oauth-io / oauthd

oauthd - The OAuth Daemon is the open source version of the OAuth.io core

oauthd, also known as the 'oauth Daemon' is the open source version of OAuth.io's core.

What is it?

It is a solution based on node.js that enables you to set up and run your own stand-alone, completly free, web Background API Server.

Main features

This server will allows you to authenticate and to integrate the common API providers, with just three lines of JavaScript, completely abstracting away the complexity of OAuth integration. By using the oauth Daemon, you are free to focus your attention on product development instead of losing time on API integration using OAuth.

Exhaustive: compatible with 100+ providers

oauthd works with all your favorite platforms, whether social (Facebook, Twitter, LinkedIn...) or SaaS (Mailchimp, Paypal, Stripe...).

Simplified API calls

With oauthd, you can make API calls instead of dealing with complex OAuth flows. Abstract tokens with the 'Request API' and get user info in a unified way, no matter which provider you are using. The API also lets you perform CRUD actions on behalf of users.

Secured encrypted API

oauthd lets you choose an authorization flow that fits your needs (client-side or server-side). It secures providers API access with SSL encryption and allows you to specify domains/url restrictions for more security.

Integrate in less than 90 seconds

Through the oauthd default administration interface, you can start adding OAuth providers to your app and get a public key to start using these APIs right away.

Modular design

oauthd is highly extendable thanks to a plugin management system based on Git. Each plugin can brings its own layer of features. Anyone can create his own plugin and is free to share it with the Open Source Community. We are eager to see you contribute!

Default plugins are furnished to ensure a working minimum environment, with:

• The request system plugin
• The '/me' feature plugin
• The default auth plugin, which lets you administrate oauthd
• The default back office front plugin, which lets you manage apps, providers and access to other plugins' configuration from the browser

You can learn more about plugins development here.

Installation

Currently, oauthd relies on node.js, npm, redis and the npm package grunt-cli to work. Check out our quickstart tutorial to bootstrap your oauthd server.

As soon as you are done with pre-requisites, you can simply install oauthd from npm, by executing the following command:

(sudo) npm install -g oauthd

Once you've installed the oauthd npm package globally, you will have the oauthd command available in your shell. This command allows you to create new oauthd instances, start them, and manage their plugins.

Learn more about the oauthd configuration and the command line features.

There is also a Docker container for oauthd if you want to try running oauthd inside a VM: Docker hub repository.

Usage

You can use the oauthd server from you app directly through the API or use one of our SDKs:

Client side SDKs

• JavaScript
• iOS
• Phonegap
• Android

Server side SDKs

• Nodejs
• PHP
• Go

Learn more about the oauthd apis and the oauthd-sdks.

Contact

Have a question?

• Drop an email at [email protected]
• @OAuth_io on Twitter

Contributing to this project

Anyone and everyone is welcome to contribute. Please take a moment to review the guidelines for contributing.

• Bug reports
• Feature requests
• Pull requests

License & Copyright

Copyright (C) 2017 Webshell SAS https://github.com/oauth-io/oauthd and other contributors

Licensed under the Apache License 2.0

oauthd's Issues

/usr/local/bin/oauthd: line 7: node: command not found

While trying to run oauthd start I get that error...

In the bash script it has the following line:

oauthdurl=node -e 'var c=require("./lib/config");console.log("http://127.0.0.1:"+c.port+c.base)'

So what is the reason to still reference node instead of nodejs? Should everyone install the nodejs-legacy package?

[$]> sudo apt-get install nodejs-legacy

http://askubuntu.com/questions/235655/node-js-conflicts-sbin-node-vs-usr-bin-node
http://stackoverflow.com/questions/21168141/can-not-install-packages-using-node-package-manager-in-ubuntu/21171188

Use provider's "name" instead of filename

It seems the frontend uses filename instead of "name" in the providers JSON configuration.

e.g. mailchimp.json: "name": "MailChimp", and we see Mailchimp.

I'm non nodejs developer. Haven't studied the code. It looks like so. Using "name" field can give better capitalization.

Error on npm install (node-waf: not found)

Hello, there is an error with the latest version of nodejs. If I run npm install I got the following error.

