kaliop / oidc-sample-provider

Demo OpenID Connect identity provider in NodeJS (tutorial mode)

oidc-sample-provider

Demo OpenID Connect identity provider in NodeJS (tutorial mode)

Tutoral

Requirements

NodeJS >= 8.16

Init

Clone the sources:

git clone https://github.com/kaliop/oidc-sample-provider.git && cd oidc-sample-provider

Fetch the start tag to get the boostrap:

git checkout start

Install main depencencies:

npm install

Start the application:

npm start

Go to http://localhost:4000

Step 1: init userAuthorize endpoint

checkout step-01

Check if all the required request parameters are present with good values:

• response_type: must be equal to "code".

• scope: specifies which user data the service requires.
  Space delimited list of keywords ('openid', 'profile', 'email', 'address', 'phone'). At least "openid" is required. The other are optional.

• client_id: must be found in the knwon allowed clients list (see default config file)

• redirect_uri: must match the configured redirect_uri for the client.

Step 2: Redirect to loginCallback

checkout step-02

Generate a callback redirection with following parameters, according to specifications:

• code: random value
• state: value of state parameter from input request, if present.

Step 3: init Token Endpoint

checkout step-03

Initiate the Token Endpoint:

• check the mandatory parameters
• return a JSON object

Step 4: Token Endpoint - validate code and return token data

checkout step-04

• use a dummy key/value in-memory storage service (use it only for tutorial purpose !) to share some data between the user session and the Access Token Endpoint.
• generate a random "access_token" value and store it as key with UserInfo as value.
• generate a random "code" value and store it as key with {access_token, id_token} as value.

Step 5: generate a valid ID Token

checkout step-05

The ID Token must be a valid JWT that follows OIDC ID Token specifications. We use nJwt library to generate it.

Step 6: UserInfo Endpoint

checkout step-06

Fetch the user info that are stored within the in-memory storage, related to the request's access_token header.

Step 7: Consent form

checkout step-07

Step 8: update consents

checkout step-08

Step 9: Logout propagation

checkout step-09

Implement the logout propagation (see RP-Initiated Logout):

Resources

• Demo OpenID Connect identity client
• OpenID Connect Official Specifications
• OpenID Connect Official Basic Guide
• JSON Web Tokens
• Unofficial documentation
• List of certified OpenID Connect libraries