Express

IDRA_ISSUER=https://<your-org>.idra.team/api/auth
IDRA_CLIENT_ID=<Client ID>
IDRA_CLIENT_SECRET=<client secret>
APP_URL=http://localhost:3000
SESSION_SECRET=<output of: openssl rand -hex 32>

mkdir idra-express && cd idra-express
npm init -y && npm pkg set type=module
npm install express express-session openid-client

import express from 'express';
import session from 'express-session';
import * as oidc from 'openid-client';

const { IDRA_ISSUER, IDRA_CLIENT_ID, IDRA_CLIENT_SECRET, APP_URL, SESSION_SECRET } = process.env;
const issuer = new URL(IDRA_ISSUER);
const redirectUri = `${APP_URL}/callback`;

// Discovery reads the endpoints. With a secret: client_secret_basic. Without one: a public client.
const config = await oidc.discovery(
  issuer,
  IDRA_CLIENT_ID,
  undefined,
  IDRA_CLIENT_SECRET ? oidc.ClientSecretBasic(IDRA_CLIENT_SECRET) : oidc.None(),
  // Only for an IdRa you run locally on http. Never needed for an https issuer.
  issuer.protocol === 'http:' ? { execute: [oidc.allowInsecureRequests] } : undefined,
);

const app = express();
app.set('trust proxy', 1);
app.use(
  session({
    name: 'app.sid',
    secret: SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: { httpOnly: true, sameSite: 'lax', secure: APP_URL.startsWith('https://') },
  }),
);

app.get('/', (req, res) => {
  const { user } = req.session;
  if (!user) return res.send('<h1>Signed out</h1><a href="/login">Sign in with IdRa</a>');
  res.send(`<h1>Signed in</h1><pre>${JSON.stringify(user, null, 2).replace(/</g, '&lt;')}</pre>
    <a href="/logout">Sign out</a>`);
});

app.get('/login', async (req, res) => {
  const verifier = oidc.randomPKCECodeVerifier();
  req.session.flow = { verifier, state: oidc.randomState(), nonce: oidc.randomNonce() };
  const url = oidc.buildAuthorizationUrl(config, {
    redirect_uri: redirectUri,
    scope: 'openid profile email groups',
    code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
    code_challenge_method: 'S256',
    state: req.session.flow.state,
    nonce: req.session.flow.nonce,
  });
  res.redirect(url.href);
});

app.get('/callback', async (req, res) => {
  const { flow } = req.session;
  if (!flow) return res.redirect('/login');
  delete req.session.flow;
  try {
    const tokens = await oidc.authorizationCodeGrant(
      config,
      new URL(req.originalUrl, APP_URL),
      { pkceCodeVerifier: flow.verifier, expectedState: flow.state, expectedNonce: flow.nonce },
    );
    // The ID token has no email or name: they come from UserInfo.
    req.session.user = await oidc.fetchUserInfo(config, tokens.access_token, tokens.claims().sub);
    req.session.idToken = tokens.id_token;
    res.redirect('/');
  } catch (e) {
    console.error(e);
    res.status(400).send(`Sign-in failed: ${e.error ?? e.message}`);
  }
});

app.get('/logout', (req, res) => {
  const idTokenHint = req.session.idToken;
  req.session.destroy(() => {
    if (!idTokenHint) return res.redirect('/');
    const url = oidc.buildEndSessionUrl(config, {
      id_token_hint: idTokenHint,
      post_logout_redirect_uri: `${APP_URL}/`,
    });
    res.redirect(url.href);
  });
});

app.listen(process.env.PORT ?? 3000, () => console.log(`Listening on ${APP_URL}`));

node --env-file=.env server.js