$ npm install
npm WARN package.json [email protected] Invalid filename in 'files' list: 

> [email protected] preinstall /home/lindsey/projects/js/oauthd/node_modules/zlib
> node-waf clean || true; node-waf configure build

sh: 1: node-waf: not found
sh: 1: node-waf: not found
npm ERR! [email protected] preinstall: `node-waf clean || true; node-waf configure build`
npm ERR! Exit status 127
npm ERR! 
npm ERR! Failed at the [email protected] preinstall script.
npm ERR! This is most likely a problem with the zlib package,
npm ERR! not with npm itself.
npm ERR! Tell the author that this fails on your system:
npm ERR!     node-waf clean || true; node-waf configure build
npm ERR! You can get their info via:
npm ERR!     npm owner ls zlib
npm ERR! There is likely additional logging output above.

npm ERR! System Linux 3.14-9.dmz.1-liquorix-amd64
npm ERR! command "/usr/local/bin/node" "/usr/local/bin/npm" "install"
npm ERR! cwd /home/lindsey/projects/js/oauthd
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.14
npm ERR! code ELIFECYCLE
npm ERR! 
npm ERR! Additional logging details can be found in:
npm ERR!     /home/lindsey/projects/js/oauthd/npm-debug.log
npm ERR! not ok code 0
lindsey@unknown:~/projects/js/oauthd$ npm install
npm WARN package.json [email protected] Invalid filename in 'files' list: 
npm WARN prefer global [email protected] should be installed with -g

After some research I found a solution. Zlib is not needed because node have their own zlib included.

If I remove the zlib from the dependencies in packages.json, everything works fine.

Tested with
Debian Wheezy
Nodejs: v0.10.29

I've don't know it issue occur on other versions.

how do i add more custom providers?

i tried to add another provider but it is not showing up in the providers list in the admin console. are there any instructions on how to add additional providers?

i just test

i just test

Provider Request: App.net

Can you please add support for App.net's OAuth services.

missing /auth route

Seems like the library is pretty far behind with the production version,

• oauth.js
• http://localhost:6284/auth//me is missing

and many other miscellaneous bugs that I can't reproduce on oauth.io, a few pull requests remain open with no comment for a long time. Is this project still active? Any chance you guys can sync this awesome library with what you have in-house?

404 errors of static assets with SSL

Just setup with SSL, when I visit though I just see:

Looking at Chrome developer tools I am setting:

GET https://auth.mydomain.com/js/app.js 404 (Not Found) admin:18
Uncaught Error: No module: oauth angular.js:1124
GET https://auth.mydomain.com/css/main.css 404 (Not Found)

Humm, seems static assets are not being served. Any ideas?

Client ID and secret did not authenticate @ first login

I tried oautd first time a couple of days ago, and this problem was not there.
But today, I started over with the current version, and I am now getting "Client ID and secret did not authenticate." when trying to write the username/password for the first time.

I have tried to clear redis, and am using a default configuration.
I am accessing it through nginx, but there is no changes to my nginx configs, so that shoulnt have anything to say.

The request that is done when I try to click the login button is a POST which I am getting a 403 back from.
The request payload is {"grant_type":"client_credentials"}, and the response I'm getting is: {"error":"invalid_client","error_description":"Client ID and secret did not authenticate."}.

Add config.js option for bind address

Add config.js option to set the local bind address instead of using 0.0.0.0.

Using OAuth.io within a Chrome Extension

Hi,

I am currently trying to use OAuth.io (Using the Stackoverflow provider) into a Chrome Extension. Note:

• It is a BrowserAction type extension. And the place where I try to get authorisation from the user is the Popup page.
• I am using OAuth.io with the standard oauth.js library via the popup method.

It almost go through the entire process but, unfortunately, the window can't send back the token to the opener.
Therefore, the callback in the Javascript code is never called and it's impossible to make further API calls.

I am afraid that there will be no other possibility than using, one way or another, the specific methods provided by Google to send message across windows/tabs. As suggested and documented here:

• http://stackoverflow.com/questions/11812786/window-open-returns-undefined-in-chrome-extension
• http://developer.chrome.com/extensions/messaging.html

And I am under the impression that this kind of modifications will require commit into oauthd as well as oauth-js.

Can you tell me if there is already existing solutions to avoid this issue? And if not, do you think it would be reasonable work to provide a specific solution in order to develop a Chrome Extension?

