Coder Social home page Coder Social logo

tekul / broch Goto Github PK

View Code? Open in Web Editor NEW
44.0 5.0 7.0 386 KB

OAuth2 and OpenID Connect in Haskell

Home Page: http://broch.tech

License: BSD 3-Clause "New" or "Revised" License

Haskell 99.02% Nix 0.12% CSS 0.86%
haskell openid-connect oauth2 identity-management

broch's Introduction

Broch

A Haskell implementation of OpenID Connect.

Build Status

Building

The easiest option is to use stack, particularly if you are new to Haskell. Follow the instructions to download and install stack (just adding the stack binary to your path), then

$ git clone https://github.com/tekul/broch
$ cd broch

If you don't already have a compatible ghc version installed, you can get stack to install one by running

$ stack setup

To build the project run

$ stack build

Running with SQLite

If all goes well you can then run the command-line server, and start it with a sqlite database

$ stack exec broch -- --help
$ stack exec broch -- --back-end=SQLITE --issuer=http://localhost:3000

The SQLite database creates a broch.db3 file for the database. It automatically creates the schema and adds a test user (username: "cat", password: "cat") and a client called "app". You should then be able to paste the following authorization request into your browser

http://localhost:3000/oauth/authorize?client_id=app&state=somerandomstate&response_type=code&redirect_uri=http%3A%2F%2Flocalhost:8080/app

After logging in, you will be redirected to the client app URL with a code parameter. This will give a 404, since the client isn't actually running, but you can use a utility like curl to mimic the client's interaction with the token endpoint and exchange the code for an access token.

PostgresSQL Backend

By default, broch uses a PostgresSQL database for storage. Version 9.5 or greater is required. There are two initialization scripts, pgdb.sql and user.sql which create the required schema. For a real deployment, you would run postgres as a system service running in the background, but you can also run it manually.

First create a directory to store the data and initialize it, then start the database

$ initdb brochdb
$ pg_ctl -D ./brochdb start

Then we run the psql client, create a new database and run the initialization scripts

$ psql -u postgres

postgres=# create database broch;
postgres=# \connect broch
broch=# \i pgdb.sql
broch=# \i user.sql
broch=# \q

You should then have a database the server can run against, as well as the same test user and client application as for SQLite. The default connection string is dbname=broch so it should work with the database we just created.

$ stack exec broch -- --issuer=http://localhost:3000

broch's People

Contributors

diogob avatar peterbecich avatar tekul avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

broch's Issues

Use cryptonite

After the next jose-jwt release, it will be using cryptonite, so broch will probably have to switch too.

Link configuration "supported" options to behaviour

These are currently ignored, other than as provided to the client via the discovery response. The client can still use unsupported options in requests and have them processed. For example

  • responseTypesSupported should be checked when processing an authorization request
  • algorithmsSupported should be checked in id token creation, user info responses, request object (when implemented) and client auth signing. It may be sufficient to check some of them when registering the client, since the client's specific algorithms are stored with its data.

Both these and clientAuthMethodsSupported should be checked when registering the client.

Use a routing package

Replace pattern matching with a routing package like reroute so that routing tables can be modified added to etc.

OP-Registration-jwks is broken

Apparently because jwt-bearer authentication is failing at the token endpoint:

6.056765 ------------ AccessTokenRequest ------------
6.070599 --> URL: https://connect.broch.io/oauth/token
6.070606 --> BODY: code=5b68c016317953fa&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&redirect_uri=https%3A%2F%2Foictest.umdc.umu.se%3A8101%2Fauthz_cb&client_assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6ImExIn0.eyJhdWQiOiBbImh0dHBzOi8vY29ubmVjdC5icm9jaC5pby9vYXV0aC90b2tlbiJdLCAiaXNzIjogImVmNTViYWFhNzAyMWM0ZDciLCAianRpIjogIlBjZnAzZ0hGIiwgImV4cCI6IDE0MjM4MjczNTIsICJpYXQiOiAxNDIzODI2NzUyLCAic3ViIjogImVmNTViYWFhNzAyMWM0ZDcifQ.fdCY3O6JU2hWZAOacdZkfXWgbclO9ZP990lrZuoV7pcPY_NMkXxDzrtIf4eenXFc1YOFujiCmtxKopvFp3fMpcdweO1we4N37l5FsuI9AFCTGyrNdoay42EXdimG2FV4shA8HKjmp0Y36Pt0Vvv6VkzMguIlwOWYJ77_s2UHny9YBLcMwT5tGwL84yYRinuocnnx9yYQv1LeHE-RYEk8zG8yFqNRfoRrOoid3HwfgwA0giwksVmhRLwYJXrdh97aFmmAnXTOH9Br6tKqE8E30zQMr_fxL-lyFuaG5PgIT8T3X17HbY8ym-9DabVp5NgTlJJE88npVuALlOCbzgeGgg&client_id=ef55baaa7021c4d7&grant_type=authorization_code
6.070613 --> HEADERS: {'Content-type': 'application/x-www-form-urlencoded'}
6.539187 <-- STATUS: 400
6.539302 ErrorResponse: {
  "error": "invalid_client"
}
6.540084 [ERROR] WHERE: check-http-response
6.540091 [ERROR] STATUS:CRITICAL
6.540093 [ERROR] HTTP STATUS: 400
6.540094 [ERROR] INFO: {"error": "invalid_client"}
6.540733 [ERROR] FatalError:{"error": "invalid_client"}

redirect_uri parameter with a dynamically changing query string should be allowed

Currently only an exact match is allowed, whereas varying the query string is allowed in some cases - From 3.1.2.2 of RFC-6749:

   The authorization server SHOULD require the client to provide the
   complete redirection URI (the client MAY use the "state" request
   parameter to achieve per-request customization).  If requiring the
   registration of the complete redirection URI is not possible, the
   authorization server SHOULD require the registration of the URI
   scheme, authority, and path (allowing the client to dynamically vary
   only the query component of the redirection URI when requesting
   authorization).

So the checks should probably be:

  • Make sure there's no fragment
  • Verify everything apart from the query string matches
  • If the registered URI has a query string, make sure those parameters match
  • Allow the client to add additional query parameters

Sample code with Servant.

I just came across your project and I would like to find out if there is any sample code that shows the framework being used along Servant? I really appreciate your blogs and hope to read more of them. Thanks for your help.

Better UI for "user agent" errors

An error page for errors which are reported to the users, rather than as redirects to the client.

Currently the textual error is just printed in the browser.

Fix handling of redirect_uris with a query string

These are allowed by OAuth2 and the query parameters should be retained when building the new redirect. The current code is broken in that it will append a new query on the end.

Both the error and success cases need to be dealt with. The code should be refactored to share the redirect URL building functionality.

Update to reroute 0.4

The text routing code has been removed from reroute in the latest LTS version, so need to switch to the SafeRouting option (if it makes sense).

Please make a hackage release

At supercede we've made a yesod integration for this library.
However it currently doesn't build out of the box because this library was never uploaded to hackage.
Please upload this software to hackage!

Access token revocation on code reuse attempt

OP-OAuth-2nd-Revokes requires that using an authorization code twice revokes access tokens.

See also 10.5 of RFC6749

The requirement is only for access tokens based on the code itself, but this won't be possible for JWT tokens which aren't cached at the OP. The code would also have to be stored with the token.

automatic key rotation process?

This is more a question than an issue. We're running a server pretty much based on the example server (but with different authentication). After about 5 days, some clients seem to stop working until we restart one or both services, which seems to correspond to the default key TTL. Does rotateKeys need to be called manually every 5 days, or is some other process necessary? The docs just say the function exists in case you need to manually generate new ones, but the example only calls the function when it starts.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.