Undefined value returned from authorizationCallback breaking passport

[panva]

Undefined value returned from authorizationCallback breaking passport

[panva]

Of course passing the authenticate call into every single resource middleware chain is going to fail on you - the strategy is for starting and consuming an authorization request and response callback. Nothing more.

Is this how I am supposed to protect an endpoint when using with passport?

Please consult the passport documentation for this.

My read of the code is that because id_token is not set, this method won't ever return a defined value.

if (error) throw;
if (id_token) validate(); // implicit and hybrid response types
if (code) finish validate() from before and then do tokenEndpoint();

I can see that when none of these is present no promise is returned, i will fix that with a rejection that the received data does not seem like an OIDC response or something similar. That ain't going to fix your issue of using passport in an incorrect way.

[morungos]

Aha! So, in order to use with passport, I need to protect the endpoints entirely separately, with something like:

function checkAuthentication (options) {
  return function (req, res, next) {
    if (req.isAuthenticated()) {
      return next()
    }
    res.redirect((options || {}).loginRedirect || '/');
  }
}
router.use(checkAuthentication());

That does seem to move it forward. Passport's documentation isn't exactly wonderful, and without an example that does seem to be a gap here. I'll maybe see if I can work out an example I can make in a PR if you're interested.

[panva]

Any and all improvements, additions, typo fixes and such contributions are indeed very welcome. Happy to hear you're progressing.