Thank you.

Aurélien

Self Signed Cert

Hello,

I'm trying to test this in my dev environment and I have a self signed certificate. I'm getting the following error:

DEPTH_ZERO_SELF_SIGNED_CERT {
  "body": {
    "stack": [
      "Error: DEPTH_ZERO_SELF_SIGNED_CERT",
      "    at SecurePair.<anonymous> (tls.js:1370:32)",
      "    at SecurePair.EventEmitter.emit (events.js:92:17)",
      "    at SecurePair.maybeInitFinished (tls.js:982:10)",
      "    at CleartextStream.read [as _read] (tls.js:469:13)",
      "    at CleartextStream.Readable.read (_stream_readable.js:320:10)",
      "    at EncryptedStream.write [as _write] (tls.js:366:25)",
      "    at doWrite (_stream_writable.js:226:10)",
      "    at writeOrBuffer (_stream_writable.js:216:5)",
      "    at EncryptedStream.Writable.write (_stream_writable.js:183:11)",
      "    at write (_stream_readable.js:583:24)",
      "    at flow (_stream_readable.js:592:7)",
      "    at Socket.pipeOnReadable (_stream_readable.js:624:5)"
    ]
  }
}

Where do I specify the option to allow self signed certs?

Flickr API example

I saw the Facebook example, but am having issues getting Flickr API calls to work. Anything I'm doing wrong? It seems to be ignoring the "method" param.

OAuth.initialize('MYKEY');
OAuth.popup("flickr", function(err, r) {
      r.get("/services/rest/",
              {
                data: {
                  method: 'flickr.photos.search',
                  tags: 'mytag',
                  format: 'json',
                  nojsoncallback: 1
                }
              }).done(function(data) {
        console.log('JSON REPLY');
        console.log(data);
      });
    });

Spotify and Rdio API

Will these provider's api be available sooner or later? :D

I did not looked at their API documentation so i don't know if they serves oAuth API, so if not please just close the issue ,

thanks!

In the case of MediaWiki's OAuth Extension; Configuring a provider in request_token when the key is part of the body

While attempting to configure MediaWiki's OAuth Extension (OAuth v1.0a).

I wanted to create the provider, but it turns out that the current model to create a provider (at least what I understand of it) is either not supporting the implementation details of MediaWiki OAuth extension, or I'm missing something.

My question is, due to those limitations, how can I configure in oauthd? Is it possible?

Extension implementation details

1. Extension uses OAuth 1.0

   Note: most of my attempts were made through a shell script that shows how to use the extension and it might be much helpful to see the implementation details.

2. base url HAS to be in the form 'http://mediawikihost/w/index.php?title=Special:OAuth' (as in, must have index.php (known Caveat).

   Quoting, in Extension:OAuth: When constructing your url, use /w/index.php?title=Special:OAuth/initiate instead of /wiki/Special:OAuth/initiate, because MediaWiki Extension will silently creates in the index.php?title=Special:OAuth/initiate format and therefore makes the hash invalid.

   url in provider conf.json therefore has to have this format. I guess that when you append request_token {Request-Object} parameters to it, it would create a different address to call, right?

3. The key given by MediaWiki is within the body of the response, in the following format:

   {"key":"OAUTH_VERIFIER_VALUE","secret":"SECRET","oauth_callback_confirmed":"true"}
   

   And the extension requires that you request your token with oauth_callback set to oob (i.e. "Out Of Band"), see Endpoint samples below.

Endpoint samples:

• request_token:

      https://mediawikihost/w/index.php?title=Special:OAuth/initiate&format=json&oauth_callback=oob` 
  

  OAUTH_VERIFIER_VALUE is inside the body of the content (i.e. out of band). They also require that oauth_callback=oob; oob is for Out Of Band, it is not a random string.

• access_token:

       https://mediawikihost/w/index.php?format=json&oauth_consumer_key=....&oauth_nonce=....&oauth_signature=....&oauth_signature_method=....&oauth_timestamp=....&oauth_token=....&oauth_verifier=OAUTH_VERIFIER_VALUE&oauth_version=1.0&title=Special%3AOAuth%2Ftoken`
  

• authorize:

      https://mediawikihost/w/index.php?title=Special:OAuth/authorize&oauth_token=....&oauth_consumer_key=...
  

