I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?

Details: I have worked with OAuth2 in the past, but I am not familiar with SAML concepts. With OAuth2, the JavaScript SPA can go directly at the Identity Provider and get a token. I can send this token to my RESTful server. The server only needs to be able to decode the token and verify that it is coming from a trusted provider.

  • Does SAML work in a similar way? Is there a simple reference that shows the workflow?
  • Is there a solution that works with my architecture - JavaScript SPA and Node.js serving a RESTful API?

bumped to the homepage by Community 18 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • Were you able to find a solution for this? – user1984795 Jan 18 '18 at 17:31
  • were you ever able to get this to work? if so can you share your soln? I've asked a similar question here stackoverflow.com/q/53603554/358574 – Tom McDonald Dec 6 '18 at 18:43
  • Nope. The need went away after a while! – Naresh Dec 6 '18 at 22:03

For the record: In a typical SAML WebSSO flow the IDP wants to take control of the browser to establish or resume a session with the browser. So this approach needs to be tested if it is compatible with your IDP(s). There is another, less popular flow called ECP (Enhanced Client or Proxy) that should be more suitable.

See also: https://www.codeproject.com/Articles/1248145/How-to-use-SAML-in-an-Angular-JS-Single-Page-Appli

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.