I want to to implement SSO using SAML2. But I don't know how to get it work with a distributed system where each instance is running independently on its own server. The environment consists out of three instances:

  • Instance #1: an angular frontend
  • Instance #2: a node.js backend (using express.js + passport)
  • Instance #3: a SAML instance (identity provider)

The question is what would be the best approach if the frontend calls a guarded backend route? Which sequence of actions can be seen as good practice?

At the moment I have this behaviour in my mind:

  1. The frontend sends a request to a guarded backend route
  2. Because the user isn't authenticated, the server initiates a redirect to the SSO-Page provided by the identity provider.
  3. There the credentials are entered
  4. The user gets authenticated by the saml instance and it sends a request back to the server.
  5. Now the user is authenticated, the server sends back the response with the requested resource to the client.

But as long as I think about this sequence I realize this couldn't work. Its because the frontend is its own instance and it is independent from the backend. The redirect to the SSO-Page initiated by passport don't work if you have a separated frontend instance. It works if you call the guarded route directly with the browser, because then you have only two communication partners (service provider & identity provider) instead of three. But this is not the case here.

Thanks and regards


  • What exactly is your question? – mentallurg Dec 11 '20 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.