Attempt to create a provider

I understand that I could configure oauth1 members (e.g. "request_token" with a few keys based on (url, parameters, etc) but
Here is what I ended up trying:

{
        "name": "MediaWiki instance",
        "desc": "TODO",
        "url": "https://mediawikihost/w/index.php?title=Special:OAuth",
        "oauth1": {
                "request_token": "/initiate&format=json&oauth_callback=oob",
                "authorize": "/authorize&format=json",
                "access_token": "/token&format=json"
        },
        "href": {
                "keys": "https://mediawikihost/wiki/Special:OAuthConsumerRegistration/propose",
                "docs": "http://mediawikihost/#docpage-todo",
                "apps": "http://mediawikihost/#appspage-todo",
                "provider": "http://mediawikihost/#providerpage-todo"
        }
}

oauthd ignores refresh_token

Hello I want to use oauthd with a custom provider. My provider is really straight forward.

Here is the relevant part

"oauth2": {
    "authorize": "/auth",
    "access_token": "/token",
    "request": {
        "url": "http://localhost:8000/api",
        "cors": true,
        "query": {
            "access_token": "{{token}}"
        }
    },
    "refresh": "/token",
    "parameters": {
        "client_secret": "string",
        "client_id": "string",
        "scope": {
        }
    }
}

The Response type of my provider is Client-side (token)
The auth process and the client implementation works greate. But after 30 mins the access_token is invalid and I've to login again.
I used also my provider in the admin interface of oauthd and a I saw the following result is.

{
  "access_token": "NWRhZDUwODlhOTZmNTcxOTI3MzA1NzJjMjg2MDEyNGRmNTZiYzNlOWM3ZTRhZDM2Y2IzOWVkMGE3MTZhOWFjMQ",
  "token_type": "bearer",
  "expires_in": 3600
}

But my original response is

{
  "access_token": "NWRhZDUwODlhOTZmNTcxOTI3MzA1NzJjMjg2MDEyNGRmNTZiYzNlOWM3ZTRhZDM2Y2IzOWVkMGE3MTZhOWFjMQ",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "xxxx"
}

Why ignores oauthd my refresh_token? What is the trick to use the refresh token? My OAuthServer is setup correctly I use it with more client apps.

At the documentation I didn't found anything about refresh_token. Does oauthd really support or can handle refresh_tokens?

Thanks for help

Error: Origin "http://localhost" does not match any registered domain/url

Hi,

I setup OAuthd on a dedicated server and changed oauthio.com domains to that server domain on my mobile app (that's developed with PhoneGap (Cordova)).

When i try to login with Twitter it gives me that error:

Error: Origin "http://localhost" does not match any registered domain/url on oath.xxx.com

What should i need to do?

Testing

I need to test the OAuth2 Refresh code and the OAuth2 server-side Request code.

The server-side Request is being done automatically for OAuth1 providers. How to force it for OAuth2 providers?

Withings conf has wrong href.keys value

Che current config in the file provides/withings/conf.json has a wrong href.key value

{
    ...
    "href": {
        "keys": "https://dev.twitter.com/apps/new",
        "docs": "https://oauth.withings.com/partner/add",
        "apps": "https://oauth.withings.com/partner/dashboard",
        "provider": "https://www.withings.com"
    }
}

twitter / google plus - me request Not Found response?

I keep getting Not Found for the me request from twitter and google plus. how should i load user data after getting the token via server side through twitter and google plus? Facebook is working perfectly...

Reference to /me equivalent for each provider

Can we get an easy reference to the /me equivalent endpoint for each provider as part of the OAuth.io RESTful API and/or Javascript API?

In the RESTful API, it could be an additional entry under "oauth1".

