Cannot use dynamic values for entryPoint and cert about passport-saml

[benheymink]

Late to the party, but take a look at passports: https://www.npmjs.org/package/passports

[ploer]

So, the issue is that you have many users with many different identity providers, some of which are different accounts at onelogin, and you need to be able to dispatch to the appropriate identity provider based on some property of the user?

passport-saml is oriented around providing a strategy to authenticate users against one identity provider. If you have multiple identity providers I think you want multiple instances of the passport-saml strategy, and then maybe a middleware wrapper around your passport.authenticate call that dispatches to the appropriate strategy based on your application logic.

[apriendeau]

So we are only looking to support onelogin but since they generate a random url, like https://app.onelogin.com/trust/saml2/http-post/sso/{{random_id_generated}}; How do you add that without it being dynamic? So if I have two different companies that are using onelogin. If I can add it to .authenticate(), how would you use suggest that we go about that?

[ploer]

Well, I'm not sure I'd call it random, it's just that each company using onelogin as an identity provider has a different id, right? So as part of each company that wants to set up onelogin as their identity provider for you, they need to give you that entrypoint. It may be all at onelogin but it is still multiple identity providers.

So one way I can think of to handle this (not sure if its the best way or not), would be to register multiple strategies for each comany, i.e. passport.use('saml-foo-company', samlStrategy1); passport.use('saml-bar-company', samlStrategy2);, and then instead of putting passport.authenticate in the middleware chain for your route, something like:

function authenticateWithAppropriateIdentityProvider(res, req, next) {
   if (userIsWithFooCompany)
    passport.authenticate('saml-foo-company')
  else if (userIsWithBarCompany)
    passport.authenticate('saml-bar'company')
  ...
}

[ploer]

Nice, that looks like just the thing.

[apriendeau]

perfect. Thank you.