for SAML, I'm sorry.

You can close the discussion is you think it will not be a "good" feature to have. No problem.

Have a good day.

Best regards,

[markstos]

The other day I submitted a patch to a project that I used AI to generate. The patch was so simple and obvious looking that I was sure it was correct, but I hadn't properly tested it. It did not compile.

So we've both learned a lesson: Double-check AI results before using them in issues or PRs.

Thanks for all the examples. I've leaving this open for others to comment on. Since a number of other implementations support fingerprints, maybe it's something that should be supported here, too.