Greenfields project using Sails.js and NodeBB - Is Passport suitable for providing single-sign on?

Question

I'm an experienced Ruby (Sinatra, Event Machine, Warden, etc) developer and have decided to teach myself Node.js

I've written enough Node now to feel very comfortable with it, and now I'm feeling a bit more ambitious. I would like to wire a simple Sails.js app and a forum built with NodeBB together such that my users can sign into one and be automatically signed in to the other.

I'd like those users to have role-based authentication for access to various parts of the Sails app and also of the forum, so they'd need to share a common RBAC model.

Is Passport suitable for this? And if so, do you have any links to examples?

Answer 1

To persist sessions across requests, Passport relies on Connect, which in turn relies on encrypted cookies containing a connect session id. To use the same sessions across multiple applications, you will need to synchronize your Express / Connect cookie parser and synchronize or share your sessions and user models. You would need to use an external session store (like Redis or Mongo) and probably separate your user database from the individual application databases. Additionally, you would need to copy and paste the cookie parser secret into each application.

It's not really the best approach, though. The maker of Passport also published an open-source OAuth2 Server, which you can use (in combination with Passport's OAuth 2 authentication support) to provide authentication for all the applications you want to tie together. This is a much more robust and scalable solution to your problem, as you won't have to worry about synchronizing secrets and sharing databases. Additionally, it would allow you to write any kind of application you want (not necessarily in node) and still implement shared single sign on.

(If that still sounds like more effort than it's worth, you can always just use an external identity provider. Google-account based OpenID requires no setup, integrates seamlessly with Passport, and lets Google do all the work.)