{
    "status": "success",
    "data": {
        "url": "https://api.twitter.com/oauth",
        "oauth1": {
            "request_token": "/request_token",
            "authorize": "/authenticate",
            "access_token": "/access_token",
--->        "me","/1.1/account/verify_credentials.json",
            "parameters": {
                "client_secret": "string",
                "client_id": "string"
            }
        },
        "href": {
            "keys": "https://dev.twitter.com/apps/new",
            "docs": "https://dev.twitter.com/docs",
            "apps": "https://dev.twitter.com/apps",
            "provider": "https://www.twitter.com/"
        },
        "name": "Twitter",
        "provider": "twitter"
    }
}

I see that the /me endpoint reference is already in /providers/{provider}/settings.json as a sample API call. Is that exposed somewhere? I also see references to me() in aad1645 but not clear how that should be used. (And it's not available in the latest release yet, so I wasn't sure if it was all ready yet or not.)

Ideally I'd like to do something like this simplified example:

OAuth.popup(provider, function(err, res){
   console.log(res.me().name);
});

(And I guess a related question is whether or not all/most providers have some common return values such as 'name'/'email' that can be used without having to care which provider was authenticated against.)

Getting this to work on Heroku?

Hi!
I'm wanting to deploy this to Heroku and have done the following:

a. Used the Grunt buildpack
b. Added grunt, grunt-cli, grunt-concurrent, grunt-nodemon, forever and coffee-script to the main deps in package.json
c. Changed references to the app's port in config.js to (process.env.PORT || 6248) (As per here)
d. Removed the line to grunt on install (The buildpack runs grunt after anyway)
e. Added grunt.registerTask('heroku:', gruntConf.taskDefault); to Gruntfile.js
f. Added a Procfile with: "web: npm start"

At this point, it compiles fine and deploys to Heroku without issue. However, when I try to access it, it times out and I get this error:

2014-01-29T12:02:47+00:00 heroku[slug-compiler]: Slug compilation finished
2014-01-29T12:02:48.735753+00:00 heroku[web.1]: State changed from crashed to starting
2014-01-29T12:03:10.972916+00:00 heroku[web.1]: Starting process with command `npm start`
2014-01-29T12:03:13.008623+00:00 app[web.1]: > [email protected] start /app
2014-01-29T12:03:13.008615+00:00 app[web.1]: 
2014-01-29T12:03:13.008627+00:00 app[web.1]: 
2014-01-29T12:03:13.008626+00:00 app[web.1]: > forever --minUptime 1000 --spinSleepTime 1000 -a -l forever.log -o out.log -e err.log start lib/oauthd.js
2014-01-29T12:03:13.897618+00:00 app[web.1]: info:    Forever processing file: lib/oauthd.js
2014-01-29T12:03:16.150362+00:00 heroku[web.1]: Process exited with status 0
2014-01-29T12:03:16.174101+00:00 heroku[web.1]: State changed from starting to crashed
2014-01-29T12:03:17.606146+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path=/ host=tnl-oauth.herokuapp.com request_id=7289b173-7628-4606-a9ba-40289c4a46f2 fwd="143.252.80.100" dyno= connect= service= status=503 bytes=

If I change the Procfile to "web: grunt server", I get:

2014-01-29T12:08:44.333537+00:00 app[web.1]: Running "watch" task
2014-01-29T12:09:39.869515+00:00 heroku[web.1]: Stopping process with SIGKILL
2014-01-29T12:09:39.869254+00:00 heroku[web.1]: Error R10 (Boot timeout) -> Web process failed to bind to $PORT within 60 seconds of launch
2014-01-29T12:09:41.334061+00:00 heroku[web.1]: Process exited with status 137
2014-01-29T12:09:41.354141+00:00 heroku[web.1]: State changed from starting to crashed
2014-01-29T12:17:23.317571+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path=/ host=tnl-oauth.herokuapp.com request_id=1472be24-abd7-4508-b09e-6193b3fc43e1 fwd="143.252.80.100" dyno= connect= service= status=503 bytes=

Debug mode is on as per config.js, by the way.

Any help? It's not critical that I deploy to Heroku, I'm just curious whether it's possible.

