jveverka / iam-service Goto Github PK

Simple OAuth2/OpenID-connect authentication and authorization server.

License: Other

Java 97.21% HTML 0.27% JavaScript 0.90% Dockerfile 0.26% Shell 1.33% CSS 0.02%

iam-service jwt openid oauth2 oauth2-server oauth2-provider oauth2-authentication openid-server spring-security-oauth2 spring-security-jwt

iam-service's Introduction

IAM service - OAuth2 server

Really simple standalone Identity Access Management (IAM) service, OAuth2 authentication and authorization server. Project is compliant with subset of OpenID-connect and OAuth2 and other related specifications.

Please check User's Guide and Examples for more details.

Check Docker Hub releases.

docker run -d -p 8080:8080 jurajveverka/iam-service:2.5.10-RELEASE
curl 'http://localhost:8080/services/discovery'
curl 'http://localhost:8080/services/oauth2/iam-admins/iam-admins/.well-known/openid-configuration'

OpenAPI documentation: http://localhost:8080/swagger-ui/index.html?url=/v3/api-docs#/
Deploy into kubernetes cluster.

Modes of deployment

Unit test deployments, rapid deployments, replicas=1.
Simple use, single JSON file as database, replicas=1.
Single instance deployments, replicas>1.
Cluster deployments, docker or kubernetes, replicas>1.

Features & Mission

Provide minimalistic, simple and small OAuth2/OIDC identity server.
Self-Contained IAM management - clients, users, credentials, permission and roles.
JWTs issued for authenticated clients and user-agents.
Back Channels for JWT verification - backend libraries for resource servers.
Small memory footprint - iam-service (32Mb JVM heap)
Small build size - iam-service (single jar: ~40Mb, docker: ~190Mb)
Seamless integrations with spring framework - check examples.
In memory or Redis backed caches.
Data model stored in memory, single JSON file or MongoDB.

Supported OAuth2 flows

Authorization Code - flow details.
Authorization Code (With PKCE) - flow details.
Password Credentials - flow details.
Client Credentials - flow details.
Refresh Token - flow detail.

Architecture

Front channels.
Back channels.
Architecture details.

Components

iam-service - SpringBoot IAM as microservice (standalone authorization and authentication server).
iam-client - client library for back channel integrations with other microservices (resource-servers).
iam-service-client - client library for remote administration of iam-service (resource-servers).
iam-client-spring - easier integrations for springboot microservices.
iam-examples - examples how to use and integrate with IAM-service.

REST endpoints

Authorization / Authentication APIs - login flows, issuing JWT, revoking JWT.
Admin APIs - manage organization / project / users and credentials.
Back-Channel APIs - discover organization / project / user configuration, get public keys.
Swagger and Actuator APIs

Technical documentation

Security Rules - accessing APIs.
Internal Data Model - internal data model description and glossary.
JWT mappings - mapping details between data model and issued JWT.
Project build & test instructions - how to build this project locally.

RFCs and Specifications

RFC6749 - OAuth 2.0 Authorization Framework
RFC7009 - OAuth 2.0 Token Revocation
RFC7662 - OAuth 2.0 Token Introspection
RFC6750 - OAuth 2.0 Bearer Token Usage
RFC8414 - OAuth 2.0 Authorization Server Metadata
RFC7636 - OAuth 2.0 Proof Key for Code Exchange by OAuth Public Clients (PKCE)
RFC7519 - JSON Web Token (JWT)
RFC7517 - JSON Web Key (JWK)
OpenID - OpenID Connect Core 1.0
References

iam-service's People

Contributors

Stargazers

Watchers

Forkers

brhmshrnv sohbati algarves guilleor toquery avi202020 vladciocan thieucong98 it9good xaviercw codingkrishna

iam-service's Issues

support all 4 official grant types https://oauth.net/2/grant-types/

include model version into persistence (file and mongo)

set persistence to file as default in public docker image

auth code grant flow: implement redirect URL properly

fix swagger / openapi docs

implement security access for management REST APIs

implement properties for client

Implement redis backed caches.

add builders for model entities and model

Model, Organization, Project, Client, User

create python resource server example

implement Extension Grants

https://tools.ietf.org/html/rfc6749#section-4.5

implement automatic unit tests for authorization code grant flow

improvements: create public docker image

implement user password change

use spring version 2.4.1

add consent screen into "Authorization Code" flow

implement SQL persistence layer

implement properties for project

Project object will have Map<String, String> properties.

JWT audience should contain string array

As specified here:
https://tools.ietf.org/html/rfc7519#section-4.1.3

"aud" : [ "api1", "api2", ... ]

Project should contain set of audiences to be used for granting access.

implement userinfo endpoint as specified in OIDC core 1.0

as specified in OIDC core 1.0
https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest

implement provider configuration endpoint

required by resource server:
https://docs.spring.io/spring-security/site/docs/5.3.1.BUILD-SNAPSHOT/reference/html5/#oauth2resourceserver

implementation is described here:
https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
https://tools.ietf.org/html/rfc8414#section-3

rename /services/authentication to /services/oauth2

implement jwks_uri endpoint

implement jwks_uri endpoint as specified here
https://openid.net/specs/openid-connect-discovery-1_0.html
add uri to OpenID Provider Configuration Response

implement project properties true|false

enable / disable password credentials flow
enable / disable client credentials flow

implement in-memory persistence

implement mongo-db persistence

Implement support for RFC7636 (pixy)

https://tools.ietf.org/html/rfc7636

create spring integration tests for user management REST api

Implement "Client Authentication" as "Send client credentials in body".

user sign-up implementation

implement implicit grant flow

https://tools.ietf.org/html/rfc6749#section-1.3.2

implement "token_introspection_endpoint"

https://tools.ietf.org/html/rfc7662

create integration test package

create integration test package that can be used to verify any instance of iam-service

implement properties for user

iam-spring-httpclient - remove this component completely

iam-spring-httpclient is obsolete and it replaced by much better iam-service-client

test spring-security-5-oauth2-login

https://keyholesoftware.com/2020/06/30/quick-start-spring-security-5-oauth2-login/

remove healthcheck controller and enable spring actuator

normalize /service/authentication REST endpoints

actual:
http://localhost:8080/services/authentication/{organization-id}/{project-id}/
http://localhost:8080/services/authentication/login

better:
http://localhost:8080/services/oauth2/{organization-id}/{project-id}/
http://localhost:8080/services/oauth2/{organization-id}/{project-id}/login

implement mongoDB persistence layer

implement proper consent screen for authorization code grant flow

implement file-system persistence

Create Token Generation service and make it pluggable into iam-core.

check random generator setup in docker images

https://stackoverflow.com/questions/7554831/faster-random-generator-in-tomcat-7
https://www.digitalocean.com/community/tutorials/how-to-setup-additional-entropy-for-cloud-servers-using-haveged
https://stackoverflow.com/questions/137212/how-to-deal-with-a-slow-securerandom-generator

secure introspection endpoint

secure introspection endpoint as described here
https://tools.ietf.org/html/rfc7662#section-2.1

To prevent token scanning attacks, the endpoint MUST also require
some form of authorization to access this endpoint, such as client
authentication as described in OAuth 2.0 [RFC6749] or a separate
OAuth 2.0 access token such as the bearer token described in OAuth
2.0 Bearer Token Usage [RFC6750]. The methods of managing and
validating these authentication credentials are out of scope of this
specification.