OpenID Connect Identity Provider (Login and Consent part) using client certificate authentication and ORY Hydra

Find a file

Jan Dittberner 679dcb27ce Adapt to Hydra 2.x - use new SDK package - add session to transport user information from login to consent		2023-08-03 23:51:57 +02:00
cmd/idp	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
debian	Run deb-systemd-helper in postinst	2023-07-29 21:19:15 +02:00
docs	Improve documentation and defaults	2023-07-24 21:32:28 +02:00
internal	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
translations	Enforce email address selection	2023-08-03 10:45:21 +02:00
ui	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
.gitignore	Add packaging configuration	2023-07-24 17:55:41 +02:00
.golangci.yml	Fix golangci-lint config	2023-07-29 22:00:53 +02:00
.goreleaser.yml	Add packaging configuration	2023-07-24 17:55:41 +02:00
changelog.md	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
go.mod	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
go.sum	Adapt to Hydra 2.x	2023-08-03 23:51:57 +02:00
LICENSE.txt	Add Apache License 2.0 text	2023-05-13 10:16:00 +02:00
Makefile	Add packaging configuration	2023-07-24 17:55:41 +02:00
README.md	Minor documentation and code improvements	2023-07-29 17:49:55 +02:00

README.md

CAcert OAuth2 / OpenID Connect IDP

This repository contains an implementation for an identity provider. ORY Hydra is used for the actual OAuth2 / OpenID Connect operations. The implementation in this repository provides the end user UI components that are required by Hydra to allow login and consent.

The code in this repository is licensed under the terms of the Apache License Version 2.0.

Setup

Certificates

You need a set of certificate and private key and a PEM file with CA certificates used to verify client certificates to run cacert-idp.

An easy way to generate server certificate and key for local testing is mkcert.

Run mkcert to generate idp.cacert.localhost+1.pem and idp.cacert.localhost+1-key.pem:
```
mkcert -cert-file idp.cacert.localhost login.cacert.localhost
```

Copy CA certificate for client certificates

(curl -s http://www.cacert.org/certs/CAcert_Class3Root_x14E228.crt ; \
 curl -s http://www.cacert.org/certs/root_X0F.crt ) > client_ca.pem

Configure IDP

The Identity Provider application (IDP) requires a strong random key for its CSRF cookie. You can generate such a key using the following openssl command:

openssl rand -base64 32

Use this value to create idp.toml:

[security]
csrf.key = "<32 bytes of base64 encoded data>"

Start

Now you can start the IDP:

make
go run cmd/idp.go

Translations

This application uses go-i18n for internationalization (i18n) support.

The translation workflow needs the go18n binary which can be installed via

go install github.com/nicksnyder/go-i18n/v2/goi18n

To extract new messages from the code run

goi18n extract .

Then use

goi18n merge active.*.toml

to create TOML files for translation as translate.<locale>.toml. After translating the messages run

goi18n merge active.*.toml translate.*.toml

to merge the messages back into the active translation files. To add a new language you need to add the language code to the languages configuration option (default is defined in the configmap in cmd/idp.go).