title: Using JWT with Active Directory authentication in NodeJS backend
body: <p>I am building an intranet web application consisting of an Angular frontend and a Node.JS backend. The application needs to use the corporate Active Directory for authentication and authorization.</p>
  
  <p>I'm considering how to best implement this in a secure way. I am planning to use the <a href="https://www.npmjs.com/package/activedirectory" rel="noreferrer">Active Directory node module</a> for actually communicating with the AD to authenticate when the user logs in, and to check security group membership for certain restricted actions, etc.</p>
  
  <p>However, I am not quite sure what is the best way to authorize my backend endpoints. The AD module does not offer any token/ticket, even though I suppose Kerberos is used for the actual authentication process. In other authenticated apps I've developed I've generated a jsonwebtoken when the user logs in, and then passed and verified that token in each backend route, is that a good idea also when authenticating against AD?</p>
  
  <p>EDIT: Second part of question spawned to separate thread: <a href="https://stackoverflow.com/questions/30523238/best-practices-for-server-side-handling-of-jwt-tokens">Best practices for server-side handling of JWT tokens</a></p>
  
  <p>Also, I have a more general concern, regarding what the best practice is for actually verifying tokens. Suppose that the "secret" used for JWT generation is compromised (in my scenario many people may have access to the source code of the system, but not to the system itself). Am I right in believing that a malicious user could then, with only this information, generate a token on behalf of any given user, and without ever authenticating with AD use that token in my API requests? A token is typically generated using <code>jwt.sign(payload, secretOrPrivateKey, options)</code>.
  Alternatively, suppose a malicious user could get hold of an actual token (before it has expired). To me it seems like instead of having to know a user's username and password, the security is now reduced to having to know the username and the JWT secret. Is this a valid concern and what should I do to prevent this? </p>
  
  <p>My best hope so far is using a server side session to store information about the current user after logging in, so that even if a token is maliciously generated and used when accessing backend endpoints, it would fail unless the user has actually gone through the login route, authenticated with AD and stored some information in the session as a result of this.</p>
  
  <p>I also considered actually authenticating with AD in <em>each</em> API endpoint, but that would require the AD username/password to be sent in every request, which in turn would require that sensitive information would have to be stored in the client's sessionstorage or localstorage, which is most likely a bad idea.</p>
  
  <p>So, questions:</p>
  
  <p>1) Is it reasonable to combine AD authorization with JWT as bearer token or what is the preferred way to build a secure backend + frontend utilizing AD for authentication?</p>
  
  <p>2) If JWT is a good idea, what is the best practice for securing endpoints using JWT? Is using a server side session reasonable?</p>
  
  <p>Interestingly enough I have found tons of examples on how to best implement token based authentication (in general, or with NodeJS specifically), but many of them seem flawed in one way or another.</p>