Configure passport strategy with multiple issuers

[eugeniosegala]

Hello!

I'm would like to integrate node-openid-client with multiple clients as my application will have to initiate different login flows depending on the current domain.

From an architectural point of view, imagine the application running on different domains (my-domain-a.com and my-domain-b.com) pointing to the same pod.

I solved this problem by wrapping passport and the openid-client into an express middleware and I'm calculating which client to use on the fly.

This is just an high level example:

// more code containing issuers and clients.
// ...
app.use((req, res, next) => {
  let client;

  if (req.rawHeaders[1] === "my-domain-a.com") {
    client = clientA;
  }

  if (req.rawHeaders[1] === "my-domain-b.com") {
    client = clientB;
  }

  passport.use(
    "oidc",
    new Strategy({ client }, (tokenSet, userinfo, done) => {
      return done(null, tokenSet);
    }),
  );
  next();
});

it seems that everything works as expected however I'm now sure if this is an anti-pattern within the context of passport or node-openid-client.

I was wondering if anyone had this problem before?

Additionally, I could also deploy two pods with different environment variables but I would like to solve this problem on the application side if possible.

I appreciate that this question is a bit on a blurry line between two packages.

Thanks!

[big-kahuna-burger]

You will eventually have to call passport.authenticate middleware on some endpoint in your app.
Here is a nice description on how to do this with multiple strategies.
Now back to your case, you just need to name them differently and do passport.use twice during app init.

// Create two issuers, two clients, two strategies then:
passport.use('oidc-domain-a', strategyA);
passport.use('oidc-domain-b', strategyB);

Then on some endpoint:

router.post('/login',
   passport.authenticate(['oidc-domain-a', 'oidc-domain-b']),
  (req, res) => {
     // now you have a token which comes from either A or B domain oidc provider
  }

[eugeniosegala]

It worked! Thank you!

The only difference for my use-case is that I need to calculate the strategy on the authenticate function.

if (req.rawHeaders[1] === "localhost:3000") {
    return passport.authenticate("oidc-a", options)(req, res, next);
  }

  if (req.rawHeaders[1] === "localhost:4000") {
    return passport.authenticate("oidc-b", options)(req, res, next);
  }

(or I could just swap the string inside the authenticate).

But the approach worked! 👍