Suggest adding Auth0 as an alternative to Feide OpenIdp identity provider

[law108000]

As I am unable to register as SP on the Feide OpenIdp identity provider by your instructions.

However, I found that Auth0 is allowed to create an application with SAML easily.
It would be better to mention it on the instruction page for new users to experience your library.

No settings are needed to enable SAML.

And all info you need is ready for use.

[srd90]

Random sidenote:
@law108000 In one of the pictures you have/had in your post (at the time when this comment was written) you provided a sample configuration which has two issues:

1. audience is not verified (you are most probably using passport-saml <= 3.x.x which has disabled it by default)
2. you have explicitly disabled NotOnOrAfter validation (by setting acceptedClockSkewMs to negative value) which means that AuthnResponse can be reused (replayed) multiple times (until certificate expires) to login to your application without having to visit IdP.
   • see v3.2.1/README.md#config-parameter-details

Additional links relating to accepted clock skew problem:

• Should perform audience checking. #137 (comment)
• Sample configuration for Shibboleth v3 #520 (comment)
• ADFS SingleLogOut hangs on first application #430 (comment)
• req.user is undefined after passing ADFS #703 (comment)
• Update README to remove an insecure suggestion #704

For anyone reading configuration example from one of the images which is attached to first post at the time of writing this particular comment: do not disable NotOnOrAfter validation by setting accepted clock skew to negative value (i.e. do not copy paste such configuration from anywhere).

[law108000]

Thank you @srd90.
I already updated audience and acceptedClockSkewMs to 5000 instead of -1. It works well.
However, I am using passport-saml@3.2.1 and the audience config is not required by default.

My package.json

Latest configuration

[markstos]

I would welcome a patch to the documentation to suggest Auth0 is an alternative. SAML is already hard enough to work as it is. I'm sure others would welcome a recommendation of an easy-to-use demo.

Or maybe this documentation should be moved to a wiki page where it's easier for people to make edits, as SAML providers will continue to change over time.

[cjbarth]

@markstos I like the idea of a wiki page instead of README in the repo. Do you think we should move what we have to a wiki page and point people there to update it as things evolve with products and the codebase?