# express-okta-saml > Okta Authentication via SAML for ExpressJS (NodeJS) Latest version **1.0.6** (published 2018-04-17) · MIT license · 0 weekly downloads ## Install ```sh npm install express-okta-saml pnpm add express-okta-saml yarn add express-okta-saml bun add express-okta-saml ``` ## Health **Score 15/100 (F)** — status: abandoned. Positive: no vulnerabilities. Warnings: low downloads; no types; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 1.0.6 | | Published | 2018-04-17 | | First published | 2018-03-01 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | none | | Module format | CommonJS | | Dependencies | 3 | | Unpacked size | 7.9 KB | | Known vulnerabilities | 0 (+4 in 2 direct dependencies) | | Install scripts | no | | Author | Tomas Didvalis | | Maintainers | tomdid | | Keywords | okta, passport, saml | ## Links - npm: https://www.npmjs.com/package/express-okta-saml - Repository: https://github.com/tomdid/express-okta-saml - Homepage: https://github.com/tomdid/express-okta-saml#readme - Issues: https://github.com/tomdid/express-okta-saml/issues - npm.io page: https://npm.io/package/express-okta-saml ## Dependencies (3) - [debug](https://npm.io/package/debug.md) ^3.1.0 - [passport](https://npm.io/package/passport.md) 0.4.0 - [passport-saml](https://npm.io/package/passport-saml.md) 0.33.0 ## Alternatives - [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads - [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads - [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads - [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads - [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads ## Recent versions - 1.0.6 (latest) — 2018-04-17 - 1.0.5 — 2018-04-17 - 1.0.3 — 2018-03-01 - 1.0.2 — 2018-03-01 - 1.0.1 — 2018-03-01 ## README # express-okta-saml express-okta-saml is node.js library which creates routes for okta-saml authentication. It is very minimal and clean, using passport-saml and passport libraries to handle the process, gives you all access to passport-saml and passport configs/options. ## Why another one? There is a few other, not maintained libraries that provides middleware for OKTA authentication but all of them introduces configuration abstraction without leaving a way to pass configs/options directly for passport and passport-saml libraries. I simply needed full flexibility of passport-saml and passport-saml to be accessible . ## How to use it? ### Simple app setup example ```javascript const http = require('http'); const session = require('express-session'); const oktaAuth = require('okta-auth'); const expressOktaSaml = require('express-okta-saml'); const hour = 3600000; const app = express(); app.use(cookieParser()); app.use(session({ secret: 'my-secret', cookie: { maxAge: hour * 24 }, resave: true, saveUninitialized: true, name: 'my-app', })); app.use(bodyParser.json()); // important to have bodyParser as OKTA will make POST redirect with body data app.use(bodyParser.urlencoded({ extended: false })); app.get('/ping', (req, res) => { // unprotected healthcheck res.statusCode = 200; res.send('pong'); }); const expressOktaSamlConfig = require('./oktaConfig.js'); // check bellow for config exmaple and tips const okta = expressOktaSaml(app, expressOktaSamlConfig); // setups okta routes + passport app.use('/', okta.secured); // from here all following requests will be checked for auth app.get('/test', () => { res.send(''); }); // this will be not reachable if user is not logged in via OKTA const server = http.createServer(app); server.listen(3000, (err) => { if (err) { console.log('Failed to start server'); console.log(err); } console.log(`Server has started on port: ${server.address().port}`); }); ``` ### oktaConfig.js example ```javascript const fs = require('fs'); const path = require('path'); const cert = fs.readFileSync(path.join(__dirname, 'okta.pem'), 'utf8'); module.exports = { SAML: { passportOptions: { // check full list of available options - https://github.com/bergie/passport-saml cert, issuer: 'http://www.okta.com/id-from-okta-saml-setup', // your okta issuer url (provided by okta duerning SAML setup) entryPoint: 'https://...../sso/saml', // entryPoint url (provided by okta duerning SAML setup) callbackUrl: 'http://localhost:3000/login', // your callback url }, propertiesToExtract: ['Email', 'FirstName', 'LastName'], // these properties will be saved on user session by passport access it by req.user }, passport: { options: { //options to be passed to passport.authenticate(). check full list of available options - https://github.com/jaredhanson/passport/blob/master/lib/middleware/authenticate.js successRedirect: '/', failureRedirect: '/login', failureFlash: true, }, }, appRoutes: { // express-okta-saml will create GET/POST routes on these endpoints to handle auth proccess loginPath: '/login', // make sure this is same as path on SAML.passportOptions.callbackUrl and passport.options.failureRedirect logoutPath: '/logout', accessDeniedPath: '/access-denied', }, } ``` ## Tips on OKTA #### SAML.passportOptions.callbackUrl OKTA after successful auth will redirect user to this url. It is important that callbackUrl is whitelisted in OKTA SAML setup. If passed callbackUrl URL is not whitelisted, OKTA will ignore it and redirect to the whitelisted one. Check image to see how to whitelist multiple domains/urls for okta auth. okta-saml-integration-example #### privateCert instead of cert You can pass private certificate to passport-saml. Remove `SAML.passportOptions.cert` and add `SAML.passportOptions.privateCert`. ## Credits [Originally Inspired by wojtekk/okta-auth](https://github.com/wojtekk/okta-auth) --- _Source: https://npm.io/package/express-okta-saml · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._