passport-saml | SAML 2.0 authentication with Passport | Authentication library

I am building an API endpoint with Express, NodeJS, PassportJS, and TypeScript. I want to allow two types of authentication for this endpoint. SAML (for humans) and token for automation. For human authentication, I'm using the passport-saml strategy. For token auth I'm using passport-http basic authentication. So far my code looks like:

I am trying to configure passport-saml node.js, but I do not know how to read the idp metadata.

this is my passport.js file:

when I created passport-saml strategy, during login, there is a profile object pass to the middleware function, with nameID info there. I need that info to call logout later on.

As per the passportjs documentation, the verifier function is supposed to be called. But I am not seeing this call back.

I am testing this with okta. In okta the app is configured to send the saml response to /fromokta The okta is redirecting to /fromokta What am I missing?

We have a SaaS product on the firebase platform, one of our customer asked us to provide a SSO experience to their users. They have an old ADFS as an IdP.

I though first to use Passport-Saml but then noticed that firebase auth could use Google Cloud Identity Platform for custom SAML IdP.

It worked pretty well and we got a user logged in first try. However, the user created in firebase is pretty empty.

Here is the user from the auth creation hook:

I have a React app.

I also have an Express server, that using passport-saml I can authenticate against the company's PingID SSO IdP.

I would like to get the React app, to somehow call the Express app, to authenticate.

The Express Server and the React app are running on the same host.

Here's what I have:

I'm running expressJS in one of the containers I'm trying to run in docker-compose; When I keep pressing CMD+R to refresh the landing page (Probably 3~4 seconds), it says "Error: socket hang up" and broken. Here is the error

I'm looking for a way to programatically log in a fake user for development purposes. The end goal is that I open the app for demo/development purposes and there's a fake user forcibly logged in(this is turned off in production)

Currently, I have 3 sets of middleware running:

1. express-session - Sets up the session and session storage provider
2. Some custom middleware I wrote that just appends my dev user to req.session.user
3. passport-saml middleware that checks to see if a user is authenticated, and kicks them over to the SSO provider if not.

Right now, I can add some more middleware between 1 and 3 and see that my fake user is persisting in the session(at least for the duration of the request, anyway). However, clearly I'm not doing something that the passport-saml middleware is expecting to see because regardless of what I set in the session it always thinks I'm unauthenticated and redirects me to the SSO provider.

The first layer of middleware(express-session) looks like this: