       saml_response = null
       decrypted_assertion = null
 
-      user = {}
+      response = {}
 
       async.waterfall [
         (cb_wf) ->

# appear to be valid.
parse_response_header = (dom) ->
  response = dom.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:protocol', 'Response')
  throw new Error("Expected 1 Response; found #{response.length}") unless response.length is 1

  response_header = {}

    .object()
    .value()

parse_authn_response = (saml_response, sp_private_key, idp_certificate, cb) ->
  user = {}
  decrypted_assertion = null

  async.waterfall [
    (cb_wf) ->
      decrypt_assertion saml_response, sp_private_key, cb_wf
    (result, cb_wf) ->
      decrypted_assertion = (new xmldom.DOMParser()).parseFromString(result)
      check_saml_signature result, idp_certificate, cb_wf
    (cb_wf) -> async.lift(get_name_id) decrypted_assertion, cb_wf
    (name_id, cb_wf) ->
      user.name_id = name_id
      async.lift(get_session_index) decrypted_assertion, cb_wf
    (session_index, cb_wf) ->
      user.session_index = session_index
      async.lift(parse_assertion_attributes) decrypted_assertion, cb_wf
    (assertion_attributes, cb_wf) ->
      user = _.extend user, pretty_assertion_attributes(assertion_attributes)
      user = _.extend user, attributes: assertion_attributes
      cb_wf null, { user }
  ], cb

module.exports.ServiceProvider =
  class ServiceProvider
    constructor: (@issuer, @private_key, @certificate) ->
