@node-saml/passport-saml
Advanced tools
@node-saml/passport-saml is a SAML 2.0 authentication provider for Passport, the popular Node.js authentication middleware. It allows you to integrate SAML-based Single Sign-On (SSO) into your Node.js applications.
SAML Strategy Configuration
This feature allows you to configure the SAML strategy for Passport. You can specify the SAML endpoint, issuer, and certificate, among other settings.
{"const passport = require('passport');":"","const SamlStrategy = require('@node-saml/passport-saml').Strategy;":"","passport.use(new SamlStrategy({":""," path: '/login/callback',":""," entryPoint: 'https://example.com/sso/saml',":""," issuer: 'passport-saml',":""," cert: 'MIIC...AB',":"","}, (profile, done) => {":""," return done(null, profile);":"","}));":""}User Authentication
This feature demonstrates how to handle the SAML callback route. Upon successful authentication, the user is redirected to the home page.
{"app.post('/login/callback',":""," passport.authenticate('saml', { failureRedirect: '/', failureFlash: true }),":""," (req, res) => {":""," res.redirect('/');":""," }":"",");":""}Metadata Generation
This feature allows you to generate and serve the SAML metadata XML, which can be used by the Identity Provider (IdP) to configure the service provider (SP).
{"const samlStrategy = new SamlStrategy({":""," path: '/login/callback',":""," entryPoint: 'https://example.com/sso/saml',":""," issuer: 'passport-saml',":""," cert: 'MIIC...AB',":"","}, (profile, done) => {":""," return done(null, profile);":"","});":"","app.get('/metadata', (req, res) => {":""," res.type('application/xml');":""," res.send(samlStrategy.generateServiceProviderMetadata());":""}passport-saml is another Passport strategy for SAML authentication. It is the original package from which @node-saml/passport-saml was forked. It offers similar functionalities but may not have the latest updates and improvements found in @node-saml/passport-saml.
saml2-js is a general-purpose SAML library for Node.js. It provides low-level SAML protocol handling and can be used to implement SAML SSO in a more customized manner. Unlike @node-saml/passport-saml, it is not specifically designed for Passport integration.
samlify is a comprehensive SAML library for Node.js that supports both SAML Service Provider (SP) and Identity Provider (IdP) roles. It offers more flexibility and features compared to @node-saml/passport-saml but requires more configuration and setup.
This is a SAML 2.0 authentication provider for Passport, the Node.js authentication library.
Passport-SAML has been tested to work with Onelogin, Okta, Shibboleth, SimpleSAMLphp based Identity Providers, and with Active Directory Federation Services.
npm install @node-saml/passport-saml
The examples utilize the Feide OpenIdp identity provider. You need an account there to log in with this. You also need to register your site as a service provider.
Most of the configuration options for the Strategy constructor are passed through to the
underlying node-saml library. For more details on the configuration options and how the underlying
SAML flows work, see the
node-saml documentation
These are the Strategy parameters related directly to passport-saml. For the full list
of parameters, see the node-saml documentation
additionalParams: dictionary of additional query params to add to all requests; if an object
with this key is passed to authenticate, the dictionary of additional query params will be
appended to those present on the returned URL, overriding any specified by initialization options'
additional parameters (additionalParams, additionalAuthorizeParams, and
additionalLogoutParams)passReqToCallback: if truthy, req will be passed as the first argument to the verify callback
(default: false)name: Optionally, provide a custom name. (default: saml). Useful If you want to instantiate
the strategy multiple times with different configurations, allowing users to authenticate against
multiple different SAML targets from the same site. You'll need to use a unique set of URLs for
each target, and use this custom name when calling passport.authenticate() as well.The SAML identity provider will redirect you to the URL provided by the path configuration.
const SamlStrategy = require('@node-saml/passport-saml').Strategy;
[...]
passport.use(
new SamlStrategy(
{
path: "/login/callback",
entryPoint:
"https://openidp.feide.no/simplesaml/saml2/idp/SSOService.php",
issuer: "passport-saml",
cert: "fake cert", // cert must be provided
},
function (profile, done) {
// for signon
findByEmail(profile.email, function (err, user) {
if (err) {
return done(err);
}
return done(null, user);
});
},
function (profile, done) {
// for logout
findByNameID(profile.nameID, function (err, user) {
if (err) {
return done(err);
}
return done(null, user);
});
}
)
);
You can pass a getSamlOptions parameter to MultiSamlStrategy which will be called before the
SAML flows. Passport-SAML will pass in the request object so you can decide which configuration is
appropriate.
const { MultiSamlStrategy } = require('@node-saml/passport-saml');
[...]
passport.use(
new MultiSamlStrategy(
{
passReqToCallback: true, // makes req available in callback
getSamlOptions: function (request, done) {
findProvider(request, function (err, provider) {
if (err) {
return done(err);
}
return done(null, provider.configuration);
});
},
},
function (req, profile, done) {
// for signon
findByEmail(profile.email, function (err, user) {
if (err) {
return done(err);
}
return done(null, user);
});
},
function (req, profile, done) {
// for logout
findByNameID(profile.nameID, function (err, user) {
if (err) {
return done(err);
}
return done(null, user);
});
}
)
);
The options passed when the MultiSamlStrategy is initialized are also passed as default values to
each provider. e.g. If you provide an issuer on MultiSamlStrategy, this will be also a default
value for every provider. You can override these defaults by passing a new value through the
getSamlOptions function.
