Adding Enterprise SSO to NestJS Applications: SAML, Guards, and SSOJet in 2026

Avi Kapoor, a Customer Success Manager at SSOJet, provides a comprehensive guide on implementing SAML Single Sign-On (SSO) in NestJS applications, addressing common pitfalls and proposing an idiomatic pattern for NestJS, which differs from traditional Express setups. Emphasizing the use of Dependency Injection, Modules, Controllers, Guards, Decorators, and Pipes, the guide critiques the typical use of passport-saml in NestJS for its lack of testability and multi-tenant support, advocating instead for a broker pattern using SSOJet. This approach keeps the codebase clean and testable by encapsulating SAML logic within an @Injectable() service, allowing for multi-tenant IdP routing and JWT issuance. The guide also outlines the necessary project setup, including the use of the @nestjs/jwt package and SSOJet's broker for SAML validation, and emphasizes the importance of configuring NestJS correctly to handle SAML callbacks and guard exceptions. Kapoor highlights the efficiency of this method in real-world applications, noting its alignment with NestJS's architecture and its ability to simplify enterprise-level SSO implementations, reducing the time to achieve a working login.