Q:

Editing req.user object

I am running a basic authentication strategy in express for passport directly out of the tutorials. 
(Facebook strategy shown below as it is common, I'm actually using passport-saml, but this question relates to all passport strategies):
passport.use(new FacebookStrategy({
    clientID: FACEBOOK_APP_ID,
    clientSecret: FACEBOOK_APP_SECRET,
    callbackURL: "/auth/facebook/callback"
  },
  function(accessToken, refreshToken, profile, cb) {
      //HOW DO I ATTACH THE profile OBJECT HERE TO THE PASSPORT USER?
      //OR IS THERE ANOTHER WAY TO SAVE profile FOR LATER? (without using a database)
      return cb(null, profile);
  }
));

I need to edit the req.user object, and append the profile object from the passport callback. This will enable the user session to have user specific profile data.
I will then use the req.user with the added profile in the authentication middleware:
//MIDDLEWARE TO CHECK IF USER IS LOGGED IN
function authUser(req, res, next) {
    if (req.user) {
        //I WANT TO HAVE THE profile AVAILABLE HERE
        next();
    } else {
        res.redirect('/');
    }
}

How can I edit the passport user object to have the extra profile information available?

A:

Trying to modify req.user doesn't seem like the best practice to have (if it would even work). I believe req.user should be, at all times, identical to the user in your database.
However, you could use passReqToCallback to use req in the Passport callback, and set req.session accordingly.
passport.use(new FacebookStrategy({
    clientID: FACEBOOK_APP_ID,
    clientSecret: FACEBOOK_APP_SECRET,
    callbackURL: "/auth/facebook/callback",
    passReqToCallback: true
  },
  function(req, accessToken, refreshToken, profile, cb) {  
      req.session.profile = profile;
      return cb(null, profile);
  }
));

You should then remember to delete the req.session.profile on any request where req.user isn't defined in order to not keep outdated profile information on logged-out users.
app.get("*", function(req, res, next){
    if(req.session.profile && !req.user)
        delete req.session.profile;
    next();
});

All of this is untested, but I believe it could work for you.

