node-saml / passport-saml

SAML 2.0 authentication with Passport

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[BUG] Cannot find name 'Element' and 'Node'

thiagonsiq opened this issue · comments

To Reproduce

Start of the node application triggers the following errors:

node_modules/passport-saml/lib/node-saml/saml.d.ts:54:38 - error TS2304: Cannot find name 'Node'.
54 _getNameIdAsync(self: SAML, doc: Node): Promise;
node_modules/passport-saml/lib/node-saml/saml.d.ts:54:38 - error

TS2304: Cannot find name 'Node'.
54 _getNameIdAsync(self: SAML, doc: Node): Promise;

Expected behavior

Expect to be able to npm run start and have the node application start as normal.

Environment

  • Node.js version: 16.14.2
  • passport-saml version: 3.2.1 (also tried with 3.2.0 and 3.1.2)
  • node-saml version: 4.0.0-beta.2
commented

@thiagonsiq you wrote that environment is:

  • passport-saml version: 3.2.1 (also tried with 3.2.0 and 3.1.2)
  • node-saml version: 4.0.0-beta.2

Just out of curiosity why are you mixing passport-saml 3.2.1 and node-saml 4.0.0-beta.2 packages into same application?

node-saml is (shall be) transitive dependecy of passport-saml 4.x. passport-saml was splitted to passport specific part and separated node-saml package which is does not depend on any specific framewor.

I.e. if you are using passprot-saml module you should let it decide which node-saml version it "pulls" as transitive dependency.

passport-saml versions < 4.x contain node-saml stuff "inline".

Starting from passport-saml >= 4.x (it is not yet officially released) it has node-saml as one of it dependencies and your dependency management software shall resolve proper node-saml version for you (i.e. you should have only passport-saml in you package.json file and if you do not need anything from passport-saml module leave it out and put node-saml to package.json).

passport-saml 3.2.1's dependencies are

"dependencies": {
"@xmldom/xmldom": "^0.7.5",
"debug": "^4.3.2",
"passport-strategy": "^1.0.0",
"xml-crypto": "^2.1.3",
"xml-encryption": "^2.0.0",
"xml2js": "^0.4.23",
"xmlbuilder": "^15.1.1"
},

(note there isn't node-saml because those libraries are still in passport-saml: https://github.com/node-saml/passport-saml/tree/6ba76ba3a015fea96a2dd38f661a6c1f85bc44a1/src ).

passport-saml 4.x i.e. current master which is not yet released has:

"dependencies": {
"@types/passport-strategy": "^0.2.35",
"node-saml": "^4.0.0-beta.2",
"passport-strategy": "^1.0.0"
},


@cjbarth @markstos is concept of transitive dependencies and dependency management somewhat "unknown" in nodejs ecosystem and if so should passport-saml documentation have some "compatibility matrix" at the start of readme?

There are also other projects which mix passport-saml 3.x and node-saml 4.x packages. It starts to look as if people are assuming that they should take latest passport-saml and latest node-saml and expect those to work together. Disclaimer: I do not know whether this issue's root cause is mixture but it is quite obvious that passport-saml 3.2.1 and node-saml 4.x are not designed to work together.

Examples of other projects which mix these packages (links are pinned to current HEADs of master branches of those projects):

FWIW: maintainers of aforementioned projects were "pinged" at node-saml/node-saml#21 issue (which was actually about mixing node-saml/passport-saml and zoellner/node-saml modules) but it seems that they have choosed to continue to use untested combination (by "fixing" problem described at that issue so that now they use passport-saml 3.x and node-saml 4.x).

Unfortunately removing node-saml did not fix the problem, although I did it anyway since it does not make sense to have both on the project.

The problem shows up when I import "passport-saml" into my project to be able to use "Strategy"

import { Strategy } from 'passport-saml'

I also made sure all the dependencies were installed as stated above.
If I update the saml.d.ts file and change the "Element" and "Node" references to "any", everything works, but this isn't a good bandaid because whenever anyone does an "npm i", the problem returns.

This may have been an issue with Typescript and the ts library our app was pointing to. It seems to be working now after updating the ts config to point to es2021