passport-linkedin-oauth2

A simple Passport strategy for LinkedIn OAuth2 that works with lite profile and supports enhanced security features.

Features

• LinkedIn OAuth2 authentication with OpenID Connect support
• Automatic state parameter handling for CSRF protection
• Refresh token support
• Extended profile information
• Comprehensive error handling

Important Notes

• PKCE Support: LinkedIn's OAuth2 implementation currently does not support PKCE (Proof Key for Code Exchange). The state parameter is used for CSRF protection instead.
• State Parameter: LinkedIn requires the state parameter for security. This implementation handles it automatically.

Install

npm install passport-linkedin-oauth2

Usage

Register the strategy:

var LinkedInStrategy = require('passport-linkedin-oauth2').Strategy;

passport.use(
  new LinkedInStrategy(
    {
      clientID: LINKEDIN_KEY,
      clientSecret: LINKEDIN_SECRET,
      callbackURL: 'http://127.0.0.1:3000/auth/linkedin/callback',
      scope: ['email', 'profile', 'openid'],
      // Enable state parameter (recommended and enabled by default)
      state: true,
      // Request refresh token
      authorizationParams: {
        access_type: 'offline'
      }
    },
    function (accessToken, refreshToken, profile, done) {
      // asynchronous verification, for effect...
      process.nextTick(function () {
        // To keep the example simple, the user's LinkedIn profile is returned to
        // represent the logged-in user. In a typical application, you would want
        // to associate the LinkedIn account with a user record in your database,
        // and return that user instead.
        return done(null, profile);
      });
    }
  )
);

Authentication routes:

// Initial authentication request
app.get(
  '/auth/linkedin',
  passport.authenticate('linkedin', {
    // Optional: Force account selection
    prompt: 'select_account',
    // Optional: Pre-fill email
    loginHint: '[email protected]'
  }),
  function (req, res) {
    // The request will be redirected to LinkedIn for authentication
  }
);

// OAuth 2.0 callback
app.get(
  '/auth/linkedin/callback',
  passport.authenticate('linkedin', {
    successRedirect: '/',
    failureRedirect: '/login',
  })
);

Configuration Options

The strategy accepts the following options:

| Option | Type | Description | Default | |--------|------|-------------|---------| | clientID | String | LinkedIn application client ID | Required | | clientSecret | String | LinkedIn application client secret | Required | | callbackURL | String | URL to which LinkedIn will redirect after auth | Required | | scope | Array | OAuth 2.0 scopes to request | ['profile', 'email', 'openid'] | | state | Boolean | Enable state parameter (recommended) | true | | authorizationURL | String | Override LinkedIn's authorization endpoint | LinkedIn default | | tokenURL | String | Override LinkedIn's token endpoint | LinkedIn default | | profileURL | String | Override LinkedIn's profile endpoint | LinkedIn default | | authorizationParams | Object | Additional authorization parameters | {} |

Profile Fields

The strategy returns a profile with the following fields when available:

• id: LinkedIn user ID
• displayName: Full name
• givenName: First name
• familyName: Last name
• email: Email address
• picture: Profile picture URL
• headline: Professional headline
• industry: Industry
• location: Location information
• positions: Current and past positions
• profileUrl: LinkedIn profile URL
• publicProfileUrl: Public LinkedIn profile URL

Error Handling

The strategy provides detailed error information through custom error classes:

• LinkedInAPIError: For LinkedIn API-specific errors
• UserInfoError: For OAuth/OpenID user info endpoint errors
• InternalOAuthError: For general OAuth2 errors

Example error handling:

app.get('/auth/linkedin/callback', function(req, res, next) {
  passport.authenticate('linkedin', function(err, user, info) {
    if (err) {
      if (err instanceof LinkedInStrategy.LinkedInAPIError) {
        // Handle LinkedIn API error
        return res.redirect('/login?error=api');
      }
      if (err instanceof LinkedInStrategy.UserInfoError) {
        // Handle user info error
        return res.redirect('/login?error=userinfo');
      }
      // Handle other errors
      return next(err);
    }
    // Proceed with successful authentication
    req.logIn(user, function(err) {
      if (err) { return next(err); }
      return res.redirect('/');
    });
  })(req, res, next);
});

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Author

Auth0

License

This project is licensed under the MIT license. See the LICENSE file for more info.