Using multiple providers supports validateInResponseTo, but all the InResponse values are stored
on the same Cache. This means, if you're using the default InMemoryCache, that all providers have
access to it and a provider might get its response validated against another's request.
Issue Report. To amend this you should
provide a different cache provider per SAML provider, through the getSamlOptions function.
Please note that in the above examples, findProvider(), findByNameId(), and findByEmail() are
examples of functions you need to implement yourself. These are just examples. You can implement
this functionality any way you see fit. Please note that calling getSamlOptions() should result in
done() being called with a proper SAML Configuration (see the TypeScript typings for more
information) and the done() callbacks for the second and third arguments should be called with an
object that represents the user.
You need to provide a route corresponding to the path configuration parameter given to the
strategy:
The authentication callback must be invoked after the body-parser middleware.
const bodyParser = require("body-parser");
app.post(
"/login/callback",
bodyParser.urlencoded({ extended: false }),
passport.authenticate("saml", {
failureRedirect: "/",
failureFlash: true,
}),
function (req, res) {
res.redirect("/");
},
);
Use passport.authenticate(), specifying saml as the strategy:
app.get(
"/login",
passport.authenticate("saml", { failureRedirect: "/", failureFlash: true }),
function (req, res) {
res.redirect("/");
},
);
...or, if you wish to add or override query string parameters:
app.get(
"/login",
passport.authenticate("saml", {
additionalParams: { username: "user@domain.com" },
}),
function (req, res) {
res.redirect("/");
},
);
In addition to passing the additionalParams option to passport.authenticate, you can also pass
samlFallback, either as "login-request" or "logout-request". By default, this is set to
"login-request". However, in the case of the req.query and the req.body not containing a
SAMLRequest or SAMLResponse, this can be used to dictate which request handler is used in cases
where it can not be determined by these standard properties.
For details about this method, please see the
documentation
at node-saml.
The generateServiceProviderMetadata method is also available on the MultiSamlStrategy, but needs
an extra request and a callback argument
(generateServiceProviderMetadata( req, decryptionCert, signingCert, next )), which are passed to
the getSamlOptions to retrieve the correct configuration.
Here is a configuration that has been proven to work with ADFS:
{
entryPoint: 'https://ad.example.net/adfs/ls/',
issuer: 'https://your-app.example.net/login/callback',
callbackUrl: 'https://your-app.example.net/login/callback',
idpCert: 'MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W==',
authnContext: ['http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows'],
identifierFormat: null
}
Please note that ADFS needs to have a trust established to your service in order for this to work.
For more detailed instructions, see ADFS documentation.
Passport-SAML has built in support for SLO from Node-SAML.
Note: Fully functional IdP initiated SLO support is not provided out of the box. You have to inspect your use cases / implementation / deployment scenarios (location of IdP in respect to SP) and consider things / cases listed e.g. at issue(s) #221 and #419. This library provides you a mechanism to veto "Success" result but it does not provide hooks/interfaces to implement support for IdP initiated SLO which would work under all circumstances. You have to do it yourself.
See Releases to find the changes that go into each release. Additionally, see the CHANGELOG.
Gerard Braad has provided an example app at https://github.com/gbraad/passport-saml-example/
We only support Long-Term Support versions of Node.
We specifically limit our support to LTS versions of Node, not because this package won't work on other versions, but because we have a limited amount of time, and supporting LTS offers the greatest return on that investment.
It's possible this package will work correctly on newer versions of Node. It may even be possible to use this package on older versions of Node, though that's more unlikely as we'll make every effort to take advantage of features available in the oldest LTS version we support.
As each Node LTS version reaches its end-of-life we will remove that version from the node
engines property of our package's package.json file. Removing a Node version is considered a
breaking change and will entail the publishing of a new major version of this package. We will not
accept any requests to support an end-of-life version of Node. Any merge requests or issues
supporting an end-of-life version of Node will be closed.
We will accept code that allows this package to run on newer, non-LTS, versions of Node.
The project was started by @bergie in 2012 based on Michael Bosworth's express-saml library. From 2014 - 2016, @ploer served as primary maintainer. @markstos served the primary maintainer from 2017 till 2020 when he created the node-saml organization. With a goal to create a team of maintainers, invitations were sent to major contributors and fork authors to work together to maintain all the improvements in one place.
Since 2020, @cjbath emerged as the primary maintainer, with major contributions from @gugu and
@zoellner. Major updates from the team included rewriting the project in TypeScript and splitting
off a node-saml module which can be used without Passport. Almost 100 other developers have
contributed improvements to the project.
The project continues to be maintained by volunteers. Contributions small and large are welcome.
“OASIS”, “SAML”, and “Security Assertion Markup Language” are trademarks of OASIS, the open standards consortium where the SAML specification is owned and developed. SAML is a copyrighted © work of OASIS Open. All rights reserved.
5.0.0 (2024-03-27)
node-saml documentation #886passport-saml #862FAQs
SAML 2.0 authentication strategy for Passport
The npm package @node-saml/passport-saml receives a total of 159,827 weekly downloads. As such, @node-saml/passport-saml popularity was classified as popular.
We found that @node-saml/passport-saml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
TypeScript is porting its compiler to Go, delivering 10x faster builds, lower memory usage, and improved editor performance for a smoother developer experience.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.