haf-tech / nodejs-sso

Showcase: Nodejs and SSO with IBM App Id

Showcase: Node.js and SSO with OpenID / IBM App Id

Table of Contents

• Overview
• Configure IBM App Id
• Test
• Misc
• References
• License

Overview

This show case covers the OpenID integration in Node.js application using IBM App Id as facade for multiple OpenID/OAuth/Identity providers.

The main steps and examples are re-used from the IBM App ID SDK for Node.js: https://github.com/ibm-cloud-security/appid-serversdk-nodejs

Configure IBM App Id

Create service

• Register for IBM Cloud (for free)

• Create a new Service IBM App Id

Configure App Id

• Select the created IBM App Id Service

  • Configure Identity Provider (here using SAML)

    • Select Manage Authentication > Identity Providers

    • Select SAML 2.0 Federation

    • Download the metadata file

    • Upload this into your Identity Provider System and retrieve information Entity ID, Sign in URL and Primary certificate

  • Create Service credentials for your app

    • Select Service credentials

    • Click New credential and enter name and role

    • Use the following fields to use IBM App Id: clientId, tenantId, oauthServerUrl and secret

  • Register the redirect urls

  • Select IBM App Id Service

  • Select Manage Authentication

  • Select the 2nd tab Authentication Settings

  • Add the web redirect URL. In general this is the callback URL which will used in the redirect_uri GET parameter

Test

For testing the application locally

• export the App ID parameters as environment variables and

• add the redirect URL http://127.0.0.1:5000/ibm/appid/callback in IBM App Id

$ cat run.sh
#!/bin/sh

export OAUTH_URL="https://...."
export CLIENT_SECRET="NW....."
export CLIENT_ID="12312322-aaaa-bbbb-cccc-acavavav"
export TENANT_ID="12312324-dddd-eeee-ffff-23123ace222"
export REDIRECT_URL="http://127.0.0.1:5000"

npm start

$ ./run.sh

> [email protected] start ../nodejs-sso
> node index.js

[2020-07-04T15:37:34.965] [INFO] appid-sdk - Initialized
[2020-07-04T15:37:35.226] [INFO] appid-WebAppStrategy-config - clientId 12312322-aaaa-bbbb-cccc-acavavav
[2020-07-04T15:37:35.227] [INFO] appid-WebAppStrategy-config - tenantId 12312324-dddd-eeee-ffff-23123ace222
[2020-07-04T15:37:35.227] [INFO] appid-WebAppStrategy-config - secret [CANNOT LOG SECRET]
[2020-07-04T15:37:35.227] [INFO] appid-WebAppStrategy-config - oauthServerUrl https://....
[2020-07-04T15:37:35.227] [INFO] appid-WebAppStrategy-config - redirectUri http://127.0.0.1:5000/ibm/appid/callback
Node app is running at localhost:5000
[2020-07-04T15:39:54.372] [INFO] appid-public-key-util - Public keys updated
[2020-07-04T15:39:54.379] [INFO] appid-token-util - token ver: 4
[2020-07-04T15:39:54.379] [INFO] appid-token-util - token version is valid
[2020-07-04T15:39:54.379] [INFO] appid-token-util - token aud: 12312322-aaaa-bbbb-cccc-acavavav
[2020-07-04T15:39:54.603] [INFO] appid-token-util - token iss: https://...
[2020-07-04T15:39:54.603] [INFO] appid-token-util - token ver: 4
[2020-07-04T15:39:54.603] [INFO] appid-token-util - token version is valid
[2020-07-04T15:39:54.603] [INFO] appid-token-util - token aud: 12312322-aaaa-bbbb-cccc-acavavav
[2020-07-04T15:39:54.603] [INFO] appid-token-util - token iss: https://....

user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:77.0) Gecko/20100101 Firefox/77.0

Test the application

• Main page, unrestricted http://127.0.0.1:5000/

• Page displays auth profile details http://127.0.0.1:5000/webpage.html

• Login URL http://127.0.0.1:5000/ibm/appid/login

• Logout URL http://127.0.0.1:5000/ibm/appid/logout

• Accessing a remote secured backend http://127.0.0.1:5000/secure/backend

Misc

• Published as article: https://my.center-of.info/2020/07/08/showcase-node-js-and-app-id/

References

• IBM Cloud Docu - IBM App Id: https://cloud.ibm.com/docs/appid?topic=appid-getting-started

• IBM Cloud Docu - App Id + Node.js: https://cloud.ibm.com/docs/appid?topic=appid-web-node

• IBM App Id SDK Node.js: https://github.com/ibm-cloud-security/appid-serversdk-nodejs

License

This article is licensed under the Apache License, Version 2. Separate third-party code objects invoked within this code pattern are licensed by their respective providers pursuant to their own separate licenses. Contributions are subject to the Developer Certificate of Origin, Version 1.1 and the Apache License, Version 2.

See also Apache License FAQ .