Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const axios = require('axios');
const jwt = require('jsonwebtoken');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(express.json());

// JumpCloud API configuration
const JUMPCLOUD_API_KEY = process.env.JUMPCLOUD_API_KEY;
const JUMPCLOUD_ORG_ID = process.env.JUMPCLOUD_ORG_ID;
const JUMPCLOUD_API_URL = 'https://console.jumpcloud.com/api/v2';
const JWT_SECRET = process.env.JWT_SECRET;

// Rate limiting for authentication endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many authentication attempts, please try again later'
});

// Middleware to verify JumpCloud user and issue JWT
app.post('/auth/login', authLimiter, async (req, res) => {
  try {
    const { username, password } = req.body;

    if (!username || !password) {
      return res.status(400).json({ error: 'Username and password required' });
    }

    // Authenticate user with JumpCloud
    const authResult = await authenticateWithJumpCloud(username, password);

    if (!authResult.success) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    // Fetch user details and group memberships from JumpCloud
    const userDetails = await getJumpCloudUserDetails(authResult.userId);
    
    if (!userDetails) {
      return res.status(500).json({ error: 'Failed to retrieve user details' });
    }

    // Generate JWT with user information and roles
    const token = jwt.sign(
      {
        userId: userDetails.id,
        username: userDetails.username,
        email: userDetails.email,
        groups: userDetails.groups,
        roles: mapGroupsToRoles(userDetails.groups)
      },
      JWT_SECRET,
      { expiresIn: '1h' }
    );

    res.json({
      token,
      user: {
        id: userDetails.id,
        username: userDetails.username,
        email: userDetails.email,
        roles: mapGroupsToRoles(userDetails.groups)
      }
    });
  } catch (error) {
    console.error('Authentication error:', error.message);
    res.status(500).json({ error: 'Internal server error during authentication' });
  }
});

// Authenticate user credentials with JumpCloud
async function authenticateWithJumpCloud(username, password) {
  try {
    const response = await axios.post(
      `${JUMPCLOUD_API_URL}/authn/authenticate`,
      { username, password },
      {
        headers: {
          'x-api-key': JUMPCLOUD_API_KEY,
          'x-org-id': JUMPCLOUD_ORG_ID,
          'Content-Type': 'application/json'
        }
      }
    );

    return {
      success: true,
      userId: response.data.userId
    };
  } catch (error) {
    if (error.response && error.response.status === 401) {
      return { success: false };
    }
    throw error;
  }
}

// Fetch user details and group memberships from JumpCloud
async function getJumpCloudUserDetails(userId) {
  try {
    const [userResponse, groupsResponse] = await Promise.all([
      axios.get(`${JUMPCLOUD_API_URL}/systemusers/${userId}`, {
        headers: {
          'x-api-key': JUMPCLOUD_API_KEY,
          'Content-Type': 'application/json'
        }
      }),
      axios.get(`${JUMPCLOUD_API_URL}/users/${userId}/memberof`, {
        headers: {
          'x-api-key': JUMPCLOUD_API_KEY,
          'Content-Type': 'application/json'
        }
      })
    ]);

    return {
      id: userResponse.data._id,
      username: userResponse.data.username,
      email: userResponse.data.email,
      groups: groupsResponse.data.map(g => g.to.name)
    };
  } catch (error) {
    console.error('Error fetching user details:', error.message);
    return null;
  }
}

// Map JumpCloud groups to application roles
function mapGroupsToRoles(groups) {
  const roleMapping = {
    'Administrators': ['admin', 'user'],
    'Developers': ['developer', 'user'],
    'Users': ['user']
  };

  const roles = new Set();
  groups.forEach(group => {
    if (roleMapping[group]) {
      roleMapping[group].forEach(role => roles.add(role));
    }
  });

  return Array.from(roles);
}

// Middleware to verify JWT token
function verifyToken(req, res, next) {
  const authHeader = req.headers.authorization;

  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.substring(7);

  try {
    const decoded = jwt.verify(token, JWT_SECRET);
    req.user = decoded;
    next();
  } catch (error) {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

// Protected route example requiring authentication
app.get('/api/protected', verifyToken, (req, res) => {
  res.json({
    message: 'Access granted',
    user: req.user
  });
});

// Role-based access control middleware
function requireRole(allowedRoles) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles) {
      return res.status(403).json({ error: 'Access denied' });
    }

    const hasRole = allowedRoles.some(role => req.user.roles.includes(role));
    if (!hasRole) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }

    next();
  };
}

// Admin-only route example
app.get('/api/admin/users', verifyToken, requireRole(['admin']), (req, res) => {
  res.json({ message: 'Admin access granted' });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});