I recently had to wire up SAML-based SSO with Okta for a Next.js project. Most of the resources I found were either outdated or assumed a ton of boilerplate. I ended up combining passport-saml, iron-session, and custom API routes to make it work cleanly with Next.js.
Covered in the guide:
Okta SAML setup + metadata extraction
Configuring Passport strategy
Secure session handling with iron-session
API route-based login/callback/logout flows
Protecting SSR pages and basic user provisioning
Tips for testing locally with ngrok
If you’re building enterprise-ready apps with Next.js and need SAML support, this might save you some time: https://ssojet.com/blog/integrating-okta-saml-sso-with-your-...
Feedback welcome, and I’m happy to help troubleshoot if anyone hits weird edge cases like ACS URL mismatch or certificate issues.