如何通过自定义UI登录OneLogin并跳转至预配置应用？passport-saml的SAMLResponse ID重复问题求助

That error typically pops up when the same SAML response is being processed more than once—either due to duplicate requests, cache inconsistencies, or session issues. Let’s walk through the most common fixes and best practices to resolve this, plus address your custom parameter requirement:

1. Rule Out Duplicate Callback Requests #

First, check if your callback endpoint is being hit multiple times for the same authentication attempt:

• Open your browser’s network tab and monitor requests when you click the login button. Look for repeated POST requests to /app/agent-websites/onelogin/callback.
• Ensure your callback route only accepts POST requests (SAML responses are almost always sent via POST). If you have a GET route pointing to the same URL, that could trigger unintended reprocessing.
• Verify that after successful authentication, you’re redirecting to a page that doesn’t re-initiate the login flow (e.g., avoid redirecting back to the login page or callback URL).

2. Fix SAML Response ID Cache Issues #

By default, passport-saml uses an in-memory cache to track processed response IDs (to prevent replay attacks). This works for single-server setups but breaks in clusters, serverless environments, or if your server restarts. Here’s how to fix it:

Use a Shared Cache Provider #

Implement a distributed cache like Redis to share processed IDs across all instances. Add this to your SamlStrategy configuration:

const Redis = require('ioredis');
const redisClient = new Redis();

// Custom cache provider using Redis
const cacheProvider = {
  get: (key, callback) => redisClient.get(key).then(val => callback(null, val)).catch(callback),
  set: (key, value, callback) => redisClient.set(key, value, 'EX', 3600).then(() => callback(null)).catch(callback), // TTL of 1 hour
  remove: (key, callback) => redisClient.del(key).then(() => callback(null)).catch(callback)
};

passport.use(new SamlStrategy(
  {
    callbackUrl: '/app/agent-websites/onelogin/callback',
    entryPoint: entryPointUrl,
    issuer: issuerUrl,
    cert: cert,
    cacheProvider: cacheProvider, // Add this line
    cacheDuration: 3600 // Optional: Control how long IDs are stored (seconds)
  },
  function(profile: any, done: any) {
    console.log(profile);
    return done(null, profile);
  })
);

3. Ensure Proper Session Persistence #

If your user session isn’t being stored correctly, the app might repeatedly trigger authentication attempts. Make sure you’re using a persistent session store instead of the default in-memory one:

const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const redisClient = new Redis();

// Configure express-session with Redis
app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: 'your-secure-session-secret',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true, maxAge: 24 * 60 * 60 * 1000 } // 1 day expiry
}));

app.use(passport.initialize());
app.use(passport.session());

4. Validate OneLogin App Configuration #

Double-check your OneLogin settings to avoid misconfigurations that cause duplicate requests:

• Confirm the callback URL in OneLogin exactly matches your callbackUrl (including HTTP/HTTPS, port, and path).
• Disable any "Force Reauthentication" settings in OneLogin unless explicitly needed—these can trigger repeated SAML requests.

5. Pass Custom Parameters to Your App #

To send custom parameters after authentication, use the SAML RelayState or store parameters in the session:

Option 1: Use RelayState #

Include custom data in the RelayState when initiating the login flow:

app.get('/login', (req, res, next) => {
  // Capture custom params from the request (e.g., query string)
  const customParam = req.query.yourCustomParam;
  // Set RelayState to include your custom data or a return URL
  const relayState = `/your-app-page?customParam=${customParam}`;
  next();
}, passport.authenticate('saml', { relayState }));

Then retrieve it in the callback:

app.post('/app/agent-websites/onelogin/callback', 
  passport.authenticate('saml', { failureRedirect: '/login' }),
  (req, res) => {
    // Redirect to the RelayState URL with custom params
    res.redirect(req.body.RelayState);
  }
);

Option 2: Store in Session #

Save custom parameters to the session before initiating login, then access them in the callback:

app.get('/login', (req, res, next) => {
  req.session.customParams = { foo: 'bar', userId: req.query.userId };
  next();
}, passport.authenticate('saml'));

// In the callback
app.post('/app/agent-websites/onelogin/callback', 
  passport.authenticate('saml', { failureRedirect: '/login' }),
  (req, res) => {
    const customData = req.session.customParams;
    res.redirect(`/your-app-page?foo=${customData.foo}&userId=${customData.userId}`);
  }
);

6. Enable Debug Logging #

For deeper insight into what’s happening, enable passport-saml debug logs:

DEBUG=passport-saml:* node your-app.js

This will log details about response ID checks, cache operations, and authentication flow steps to help you pinpoint the root cause.

内容的提问来源于stack exchange，提问作者NavyCody