title: passport-saml strategy implementaion in nodejs
body: <p>I am using <code>passport-saml</code> for authentication. For this I have installed </p>
  
  <pre><code>npm install passport passport-saml --save
  </code></pre>
  
  <p>And I have created my IDP using this blog <a href="https://auth0.com/blog/how-saml-authentication-works/" rel="noreferrer">Auth0</a>.</p>
  
  <p>Initialized passport and defined saml strategy</p>
  
  <pre><code>app.use(passport.initialize());
  
  passport.use(new passportSaml.Strategy(
          {
              path: "/login/callback",
              entryPoint: "https://qpp1.auth0.com/samlp/bZVOM5KQmhyir5xEYhLHGRAQglks2AIp",
              issuer: "passport-saml",
              // Identity Provider's public key
              cert: fs.readFileSync("./src/cert/idp_cert.pem", "utf8"),
          },
          (profile, done) =&gt; {
              console.log("Profile : ",profile);
              let user = new Profile({ id: profile["nameID"], userName: profile["http://schemas.auth0.com/nickname"] });
              return done(null, user);
          }
      ));
  </code></pre>
  
  <p>And here are the routes</p>
  
  <pre><code>app.get("/login",
      passport.authenticate("saml", (err, profile) =&gt; {
          // control will not come here ????   
          console.log("Profile : ", profile);
      })
  );
  app.post("/login/callback",
           (req, res, next) =&gt; {
              passport.authenticate("saml", { session: false }, (err, user) =&gt; {
                  req.user = user;
                  next();
              })(req, res, next);
           },
           RouteHandler.sendResponse
  );
  </code></pre>
  
  <p>Now this is working fine but I have some questions</p>
  
  <p>1) What does <code>issuer</code> mean in saml strategy</p>
  
  <p>2) Why I need to use <code>passport.authenticate</code> in two URL mappings. I don't understand why it is required in <code>/login/callback</code> request. And even control will not come to <code>/login</code> request's function that I have passed in <code>passport.authenticate</code> method? </p>
  
  <p>What is the logic behind this? Is this useful in any scenario?</p>