# sso-oidc

> Utility to instrument Single Sign-on (SSO) for Node.js and Express

Latest version **0.1.0** (published 2020-02-04) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install sso-oidc
pnpm add sso-oidc
yarn add sso-oidc
bun add sso-oidc
```

## Health

**Score 35/100 (D)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 0.1.0 |
| Published | 2020-02-04 |
| First published | 2020-02-04 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=10 |
| Dependencies | 1 |
| Unpacked size | 24.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 8 |
| Author | Eric Liu |
| Maintainers | metonym |
| Keywords | single sign-on, sso, openid connect, oidc, spa |

## Links

- npm: https://www.npmjs.com/package/sso-oidc
- Repository: https://github.com/ibm/sso-oidc
- Issues: https://github.com/ibm/sso-oidc/issues
- npm.io page: https://npm.io/package/sso-oidc

## Dependencies (1)

- [node-fetch](https://npm.io/package/node-fetch.md) ^2.6.0

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 0.1.0 (latest) — 2020-02-04

## README

# sso-oidc

> Utility to instrument Single Sign-on (SSO) for Node.js and Express.

This project illustrates the basic client/server login flow for Single Page Applications (SPA) using Single Sign-in (SSO) with OpenID Connect (oidc).

The `sso-oidc` module is intended to be used with [Express.js](https://github.com/expressjs/express) with [cookie-session](https://github.com/expressjs/cookie-session) and [body-parser](https://github.com/expressjs/body-parser) middleware. The client implementation is framework agnostic.

## Getting started

### Server-side

```bash
yarn add sso-oidc body-parser cookie-session
```

It is recommended to read environment secrets using [dotenv](https://github.com/motdotla/dotenv) or a similar module.

```bash
yarn add dotenv
```

```js
// server.js
import { json } from 'body-parser';
import session from 'cookie-session';
import express from 'express';
import Strategy from 'sso-oidc';

const app = express()
  .use(json())
  .use(
    session({
      maxAge: 1 * 60 * 1000, // 60 seconds
      name: 'sso-oidc',
      secret: '<SESSION_SECRET>'
    })
  );

const sso = new Strategy({
  redirectUri: '',
  redirectUriLocal: '',
  clientId: '',
  clientSecret: '',
  issuerId: '',
  tokenUrl: '',
  authUrl: '',
  introspectUrl: ''
});

// Returns the silent authorization url.
app.get('/authUrl', sso.getSilentAuthUrl);

// Checks if the current session is valid.
app.get('/check', sso.check);

// Authenticates user using the temporary code returned from silent authorization.
app.post('/callback', sso.token, sso.introspect, (req, res) => {
  res.send({ user_idd: req.session.user_id });
});

// Uses a wildcard to authenticate POST requests for a common, protected route.
app.post('/api/*', sso.protect);

// Resets `access_token`, `user_id` but persists session.
app.post('/api/logout', sso.destroy, ({}, res) => res.send({ success: true }));
```

### Client-side

Refer to the [`create-react-app` example](examples/create-react-app) for a basic client login flow using React hooks.

## License

[Apache 2.0](LICENSE)

---
_Source: https://npm.io/package/sso-oidc · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._