Why should you care?

Enterprises forbid local passwords; SSO via OAuth is mandatory for B2B SaaS.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

// Authorization Code flow (simplified)
router.get('/auth/oauth/microsoft/start', (_req, res) => {
  const url = new URL('https://login.microsoftonline.com/common/oauth2/v2.0/authorize');
  url.searchParams.set('client_id', process.env.MS_CLIENT_ID!);
  url.searchParams.set('response_type', 'code');
  url.searchParams.set('redirect_uri', process.env.OAUTH_REDIRECT!);
  url.searchParams.set('scope', 'openid profile email');
  res.redirect(url.toString());
});

router.get('/auth/oauth/microsoft/callback', async (req, res, next) => {
  const tokens = await exchangeCodeForTokens(req.query.code as string);
  const profile = await fetchProfile(tokens.access_token);
  const user = await upsertUserFromOAuth(profile);
  const accessToken = signAccessToken(user);
  res.redirect(`${process.env.ANGULAR_APP}/auth/callback?token=${accessToken}`);
});

What happened?

• User redirects to IdP login.
• Callback receives code exchanged server-side for tokens — client_secret never exposed to Angular.
• upsertUser links OAuth subject to MeanVerse user.

Practice next

1. Register OAuth app in Azure AD or Google Cloud.
2. build start and callback routes server-side only.
3. Map IdP groups to MeanVerse roles.
4. Add state parameter CSRF protection on start URL.
5. Support multiple IdPs via tenant-specific client_id.

Remember

OAuth delegates login to trusted IdP. Authorization code flow for web apps. MeanVerse still issues own JWT after OAuth.

Enterprise SSO

Bank employees use Microsoft Entra ID; no MeanVerse password.

Outcome: IT disables ex-employee at IdP — access stops immediately.