blazkaro / fapiserver

The FAPI implementation in C#

FAPI Server

That's flexible, but not fully compatible implementation of FAPI, OAuth2.1 and OpenID Connect specifications. It supports:

• Grant Management for OAuth2.0
• OAuth 2.0 Rich Authorization Requests in modified version, will explain later
• OAuth 2.0 Pushed Authorization Requests
• OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)
• OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0
• Authorization endpoint
• Token endpoint
• Token revocation endpoint
• Token introspection endpoint
• User info endpoint
• Discovery endpoint

Documentation

https://blazkaro.github.io/FAPIServerDocumentation/

Why it's not fully compatible?

• It uses PASETO instead of JWT, and PASERK instead of JWK. Every token like access token, authorization response and DPoP uses PASETO.
• It doesn't support mTLS, only private_key_paseto (private_key_jwt that uses PASETO) as authentication method
• Currently, it doesn't support server-provided nonce defined in FAPI 2.0 Security Profile

Roadmap

• Support for CIBA
• Support for application-level request signing between client and authorization server by using client_assertion and DPoP mechanism, or by request objects. (milestone)
• Support for signing userinfo, token introspection and grant querying responses
• Support for DPoP revocation after use (the same mechanism as with client_assertion)
• Add better documentation for project
• Add unit tests

Security policy

If you see security issues, please contact me by email, [email protected]

fapiserver's Issues

Not working token introspection and revocation

The token introspection and revocation currently is not working properly due to problems with serialization. I will fix it as soon as possible.

Support for Client Initiated Backchannel Authentication (CIBA)

I'm currently working on CIBA. I have created request validator and a piece of handler, but I see that some breaking changes must be done.
The 'AuthorizationHandler' class must be redesigned, because it was created to work with, as name says, authorization endpoint. To adapt it to CIBA this class must be fundamentally refactored. I'm planning to create something like base authorization handler, which will handle the core of authorization (no validation performed, no persistence, working on independant from authorization models etc.), and then classes that inherit from it - handler for authorization endpoint and CIBA. The InteractionService also have to be redesigned, because it was created to work with authorization endpoint based approach.