API — 2023 — 2024
SAMS Identity & SSO.
Enterprise SAML SSO and authentication hardening across a multi-service Node.js platform.
Role
Full Stack Developer — Auth & SSO Module Owner
Timeline
2023 — 2024 · ~15 months
Team
Module owner within a platform team
Type
API
The Problem
The platform needed enterprise-grade sign-in — including SAML SSO into third-party tools like Atlassian Confluence — on top of an auth stack with real security gaps: JWTs decoded without verification, no email verification, and no self-service password recovery.
What I Built
I owned the SAML SSO integration (Confluence via K15t), migrating the implementation across saml2-js → passport-saml → node-saml while adding assertion signing, issuer validation, and secure host checks. In SAMS-API I replaced JWT decode with verify, implemented bcrypt password hashing, built a full forgot/reset-password flow with EJS email templates and tokenized reset links, added email verification on signup, and fixed case-insensitive email matching and social-login bugs. I also built industry & channel sync from GMS with CRUD APIs (GraphQL + Neo4j/PostgreSQL) and admin toggles in the React/Apollo console.
The Outcome
Enterprise SSO went live for third-party tool sign-in, and the platform's authentication moved from known-vulnerable patterns to verified JWTs, hashed credentials, and complete self-service account-recovery flows.
Key Decisions & Challenges
SAML SSO for Atlassian Confluence (K15t), hardened through three library migrations with assertion signing and issuer validation.
Security fix: replaced JWT decode with verify; introduced bcrypt password hashing.
Full forgot/reset-password flow with tokenized links and templated email.
Cross-service data sync (GMS → SAMS) with GraphQL + Neo4j/PostgreSQL CRUD APIs and admin console toggles.
Have a project in mind?
I'm open to freelance work and full-time roles. Let's talk about what we could build together.
Get in touch