Passport.js and ORCiD.org

example.js

/*
 *  Example for authenticationg against the ORCiD.org Public API with
 *  passport.js and retrieving the authenticated orcid.
 *
 *  The main difficulty is that ORCiD.org will send the authenticated orcid
 *  in the accessToken request, which is normally not passed on to the
 *  passport.js-callback. Without the orcid, properly authenticating with
 *  ORCiD.org is impossible though.
 *
 *  The trick is to pass on the `passReqToCallback`-option to the
 *  OAuth2Strategy, so that the callback will receive the complete content of
 *  the accessToken request. We can then use a callback function with the
 *  signature `(req, accessToken, refreshToken, params, profile, cb)`, where
 *  the parameter `params` will contain the JSON-parsed values of the
 *  accessToken answer. The orcid can then be accessed via `params.orcid`.
 */
const passport        = require('passport');
const OAuth2Strategy  = require('passport-oauth2').Strategy;

const orcid = new OAuth2Strategy(
    { // Configure your OAuth2Stragey as usual, but set `passReqToCallback`
      …,
      passReqToCallback : true
    },
    (req, accessToken, refreshToken, params, profile, cb) => {
      // You can now access the orcid and the name of the authenticated user
      // in your passport callback and e.g. save it to your database for
      // further use.
      console.log(params.orcid);
      console.log(params.name);
    }
);

/*
 *  The remaining code would just be your usual passport.js configuration.
 */

The complete application this configuration was originally developed for is https://github.com/o2r-project/o2r-bouncer

Further comments pointing to other implementations using this approach are very welcome!