500 Server Error with Google Plus and Twitter

This request gives back 500 error only. Nothing in the error log. Facebook is working fine.
Also, this request is made after getting the token, so i don't think it's my fault.
http://mydomain.com:6284/request/google_plus/plus/v1/people/me/people/visible?t=0

Here is my code:

    doGoogle: function(url) {
        this.googlePaginationUrl = url ? url : '/plus/v1/people/me/people/visible';
        OAuth.popup('google_plus', $.proxy(this.doGoogleHandler, this));
    },

    doGoogleHandler: function(err, res) {
        if (err){
            console.log(err);
            return false;
        }

        // This is the point where it tries to get the URL and the server throws 500 error
        res.get(this.googlePaginationUrl).done($.proxy(this.doGoogleSuccess, this));
    },

UPDATE:
It turns out i'm also having the same exact issue with twitter, even with the example code mentioned in the blog:

    res.get('/1.1/account/verify_credentials.json').done(function(data) {
        console.log(data)
        alert('Hello ' + data.name)
    });

Initial admin signin fails, just 302's back with no error

After a brand new install, if you try and sign in for the first time to /admin using a password shorter than 6 characters, you get no error message, and it is very confusing until you check the source code. I was using a one letter password (i'm just testing locally!)

Solution: don't have a password minimum length, or warn people that they need a longer password, so it doesn't appear to be silently failing.

Just installed a fresh version, still the localhost doesnt work

Commands I used:

git clone git://github.com/oauth-io/oauthd.git
cd oauthd
sudo /opt/node/bin/npm install -g coffee-script grunt grunt-cli forever
npm install
npm start

-- No localhost server started. This is what npm start shows:

$ npm start

[email protected] start /tmp/oauthd
forever -c coffee --minUptime 1000 --spinSleepTime 1000 -a -l forever.log -o out.log -e err.log start lib/oauthd.coffee

info: Forever processing file: lib/oauthd.coffee

---

Any ideas what I am doing wrong?

Is there a reason dropbox uses OAuth1 instead of OAuth2?

Can I submit a pull request where the oauth2 information is in addition to the oauth1 or should the oauth1 info be replaced?

Thanks!

Provider Request: Xing

Xing is a LinkedIn competitor who is market leader in all German speaking countries.
It uses OAuth 1.0
https://dev.xing.com/docs/authentication

Optimize providers icons

Use CSS sprite on prod instead of tons of separate images. It can be done at the deployment with node-spritesheet.

Please do not send spam

Today I got an email from you:

"Hi,

I got your email through Github: I saw that you have starred Bootstrap. We launched a project not very long ago, called OAuth.io: http://oauth.io

This service allows you to integrate any OAuth provider, from Facebook to Mailchimp, in just 2 minutes. An API also lets you retrieve profile info and perform actions on behalf of the users. You literally save hours or days of work.

I'd be very curious to get your feedback about it. Basic use is free but don't hesitate if you need a coupon.

Cherry on top, we also have an Open Source version: https://github.com/oauth-io/oauthd

Thanks in advance,

Best,"

What does bootstrap and oauth.io have in common to send such emails? Please stop this.

There is no contact information on your website, so this is the only fast way to contact you without searching.

app.js and main.css not found

After installing and run the service, browser report cant found app.js and main.css. landing page only show logo and signout link.

Problem with base path

There are some problems configuring and using 'base' in the config.js file.
I'm not a coffee-script guru, but this is what I found.

When setting base: "/oauthd" in config.js, I would thing that this would make me use oauthd from my.domain.com/oauthd/. So that the admin panel would be located at my.domain.com/oauthd/admin/ and I could use nginx as a reverse proxy to present my /oauthd/ location.

However, setting the base config parameter wont do anything, everything acts the same way.

I put a 'console.log config' line in the buttom of the lib/config.coffee file, and saw this in out.log:
{ ...
base: '',
...
relbase: '/oauthd',
...
}

So my base is resat somehow..

In config.coffee, I commented out the line that is resetting my base parameter, like:
config.base = Path.resolve '/', config.base
config.relbase = config.base

config.base = '' if config.base = '/'

config.url = Url.parse config.host_url

and it kinda did the trick. But why? config.base is not '/'.... config.relbase sais it is /oauthd. (as said, I dont know coffee script, but is this syntax right?).

When commenting out that line, I was able to access the page via /oauthd/admin/, but all the css wasn’t loading. So there is several problems here..

Is this supposed to work? What is the point with the base config?

I have also tried to set the host_url, but that doesn’t do it either..

