node.js - REST / Web based authentication-as-a-service a possibility? -

i've developped rest based service using express , started implementing authentication myself. simple username/password authentication

• passwords encrypted using bcrypt
• user info + hashed passwords stored in mongodb
• password verification checks done.
• authentication tokens (limited ttl) generated / validated

i have knowledge on node.js, not sufficient make me feel comfortable rolling out own authentication (login/signup) mechanism.

for reason replace in-house mechanism else.

something proven, extendable, pluggable , easy use.

given amount of secure websites / rest apis out there based on node.js, i'm sure there out-of-the box solutions people / companies have offer can service implementors , running quickly, without having worry security/user aspect.

i'm looking even higher level of abstraction of libraries passport or everyauth. provides out-of-the-box functionality, capable of fulfilling requirements including :

• providing login page / signup page / profile page
• different authentication modules (google,facebook,github,....)
• storing user info (+credentials if required) in datastore (mongodb).
• remember me
• forgot password / reset password

so question here :

• are there out-of-the-box solutions available offer higher level of abstraction passport/everyauth/... ?
• if any, recommend of these out-the-box solutions ?
• should instead forget notion of outsourcing user authentication , start looking @ passport , everyauth , start implementing requirements using libraries ?
• is possible focus on business logic , not worry @ aspect regarding user authentication (writing login / signup pages , implementing forgot password / reset password flows, storing user info in db).

the service api should largely live independent of authentication mechanism, i'd recommend starting behind simple password protected folder or such. in opinion better make sure you're api works , can gain traction. meaning it'll more long term project. nothing kills project quicker focusing on painful stuff right out of box.

as far service use? it's non-trivial setup security well. small startup project, it's more cost-effective integrate service. might take @ mozilla persona. it's built on node , pretty straight forward.

if try roll own outside expertise, , don't stupid stuff use hashing algorithm sha1 store passwords. instead use bcrypt. there other things like, don't store server logs on server they're created. pipe out logs elsewhere if there's intrusion have forensics trail happened.