[ENHANCE] support passive option to getAuthorizeUrlAsync and getAuthorizeFormAsync

[tjenkinson]

Is your feature request related to a problem? Please describe.
Would be great to support passive option to getAuthorizeUrlAsync and getAuthorizeFormAsync, which would override the passive option provided to the constructor.

This means we could use a single SAML instance to handle both passive and not passive requests.

Describe the solution you'd like
If passive is provided in the options to either of the functions above it would take precedence over the one provided in the constructor.

Describe alternatives you've considered
We could work around this by creating multiple SAML instances, or by always creating it on the fly, but I think it would be nicer if we didn't have to do that.

Happy to prepare a PR.

[cjbarth]

What is the use-case for this?

[tjenkinson]

Hey @cjbarth we have 2 endpoints on our server, one that does not use passive and one that does, and it would be great if we can handle this with a single instance of SAML

[cjbarth]

Why do you maintain two load-balanced endpoints with different configurations? That seems like a disaster just waiting to happen? If you actively select between the two different endpoints, then it seems like you should be using the multi-SAML setup.

[tjenkinson]

We have 2 api endpoints, where one is used to login the user and redirect back if the user is signed in. The other endpoint is used as a way to determine if a user is logged in or not, where we don't want the user to be shown the sign in screen

It's the same saml endpoint. The only thing we change is the passive flag

[cjbarth]

So, if you have two API endpoints, that do two different things, then you need two different configurations. You, in fact, have two SAML endpoints, perhaps with the same backing credential store, but that is immaterial for this discussion. Since you you already have logic in your code to pick the correct endpoint, you can, and should, extend that code to also pick the correct SAML provider instance.

You could probably make things easier on yourself and have one SAML config JSON that you modify a property on before using to init the second of your multi-SAML config in passport-saml.