I can find no documentation on this, but I am happy to write some if someone can explain what is happening here, or if this is a bug? How should it behave?

problems logging in /admin

I've set this server up for the first time and it requires an email and password. I'm assuming my own. I enter these and it asks again and again. Is there a method for reseting these? help please :(

oauthd start is failing with no logs

I have installed redis, nodejs, & npm (with python, bash and curl). Redis is running, and I sudo npm install -g forever oauthd and it runs through the installation properly (or at least from the look of it).

Then when I try to sudo oauthd start, I get:
Starting OAuth daemon........... Failed

I wanted to take a look at what was going on, so I searched for 'out.log', 'err.log' & 'forever.log', and none of them exist. I had this working on another box previously, so I am really confused as to what is going on.

Can anyone give me some pointers on things to check or how to get the logs working so I can follow through on this setup?

Much appreciated in advance & thank you oauth-io team for this!
Best,
JJ

How to use OAuth.redirect with AngularJS?

How to use OAuth.redirect type authentication with AngularJS? The problem is, that breaks routing AngularJS.

undefined callback when object isn't instantiated.

need to rearrange the order to ensure callback is defined.

Twitter problems + google problems

I tried with Google next, and everything works except at the last page. (After "Accept" on google page)

Redirect URIs: http://localhost:6284/
JavaScript origins: https://localhost:5000/

I had selected scope = email.

Error =
OAuth.redirect url must NOT be "localhost:6284"

For my twitter problems, please see the closed ticket on twitter.

Missing OAuth.io public key.

Encounter this error when attempting to authenticate.

Error: Cannot find module 'restify-oauth2-private'

Trying to install on CentOS 6.3 x64, with node.js v0.10.8 and did the following steps:

sudo npm install -g coffee-script grunt grunt-cli forever
npm install oauthd
cd node_modules/oauthd 

//changed host_url to http://node1.mydomain.com:8080 and port to 8080.

npm start

The following is logged in the err.log:

Error: Cannot find module 'restify-oauth2-private'
at Function.Module._resolveFilename (module.js:338:15)
at Function.Module._load (module.js:280:25)
at Module.require (module.js:364:17)
at require (module.js:380:17)
at Object.<anonymous> (/srv/oauthd/plugins/server.admin.auth/server_admin_auth.coffee:19:1, <js>:8:19)
at Object.<anonymous> (/srv/oauthd/plugins/server.admin.auth/server_admin_auth.coffee:17:1, <js>:171:4)
at Module._compile (module.js:456:26)
at Object.loadFile (/usr/local/lib/node_modules/coffee-script/lib/coffee-script/coffee-script.js:182:19)
at Module.load (/usr/local/lib/node_modules/coffee-script/lib/coffee-script/coffee-script.js:211:36)
at Function.Module._load (module.js:312:12)
at Module.require (module.js:364:17)
at require (module.js:380:17)
at Object.exports.load (/srv/oauthd/lib/plugins.coffee:34:19, <js>:32:14)
at Object.exports.init (/srv/oauthd/lib/plugins.coffee:39:10, <js>:42:29)
at Object.<anonymous> (/srv/oauthd/lib/oauthd.coffee:23:8, <js>:12:11)
at Object.<anonymous> (/srv/oauthd/lib/oauthd.coffee:17:1, <js>:26:4)
at Module._compile (module.js:456:26

userId in OAuth response

Hi,

I am currently experimenting with OAuth.io and I find it great so far !

Nevertheless, I have a question/feature request. Currently, the flow in my application
looks like this.

• User logs in via OAuth
• I get the access_token
• I do a 'me' call to get the provider userId
• I send the access_token and the provider userId to the server
• The server can find the user with the provider userId and store the access_token
  for when we need to get the friends asynchronously server-side etc...

Since we are on mobile, we want to cut down requests as much as possible. I thought that it would be more straightforward and would remove a request if I had not
to do this 'me' call from the client side. I see from the facebook doc that the oauthResponse contains the userID. Why does OAuth.io removes it from the response I get ? Would it be possible to include it in the response ?

I would be happy to make a pull request if you think it is a good idea.

Thanks a lot !

Patrick Browne

oauth.js doesn't regenerate oauthd_url

:6284/download/latest/oauth.js file has wrong config for oauthd_url. I changed it in the config.local.js file to be a different url. do i have to manually change this variable in the js file?

var config = { oauthd_url: 'http://localhost:6284', oauthd_api: '/api', version: 'web-0.1.7', options: {} };

oauth.js malformed URL

URL is missing a slash.

load over https?

