ulrikstrid / ocaml-oidc

OpenID Connect implementation in OCaml. Currently only the RP (client) parts are polished.

ocaml-oidc

OpenID connect implementation in OCaml.

Folder structure

ocaml-oidc
│
├─executable/  Entrypoint for a webserver/OIDC client
│
├─library/     Implementation for the webserver
│
├─oidc/        Core OIDC implementation
│
├─oidc-client/ OIDC Client implementation
│
├─test/        tests
│

Developing:

npm install -g esy redemon reenv
git clone <this-repo>
esy install
esy build

Running Binary:

After building the project, you can run the main binary that is produced. This will start a webserver with a OIDC client configured for certification.

esy start

Running Tests:

# Runs the "test" command in `package.json`.
esy test

ocaml-oidc's Issues

Fix documentation generation in the actions

Non-OIDC OAuth2 providers that this repo might be ported to work with

Looking through a list of OAuth providers on Wikipedia, I made a short list of "important" OAuth2 providers that it may be good to test this repo against/adapt it to. The information on Wikipedia might be out of date, the providers might be diverging from specs in various ways, so we might simply not do some of them initially. Also, some providers might have extensive additional mechanisms, and be OAuth2 only in the sense of being based on OAuth2, yet still not be OIDC. I am suspecting Instagram might have something like that (perhaps it uses Facebook Connect). So we would address each provider separately.

• Amazon
• BitBucket [2]
• Discord
• Dropbox
• GitHub
• Instagram
• PayPal
• Reddit
• Stack Exchange
• Stripe
• Twitch
• Twitter

If we work on this, I'll gradually edit this issue with links to auth API docs, etc.

Twitch OIDC returns scope in token as array

According to https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 the scope in token response should be a space separated list of scopes which ocaml-oidc expects.

Twitch OIDC implementation returns "scope": ["openid"] (also documented here).

I'm not sure what ocaml-oidc should do here — ignore, fail (like it does now) or try to parse an array — but just creating the issue to discuss and at least to document this behaviour.

Be safer by default

There are some parsing that is raising now, we should return results

OAuth2 example: the login flow is not CSRF-safe

In the OAuth2 example, it appears to be possible to trigger login without any user interaction by causing the user's browser to do a GET /auth on the app, since the handler does not check any cookies, CSRF tokens, etc.

The OAuth2 example does not use the state parameter

A state parameter that is somehow associated with the client's user agent (usually meaning, with a cookie) is necessary to protect the OAuth2 callback from CSRF-like attacks. The library code appears to support passing state around, but the example does not use state, and it does not appear to be pointed out in the library docs.

opam release

Are there any plans to do an opam release soon? Just asking — could still work around this downstream using my much-overused rename-and-vendor workflow.

SimpleClient misses `PATCH` which leads to type error when converting to COHTTP

As discussed on slack, oidc misses PATCH which leads to type error

Originally posted by @JulesGuesnon in https://github.com/marigold-dev/marigold-dashboard/pull/54#discussion_r969723105

Fix CI

Since I'm not using esy anymore I should move everything to nix so that CI will work correctly

Make the RP registration dynamic

To run everything in 1 go with e2e tests we need to be able to register via some GUI or API

Implement pp_hum functions