big-kahuna-burger / f0

OIDC Protocol Conforming Identity Provider and a Management Dashboard

A Auth0 (micro) copy

Requirements

• Node 18/20
• Docker

Install

Clone repo, cd to it:

Env

Add env files:

OP ENV (fastify server)

cat <<EOT > services/idp/.env
# IDP Environment Variables
ISSUER=http://localhost:9876/oidc
POSTGRES_PRISMA_URL='postgres://postgres:secret123@localhost:5432/idp'
POSTGRES_URL_NON_POOLING='postgres://postgres:secret123@localhost:5432/idp'
GRANTS_DEBUG=1
DEBUG=oidc:events:*
DASHBOARD_ORIGIN=http://localhost:3036

# after running scripts/init
DASHBOARD_CLIENT_ID=
EOT

Manage ENV (React SPA)

cat <<EOT > services/manage/.env
# React App Environment Variables
PORT=3036
REACT_APP_ISSUER=http://localhost:9876/oidc

# after running scripts/init
DASHBOARD_CLIENT_ID=
EOT

Run installation for services/idp

Daemonize postgres and jaeger on docker

cd services/idp && docker compose up -d

Install deps: it will run client generation and db migrations as well

npm i

Initialize

Makes those default/readonly objects for bootstrapping:

• Management API ResourceServer
• Dashboard OidcClient
• Default Admin Connection
• Enables Dashboard OidcClient with a Admin Connection

npm run init

After initialization, output will give a client id that needs to be added to env vars

Script that needs user interaction and let's you create account. (TODO, ask for claims other than email/password)

npm run create-account

npm start

Visit well known url: http://localhost:9876/oidc/.well-known/openid-configuration Visit jwks: http://localhost:9876/oidc/jwks

Run installation for services/manage

cd ../manage && npm i

npm start

Visit management app: http://localhost:3036/

f0's Issues

Implement dynamic connections for interaction router

• Based on a OidcClient -> ClientConnection -> Connection relation, there will be 0 to N Connections enabled for a client

Given this fact:

• Implement dynamic connections loading in the login interaction and dynamic plugin mounting the relevant connection configurations, start with Google as first alt example that can be enabled/disabled
• Implement error when it's 0 saying "Client disabled" or something

Tests for manage/v1

Custom SAML

Implement custom custom connection to other IDPs using SAML protocol and expose SAML IDP federation metadata.

Migrate to vite

Drop react-scripts in favour of vite.

Implement proper update of `urn:f0:type`

1. Changing from m2m/web into native/spa => not allowed
2. Changing from native/spa into m2m/web => allowed, to be followed up with issuing a secret for a client and (maybe?) adding client_credentials to grant_types.

Token Endpoint Method is nonsecretive when token_endpoint_auth_method is one of (private_key_jwt, none, tls_client_auth, self_signed_tls_client_auth)
Corresponding default grant types: implicit (?), authorization_code, refresh_token

Token Endpoint Method is a secretive when token_endpoint_auth_method is not in above set.
Corresponding default grant types: implicit (?), authorization_code, refresh_token, client_credentials

Social Connections

Implement Social Connections strategies starting with Google and Github

Applications API Tab

Maybe not that useful...

Enforce permissions on manage router

A Management API token should have permissions built in and enforced at v1/manage router, returning 403 then token has insufficient scope.

Additional context
Consider declarative api like fastify-guard, built in is the preferred way of implementation.

Implement Quick Start for private_key_jwt with AuthCode and openid-client

Wire up the Authentication Method details related to signup into the Login Prompt

1. Connection parameter

There is no standard auth parameter for connection property, but rather it needs a support trough a extraParams prop with oidc-provider library.
See docs

2. Given a client_id during GET interaction/:uid call, the login screen needs to be dynamic based on following:

• Load all possible connections for this client and (it's just a DB/internal strategy for now, until social / external IDP/SAML gets implemented)
• If at least one of those connections has a disabled signup, then the login screen has a disabled signup.
• If all of those connections have enabled signup, then oldest one is selected as registration target based on the creation timestamp.

3. For a specified connection (connection parameter implemented and client has passed a specific known connection name (id?) in the prop):

• Load that connection, see if it's enabled for a client, similar to (2.). In case it's disabled - give RP error with description specified connection disabled for a client

Identity Connection Table Schema Design

Right now, there is only single identity connection.
This DB.
So Account,PasswordHash,Identity models are all in single schema.
See the schema layout and disjunct the schema into base schema plus password bound connection/s schemas parts.
Query appropriately.
Ideally N are needed, so something like making/destroying parts of schema for password bound connections on the fly needs to happen with DB server.

Applications Credentials Selection tab

DB Connection Show/Edit Component

Applications Update

Finish this UI, wire up in OIDC Api side the effects later

Implement Passkeys using simplewebauthn

Private JWT Endpoint Authn Method

• Implement adding jwks to oidcClient on load by library

• storing of n jwks per client when auth method is private_key_jwt
  (RSA 2-4K as PEM/JWK formatted, or X509 cert as PEM/JWK formatted)
  Translate everything into JWK and show diff format on demand.

• Endpoint to accept PEM or JWK for clientId

• Render Credentials when private_key_jwt

• Credential Actions full cycle

Validations on endpoints

All manage/v1 are lacking param validations

Theme switch/contrast issue

A nicer looking light theme.
Right now I just use dark in development, but it should be switchable and also have ability to follow system applied colour scheme.

Third party Custom OIDC

Implement custom connections to other third party OIDCs that expose metadata

Connection Tester page

Implement a connection Tester on connections/iD component