I need to load the file via https. Is there a way to configure that to work?

https://localhost:6284/download/latest/oauth.js

Dockerfile

This would be great: docker run -d oauth-io/oauthd

Behind nginx proxy

Hi,
I've installed the oauthd node application inside a docker container that exposes the application on port 6284 (the binding address inside the container is 0.0.0.0 but from outside is 127.0.0.1).

Anyway in front of localhost:6284 I'm using nginx to reverse proxying my external url (<domain_name>) to that ip:port.

My problem is, after login phase, it loads an url like <domain_name>/<domain_name>/admin/keymanagerand after logout click I see a redirect loop that appends the <domain_name>.

The config.js is:

module.exports = {
        host_url: '<domain_name>',
        base: "/",                                         // add a base url path. e.g: "/auth"
        base_api: "/api",                              // api base path
        port: 6284,
        bind: '0.0.0.0',

        debug: false,                                                   // add stack trace & infos in errors

        /* uncomment to use ssl
        ssl: {
                key: '/path/to/key',
                certificate: '/path/to/crt',
                ca: '/path/to/ca'
        },
        */

        staticsalt: 'GHb4t8Q7BH1S4gQO6grPxaJXoVmwZtRu', <--- randomly generated
        publicsalt: 'wxTZbM7wV1mzicT5XjOHVJPIB0ScnMSy', <--- randomly generated

        redis: {
                port: 6379,
                host: '127.0.0.1',
                // password: '...my redis password...',
                // database: ...0~15...
                // options: {...other options...}
        },

        plugins: [
                'server.statistics',
                'server.admin.auth',
                'server.request',
                'server.admin'
        ]
}
if (require('fs').existsSync(__dirname + '/config.local.js')) {
        var override = require('./config.local.js');
        for (var i in override)
                module.exports[i] = override[i];
}

If I rewrite the url after login removing a <domain_name> I'm in the console and I also saw that the logout process is done correctly.
Is there something that I misunderstood? Is there any guideline that I'm missing to reverse proxy oauthd?

Thanks,
Dario.

P.S.
Just for a matter of completeness this is the Dockerfile that describe the installation and configuration process.

Timeout in a Twitter popup leads to a dead-end

Hello, appreciating the effort put into your product so far. I think I found a bug with the backend that would make taking advantage of your library in a robust way a bit difficult.

Issue: Opening a Twitter popup, letting the popup expire and pressing "Authorize app" will yield a white page with the text

Invalid format
state: invalid or expired

and no way to exit the flow, as I was using the Phonegap plugin. I would have expected for the popup to have cleared and to have gotten back an error in the callback to OAuth.popup instead.

Any additional details I can provide?

Thanks in advance,
Eevert

Origin does not match any registered domain/url

Origin "https://andrew.domain.com/apps/app/" does not match any registered domain/url on andrew.domain.com:6284"

What does this mean?

URLs not updating when adding connection to service.

This should update to the data from the config:

Oauth.io does not work in iOS Chrome

Steps to reproduce:

1. Visit - https://oauth.io/ on iOS Chrome
2. Press "Try it"
3. See popup open and close
4. Nothing happens

Expected to see greetings with my name from Facebook

I traced that issue could be that popup does not have window.opener property defined and can not postMessage (https://github.com/oauth-io/oauthd/blob/master/lib/server.coffee#L211) Though I can not confirm if that is 100% true, but I'm pretty sure that popup method (https://github.com/oauth-io/oauthd/blob/master/app/js/oauth.js#L162) works fine, it setups message event listeners and opens popup window, allowing me to enter my Facebook credentials and that's it.

Did anybody came onto this?

When running test: Fatal error: listen EADDRINUSE

Not sure what the cause here is. If I change the port oauthd runs on, it doesn't remove the error. Are there other places a port is set that I need to change?

Server-side response type does not work

When I try to authenticate to a service (any service) with a server-side response type instead of a client one, I get the following error: You must provide a state when server-side auth.

I looked around the code in app/js/oauth.js and it looks like it auto-generates a state if one is not provided, but somehow this state is not passed on to the request.

Any idea what's happening here?