SAML Authentication Setup

This module handles SAML-based Single Sign-On (SSO) authentication. Here's how to set it up:

1. Certificate Generation Generate your Service Provider (SP) certificate pair:

# Generate private key
openssl genrsa -out ${SAML_SP_CRT}.pem 2048

# Generate public certificate
openssl req -new -x509 -key ${SAML_SP_CRT}.pem -out ${SAML_SP_CRT}.crt -days 36500

2. File Structure Setup Place certificates in your project root:

/xyz
├── ${SAML_SP_CRT}.pem     # Your SP private key
├── ${SAML_SP_CRT}.crt     # Your SP public certificate
└── ${SAML_IDP_CRT}.crt    # Identity Provider's certificate

3. Identity Provider Setup Configure your IdP (e.g., Auth0, Okta) with:

• Your SP's Entity ID (issuer)
• Your SP's public certificate (${SAML_SP_CRT}.crt)
• Your ACS URL (callback URL)

4. Environment Variables Required variables for SAML strategy initialization:

  # Required Core Settings
  SAML_ACS=http://your-domain/saml/acs
  SAML_SSO=https://your-idp/saml/login
  SAML_ENTITY_ID=your-service-identifier

  # Certificate Paths (without file extensions)
  SAML_SP_CRT=sp_certificate
  SAML_IDP_CRT=idp_certificate

  # Additional Settings
  SAML_SLO=https://your-idp/saml/logout
  SAML_SIGNATURE_ALGORITHM=sha256

5. SAML Strategy Initialization The strategy is initialized with these components:

samlStrat = new SAML({
  callbackUrl,     // Where SAML responses are received
  entryPoint,      // IdP's SSO endpoint
  issuer,          // Your SP identifier
  idpCert,         // IdP's certificate for validation
  privateKey,      // Your private key for signing
  publicCert       // Your public cert for IdP
});

6. Security Considerations

• Keep private keys secure
• Use strong signature algorithms
• Configure proper certificate expiry
• Implement proper session management