express-okta-saml
express-okta-saml is node.js library which creates routes for okta-saml authentication. It is very minimal and clean, using passport-saml and passport libraries to handle the process, gives you all access to passport-saml and passport configs/options.
Why another one?
There is a few other, not maintained libraries that provides middleware for OKTA authentication but all of them introduces configuration abstraction without leaving a way to pass configs/options directly for passport and passport-saml libraries. I simply needed full flexibility of passport-saml and passport-saml to be accessible .
How to use it?
Simple app setup example
const http = ;const session = ;const oktaAuth = ;const expressOktaSaml = ; const hour = 3600000;const app = ;app;app; app; // important to have bodyParser as OKTA will make POST redirect with body dataapp;app; const expressOktaSamlConfig = ; // check bellow for config exmaple and tipsconst okta = ; // setups okta routes + passportapp; // from here all following requests will be checked for authapp; // this will be not reachable if user is not logged in via OKTA const server = http;server;
oktaConfig.js example
const fs = ;const path = ; const cert = fs; moduleexports = SAML: passportOptions: // check full list of available options - https://github.com/bergie/passport-saml cert issuer: 'http://www.okta.com/id-from-okta-saml-setup' // your okta issuer url (provided by okta duerning SAML setup) entryPoint: 'https://...../sso/saml' // entryPoint url (provided by okta duerning SAML setup) callbackUrl: 'http://localhost:3000/login' // your callback url propertiesToExtract: 'Email' 'FirstName' 'LastName' // these properties will be saved on user session by passport access it by req.user passport: options: //options to be passed to passport.authenticate(). check full list of available options - https://github.com/jaredhanson/passport/blob/master/lib/middleware/authenticate.js successRedirect: '/' failureRedirect: '/login' failureFlash: true appRoutes: // express-okta-saml will create GET/POST routes on these endpoints to handle auth proccess loginPath: '/login' // make sure this is same as path on SAML.passportOptions.callbackUrl and passport.options.failureRedirect logoutPath: '/logout' accessDeniedPath: '/access-denied'
Tips on OKTA
SAML.passportOptions.callbackUrl
OKTA after successful auth will redirect user to this url. It is important that callbackUrl is whitelisted in OKTA SAML setup. If passed callbackUrl URL is not whitelisted, OKTA will ignore it and redirect to the whitelisted one. Check image to see how to whitelist multiple domains/urls for okta auth.
privateCert instead of cert
You can pass private certificate to passport-saml.
Remove SAML.passportOptions.cert
and add SAML.passportOptions.privateCert
.