it9good / authx-micro

authx-micro

Minimalistic standalone OAuth2 authentication and authorization server. Project is compliant with subset of OpenID-connect and OAuth2 and other related specifications.

Disclaimer: This project is WIP ! First release is expected EOF March.2022. AuthX is simplified version of iam-service supporting more data access scenarios.

Test with docker-compose

curl https://raw.githubusercontent.com/jveverka/authx-micro/main/docs/authx-service-deployments/authx-docker-compose.yml -o authx-docker-compose.yml
docker-compose -f authx-docker-compose.yml up -d 
curl http://localhost:7777/actuator/health
curl http://localhost:8080/authx/api/v1/system/info

See other deployments scenarios;

Supported OAuth2 flows

• Password Credentials - flow details.
• Client Credentials - flow details.
• Refresh Token - flow detail.

REST Endpoints

• Check This insomnia collection.
• OpenAPI 3.0 (swagger)

  http://localhost:8080/authx/v3/api-docs
  http://localhost:8080/authx/swagger-ui/index.html?configUrl=/authx/v3/api-docs/swagger-config
  

• OAuth2 endpoints

  http://localhost:8080/authx/api/v1/oauth2
  

• Admin endpoints

  http://localhost:8080/authx/api/v1/admin/authx
  http://localhost:8080/authx/api/v1/admin/project
  

• Management endpoints

  http://localhost:7777/actuator/health
  http://localhost:7777/actuator/prometheus
  

Technical documentation

• Security Model
• Internal Data Model.
• Authx in Docker.
• Build and run locally.

RFCs and Specifications

• RFC6749 - OAuth 2.0 Authorization Framework
• RFC7009 - OAuth 2.0 Token Revocation
• RFC7662 - OAuth 2.0 Token Introspection
• RFC6750 - OAuth 2.0 Bearer Token Usage
• RFC8414 - OAuth 2.0 Authorization Server Metadata
• RFC7636 - OAuth 2.0 Proof Key for Code Exchange by OAuth Public Clients (PKCE)
• RFC7519 - JSON Web Token (JWT)
• RFC7517 - JSON Web Key (JWK)
• OpenID - OpenID Connect Core 1.0