Recommended way to log errors thrown by authenticate?

[christian-hawk]

What would be the recommended way to log errors like:

Error: SAML assertion expired: clocks skewed too much

and other errors that may be thrown?

On documentation I only found references to req.flash.

Thanks :)

[cjbarth]

req.flash is designed to show things to the user. If you are talking about logging errors internally, then why can't you catch the ones you want and log those and then redirect the user to an error page?

[markstos]

Log to STDOUT or STDERR.

Manage your app systemd or another supervisor that captures STDOUT and STDERR and sends the logs to a logging service, like rsyslog.

Have your logging service across your redundant production web servers send the logs to a log aggregation service, like AWS CloudWatch Logs or Rapid7 InsightOps. Using your log aggregator, set up alerts to notify you immediately for patterns you care about.

Alternately, if there's a condition that you would always consider an error, sending it directly to a error tracking service like BugSnag. Set up BugSnag->Slack integration to get notified immediately through a chat service.

This is general advice for logging, passport-saml is not exceptional in this regard.

You asked about logging errors, not handling them in general.

passport-saml could improve error handling by throwing a custom error class. Currently passport-saml throws objects from the Error class.

This project could improve the error handling experience, by instead using a project like common-errors which provide special error sub-classes like NotPermittedError:

https://www.npmjs.com/package/common-errors#notpermitted

From there, an Express middleware can catch unhandled errors from these classes and convert them into related user error codes like "403 Forbidden".

https://www.npmjs.com/package/common-errors#errorhandler

passport-saml could further sub-class these common-error classes with error classes like:

• SamlError (generic SAML error)
• SamlAuthenFailed (SAML Authentication Failure)

Then SAML errors could also be translated automatically into HTTP response codes or you could write your own checks against these custom error classes instead of matching error strings with a regex to see if they are SAML errors or not.