Single Sign-On with SAML
Stand up a SAML 2.0 Service Provider that accepts SSO logins from an Identity Provider — the protocol still required by most enterprise buyers, implemented with the current node-saml library.
Prerequisites: completed OAuth 2.0 and OpenID Connect, comfort reading XML, a test Identity Provider (a free Okta developer account or a self-hosted test IdP).
Version note: verified against current npm and GitHub documentation as of July 2026. Use @node-saml/passport-saml (the actively maintained fork, currently on major version 5) rather than the original passport-saml package on npm, whose last published release is over three years old and now unmaintained. samlify is a viable alternative that doesn't depend on Passport, worth considering if your app isn't already using Passport for other strategies. Whichever library you choose, verify your Identity Provider's exact metadata format against it before writing config by hand — SAML implementations vary more between vendors than OAuth/OIDC ones do, and mismatched NameID formats or binding types are the most common source of integration failures.
SAML predates OAuth and OIDC by years, and its XML-and-redirect-based design shows it — but it remains the protocol most enterprise Identity Providers (Okta, Azure AD/Entra ID, OneLogin, Ping) speak, and 'do you support SAML SSO' is a real checkbox on enterprise security questionnaires that can gate a sale. This project builds the Service Provider (SP) side: the app that receives an authenticated assertion from a company's Identity Provider (IdP) and logs the user in, without your app ever seeing their actual corporate password.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 7 complete