Using Passport with SailsJS causing verify function to not fire

[AskYous]

Hello,

I'm building a web application from SailsJS. And on the readme page of this repository, it uses a middleware (here) that is not firing in my code. My code (using SailsJS) is:

routes.js:

// initial login page
'/login': passport.authenticate('saml', {
  'failureRedirect': '/fail',
  'failureFlash': true
}),

// login call pack
'/login/callback': function(req, res){
passport.authenticate('saml', {
          'failureRedirect': '/fail',
          'failureFlash': true
      });
      res.redirect('/success');
},

passport.js:

passport.use(new SamlStrategy(config, findByEmail(profile.email, function(err, user){
     // this function is not getting called at all
     if(err) return done(err);
     else return done(null, user);
})));

http.js (middleware):

'authenticationMiddleWare': function (req, res, next) {
  passport.authenticate('saml', {
    'failureRedirect': '/fail',
    'failureFlash': true
  });
  next();
},
passportInit    : passport.initialize(),
passportSession : passport.session(),

But when the call back occurs from the IDP, the verify function is never called.

[CodeJjang]

+1
How'd you overcome the problem? I'm also facing it right now.
I thought I've done something wrong for hours.

Callback is being called but user & info are undefined, and error is also empty...

I'm thinking of making a small authentication microservice with express only just for that, or switch saml module to something else like https://github.com/auth0/passport-wsfed-saml2 ...

[AskYous]

@CodeJjang the problem was how we're supposed to code middle-ware in Sails. The solution was to write the code like so:

'/callback': [authenticate, function (req, res) {
        if (!req.user) {
            throw Error("User not authenticated.");
        }
        res.redirect("/");
}],

Noticed that the authenticate middle-ware and the /login callback function are in an array now.

[CodeJjang]

I'm having a bit difficulty to understand what you've done...

Here's my code:

In the Auth controller:

// route /auth/adfs-saml, called in order to login
adfsSamlLogin: function(req, res, next) {
    passport.authenticate('saml', { session: false })(req, res, next);
  },
// callback from adfs server, route /auth/adfs-saml/callback
  adfsSamlCallback: function(req, res, next) {
    passport.authenticate('saml', { session: false },
      function(err, user, info) {
        console.log('in callback, err %s, user %s, info %s', JSON.stringify(err), JSON.stringify(user), JSON.stringify(info));
        console.log(req.isAuthenticated());
        res.redirect(sails.config.settings.frontendUrl);
      })(req, res, next);
  },

in http.js I've just put passport.initialize() (I dont need sessions, and I dont know why you put the other function there as well).

This is my passport.js in config:

var fs = require("fs");
var passport = require('passport'),
    SamlStrategy = require('passport-saml').Strategy;

// Use SAML strategy
passport.use(new SamlStrategy({
        entryPoint: myEntryPoint,
        issuer: myIssuer,
        callbackUrl: 'https://localhost:1337' + '/auth/adfs-saml/callback',
        cert: fs.readFileSync('./mycert.crt', 'utf-8'),
        disableRequestedAuthnContext: true,
        identifierFormat: null,
        signatureAlgorithm: 'sha256'
    },
    function(profile, done) {
        console.log('in verifier, profile is:', JSON.stringify(profile));
        done();
    }
));

How should I change my code? I cannot understand what you wrote, I'd appreciate a more precise answer.. and a working piece of code would be appreciated as well :D

[AskYous]

@CodeJjang use arrays. Change your code to this:

  adfsSamlCallback: [ passport.authenticate( ... ), function(req, res, next) {
    ... 
  }],

[CodeJjang]

Ok. Thanks.

It works but the function after the authentication is not called, e.g.:

adfsSamlCallback: [passport.authenticate('saml', { session: false }, function(err, user, info){
    console.log('in callback, err %s, user %s, info %s', JSON.stringify(err), JSON.stringify(user), JSON.stringify(info));
  }),
  function(req, res, next) {
    // THIS IS NOT CALLED
    res.redirect(sails.config.settings.frontendUrl);
  }],

first function called, second isnt.
What am I doing wrong?

[CodeJjang]

Nevermind its ok :) Had cert. problem