重装node_modules后passport-saml对接Okta遇SAMLResponse验证错误

问题背景 #

当前Node.js应用使用passport.js + passport-saml对接Okta认证，package.json中相关依赖版本：

"passport": "^0.3.2",
"passport-azure-ad": "^4.0.0",
"passport-oauth2": "^1.4.0",
"passport-saml": "^3.2.0",

此前认证流程正常，重装node_modules后出现以下错误：

Error: SAMLResponse is not valid base64-encoded XML
    at SAML.validatePostResponseAsync (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport-saml/lib/node-saml/saml.js:562:23)
    at MultiSamlStrategy.authenticate (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport-saml/lib/passport-saml/strategy.js:80:18)
    at /opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport-saml/lib/passport-saml/multiSamlStrategy.js:28:32)
    at fetchSamlConfig (/opt/apache-tomcat-8.5.82/raptor-management-ui/routes/api-config/passport.js:31:14)
    at Object.getSamlOptions (/opt/apache-tomcat-8.5.82/raptor-management-ui/routes/api-config/passport.js:37:9)
    at MultiSamlStrategy.authenticate (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport-saml/lib/passport-saml/multiSamlStrategy.js:21:23)
    at attempt (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport/lib/middleware/authenticate.js:348:16)
    at authenticate (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/passport/lib/middleware/authenticate.js:349:7)
    at /opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/shim/shim.js:1313:22)
    at LegacyContextManager.runInContext (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/context-manager/legacy-context-manager.js:59:23)
    at WebFrameworkShim.applySegment (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/shim/shim.js:1303:25)
    at _applyRecorderSegment (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/shim/shim.js:934:20)
    at _doRecord (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/shim/shim.js:907:17)
    at authenticate (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/newrelic/lib/shim/shim.js:867:24)
    at Layer.handle [as handle_request] (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/express/lib/router/layer.js:95:5)
    at next (/opt/apache-tomcat-8.5.82/raptor-management-ui/node_modules/express/lib/router/route.js:137:13)

15天前的旧构建可正常运行，代码及依赖版本未修改，升级相关包无效，排查发现是passport-saml的间接依赖@xmldom/xmldom的近期版本更新导致的兼容问题。

解决方法 #

1. 强制锁定@xmldom/xmldom的兼容版本

passport-saml v3.2.0未适配@xmldom/xmldom的最新版本，需在package.json中强制指定PR合并前的稳定版本（如0.8.10）：

• npm（v8.3及以上）：添加overrides字段

  "overrides": {
    "@xmldom/xmldom": "0.8.10"
  }
  

• yarn：添加resolutions字段

  "resolutions": {
    "@xmldom/xmldom": "0.8.10"
  }
  

2. 重新安装依赖

删除现有依赖文件后重新安装：

# npm用户
rm -rf node_modules package-lock.json
npm install

# yarn用户
rm -rf node_modules yarn.lock
yarn install

3. 验证修复

启动应用后测试Okta登录流程，确认SAMLResponse is not valid base64-encoded XML错误消失。

长期方案

• 关注passport-saml官方仓库，等待发布适配@xmldom/xmldom新版本的补丁，待版本更新后升级passport-saml并移除上述版本锁定配置。
• 考虑升级passport-saml至v4.x版本（需评估代码兼容性），v4.x版本已重新梳理依赖，大概率已解决该兼容问题。

内容的提问来源于stack exchange，提问作者Deeptiranjan