Authenticating with Passport.js ActiveDirectory doesn't maintain session - node.js

Question

I'm having an issue with Passport.js using the ActiveDirectory strategy where I'm successfully authenticating but fail to maintain a session on subsequent requests. After authentication, any call to req.isAuthenticated() returns false. Additionally, no cookie is being set on the client's browser. I've spent the day pouring over similar posts but so far none of the suggested solutions have worked.
Some observations to note:
-Authentication is always successful and returns the req.user to client.
-The console.log in serializeUser() always fires and correctly logs the user record.
-The console.log in deserializeUser() never fires, I'm not sure when this function is supposed to be called but it doesn't appear to be?
-After logging in, each time I make a call to my /test endpoint the non-authenticated condition fires.
// Passport Requires
const passport = require('passport');
const session = require('express-session');
var ActiveDirectoryStrategy = require('passport-activedirectory');
// Setup
app.use(session({
secret: 'secret',
resave: false,
saveUninitialized: false,
cookie: { secure: false, maxAge: 600000 }
}));
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser(function(user, done) {
console.log('userStrategy -- serialized:', user)
done(null, user);
});
passport.deserializeUser(function(user, done) {
console.log('userStrategy -- deserializeUser', user)
done(null, user);
});
passport.use(new ActiveDirectoryStrategy({
integrated: false,
passReqToCallback: true,
ldap: {
url: "url",
baseDN: "baseDN",
username: `username`,
password: `password`
}
}, function (req, profile, ad, done) {
ad.isUserMemberOf(profile._json.dn, 'Access Group', function (err, isMember) {
console.log('isMember:', isMember)
if (err) {
return done(err)
} else {
return done(null, profile)
}
})
}))
// Login Route
app.post('/login',
passport.authenticate('ActiveDirectory', { failWithError: true }),
function (req, res) {
console.log('Authenticated');
return res.status(200).send(req.user);
}, function (err) {
console.log('Not Authenticated');
return res.sendStatus(401).send(err);
}
)
// Test endpoint to check whether user is authenticated
app.get('/test', function(req, res) {
if (req.isAuthenticated()) {
res.send('Youre authenticated!')
} else {
res.send('Youre not authenticated!')
}
})
Appreciate any thoughts on the problem -- thanks!

Answer 1

I've figured out the issue which has nothing to do with Passport or server setup.
In my client-side API call to login I've been using fetch() but I did not have credentials: 'include' option on the initial POST to login. Once I added this option, a cookie was sent back to the client browser and future API calls to isAuthenticated() returned true.
Make sure to have credentials: 'include' on ALL of your API calls, including the initial POST to login.