Node.js SAML 2.0 library for Single Sign-On, written in TypeScript under the MIT licence, for developers adding SAML SSO to Node.js applications as either a Service Provider or an Identity Provider.

What it is

samlify is a highly configurable Node.js library that implements SAML 2.0 for Single Sign-On. It is written in TypeScript, published to npm as samlify, and developed by Tony Ngan since 2016 under the MIT licence. The library lives in the Node.js and JavaScript ecosystem and is consumed through require('samlify') or an ES module import, placing it directly inside ordinary Node.js application code rather than in a separate identity gateway or reverse proxy.

The concrete problem it solves is SAML interoperability inside a Node.js service. Rather than hand-building XML assertions, signatures, and protocol bindings, or standing up an external identity broker, an application calls the library to construct and parse SAML requests and responses. The topic list makes the intended role explicit: service-provider and identity-provider, plus idp, sso, and slo, meaning the library covers both sides of the exchange as well as single logout. It coexists with hosted identity providers such as Okta, Auth0, and OneLogin, which appear as topics because they are the systems a samlify-backed Service Provider typically federates against. The specific thing it replaces is a hand-rolled or externally hosted SAML integration layer in a Node.js stack, including Express.js applications, which the expressjs topic also names.

Key capabilities

• Implements SAML 2.0 Single Sign-On, with Identity Provider and Service Provider roles, plus Single Logout (slo).
• Supports multiple schema validators, selected up front through samlify.setSchemaValidator(validator), which the README states must be called to avoid errors.
• Ships with official validator modules, including @authenio/samlify-xsd-schema-validator, @authenio/samlify-validate-with-xmllint, and @authenio/samlify-node-xmllint.
• Allows a custom schema validator to be supplied as an object exposing a validate function that returns a promise.
• Permits suppressing schema validation entirely by returning a resolved promise such as Promise.resolve('skipped'), which the README explicitly ties to accepting malicious responses at the implementer's own risk.
• Is written in TypeScript and supports Yarn as the package manager for development.
• Provides a samlify-starter example repository for getting up and running.

Who uses it and how

• Node.js and Express.js applications that need to act as a SAML Service Provider against a corporate or hosted Identity Provider.
• Teams federating with Okta, Auth0, or OneLogin, all of which appear in the project's topic list as integration targets.
• Applications that require Single Logout in addition to login, since slo is a named topic.
• Projects that need to serve the Identity Provider side of a SAML exchange, given the idp and identity-provider topics.
• Developers who need a non-default validation path, either a custom validator or a deliberate skip, for responses that the bundled validators cannot handle.

Getting started

Install from npm as samlify, then call samlify.setSchemaValidator(validator) with one of the provided validator modules before using the library, as the README requires. Full documentation is at https://samlify.js.org, and samlify-starter on GitHub is the recommended example for getting up and running. On Windows, windows-build-tools must be installed globally first if the libxml validator is used.

How it compares

No list of paid products that this project replaces is provided in the facts. Among tools named in the facts, it sits alongside hosted identity providers such as Okta, Auth0, and OneLogin as the Node.js-side counterpart that talks to them, rather than as a competitor to them. It is also distinct from the validator packages it depends on, since those only check schema and do not implement the SAML exchange.

When to use it — and when not to

A self-hoster must operate the library inside a Node.js application and must select and wire a schema validator, and on Windows must install windows-build-tools globally when using the libxml validator. Skipping validation is supported but carries a documented risk of accepting malicious responses, so it is not appropriate where response integrity is a requirement. Weaknesses are visible in the facts: the README excerpt is sparse, with setup detail largely deferred to the external documentation site, and the repository carries 53 open issues.

import * as samlify from 'samlify';
import * as validator from '@authenio/samlify-xsd-schema-validator';
// import * as validator from '@authenio/samlify-validate-with-xmllint';
// import * as validator from '@authenio/samlify-node-xmllint';

samlify.setSchemaValidator(validator);

samlify.setSchemaValidator({
  validate: (response: string) => {
    /* implment your own or always returns a resolved promise to skip */
    return Promise.resolve('skipped');
  }
});

yarn global add windows-build-tools

yarn global add typescript
yarn

const saml = require('samlify');