smembe812 / tiger-crunch

project tiger-crunch

Follows OpenID specs from https://openid.net/specs/openid-connect-core-1_0.html Draws dome inspiration from Curity https://oauth.tools/

Mono repo housing auth-server, user-service and clients-service apps/modules for tiger-crunch lab.

The main goal is to develop a server-> client-> end_user setup for future projects. Federated apps/services supported by custom SSO should stem from this tiger-crunch lab.

Front-end client to move to their own repo.

tiger-crunch's Issues

clients-service

The 'experimental' service already exists just needs to be production ready

• register client use-case & unit tests
• verify clients use-cases & unit tests
  • verify by registered project domain/url
  • verify by client_secret and client_id

Retrieve client on project domain and client_id when using proper database

Extends #4
DB query on verify_client_by_domain should retrieve client data based on their project domain and client id

• write unit tests for failure and success
• data-source should throw could not verify client on empty response
• method should throw invalid_request error on invalid client

Client authentification

• Basic auth with -> Authorization: Basic client_id:client_secret
• Bearer auth with -> Authorization: Bearer access_token

grant-types service

make OAuth, OID grant types service

• write use-cases module and their unit tests
  • implement code-flow
  • implement token-flow
  • implement implicit-flow
  • implement hybrid flow

Change Client.client_key to Client_secret

client_secret is a well adopted standard

ACL

design access -control schema for resources

Client should refresh token

• implement refresh token flow

Introduce "Person" as the abstract model for end users

Figure out how to make person the abstract class for end-users

complete OAuth flow and API-testing

extends #3

• code-flow
• token-flow
• implicit-flow
• hybrid-flow
• refresh-token

Cache tokens with LRU

• save token
• delete token when expired
  - [ ] delete token after a refresh

user-client scopes

extends #5
Design user/client scope in regards to resources' ACL
Builds on the ACL schema

distinct environment configurations for testing

need distinct environment configurations for testing and running in production

• implement Provider constructor issuer config

Client should only refresh the tokens they own

Client should only refresh the tokens they own

PKCE consideration on authorization_code

how to test PKCE-flow?