18f / identity-oidc-gin

An example Login.gov client application which authenticates users via OpenID Connect (OIDC). Written in Go. Uses the Gin web framework.

This sample SP has been retired. It was used for early prototyping for integrations with login.gov and has not been maintained. It has confirmed vulnerabilities and should not be used for production itegrations.

For maintained examples of integrations with login.gov please refer to:

• https://github.com/18F/identity-saml-sinatra
• https://github.com/18F/identity-oidc-sinatra

identity-oidc-gin

An example Login.gov client application which authenticates users via OpenID Connect (OIDC). Written in Go. Uses the Gin web framework and the Goth authentication package. Disclaimer: Goth is not (yet) a certified OpenID Relaying Party.

Demo:

Installation

Install Go (version 1.9.4).

Install the source code:

go get github.com/18F/identity-oidc-gin
cd $GOPATH/src/github.com/18F/identity-oidc-gin

Configuration

Configure environment variables using a .env file. At a minimum, set the SESSION_SECRET variable. For an example, see the .env.example file.

Choose a Login.gov Environment

Development Environment (Local Server)

Set the PROVIDER_URL environment variable to http://localhost:3000.

Run a Login.gov (identity-idp) instance locally on port 3000:

cd path/to/identity-idp
make run

Sandbox Environment

Set the PROVIDER_URL environment variable to to one of the sandbox urls:

• https://idp.dev.identitysandbox.gov
• https://idp.int.identitysandbox.gov

NOTE: this application's credentials have not yet been deployed to the sandbox environments. this note will be removed when the credentials have been deployed and this application has been tested against these sandbox environments.

Usage

Run the app:

go run app.go

Then view in browser at localhost:8080.

License

identity-oidc-gin's Issues

RP-initiated Logout

Implement RP-initiated logout. See https://developers.login.gov/oidc/#logout and https://github.com/18F/identity-oidc-expressjs/blob/master/routes/auth/login-gov.js#L35-L47.

Prefer a Certified OpenId package

I notice Goth is not included in the list of implementations certified by OpenId.

It would be ideal for us to use a certified package, but the Go language does not currently have any.

I have heard we (login.gov team) have helped certify other OIDC implementations before, so we might be able to help certify Goth.

See also: markbates/goth#216

cc @blacktm

Tests

Implement some automated browser tests! Probably need to mock/fake interactions with the login.gov server, which might be a little tricky.

Crypto Rand

I read at https://github.com/golang/go/wiki/CodeReviewComments#crypto-rand that crypto/rand should be used instead of math/rand for security reasons.

See also markbates/goth#215