passport-ssqsignon

SSQ signon authentication strategy for Passport.

This module lets you authenticate HTTP requests using the SSQ signon online authorization server access tokens in your Node.js applications. Access tokens are typically used to protect API endpoints, and are often issued using OAuth 2.0.

By plugging into Passport, SSQ singon authentication support can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

This module is a fork of the Passport HTTP Bearer strategy by Jared Hanson

Install

$ npm install passport-ssqsingon

Usage

Configure Strategy

The SSQ signon authentication strategy authenticates users using an access token generated by the token endpoint of your SSQ signon module. Once authenticated, the user id and scope contained within the token are stored in the req.user property. The strategy requires your module's module name. An optional scopePresenter function can also be passed, which transforms the raw scope string into whatever you like (i.e. a permission helper of some sort).

passport.use(new SSQsignonStrategy('my-ssqsignon-module-name',
    function scopeAsObject(scopeStr) {
        return scopeStr.split(' ').reduce(function(result, s) { result[s] = true; return result; }, {});
    }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'ssqsignon' strategy, to authenticate requests. Requests containing bearer tokens do not require session support, so the session option can be set to false.

For example, as route middleware in an Express application:

app.get('/me', 
  passport.authenticate('ssqsignon', { session: false }),
  function(req, res) {
    res.json(req.user);
  });

Issuing Tokens

For details on how to issue access tokens with the SSQ signon token endpoint please visit ssqsignon.com

How it works

The strategy dispatches the received token as an HTTPS request to the token validation endpoint of your SSQ signon module. If the request is successful, the resulting JSON is parsed, and the user id and scope extracted into the req.user property. If the request fails, the strategy signals that authentication has failed.