cacert/oidc-parent
9
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
OpenID Connect parent repository for local development
31 commits 1 branch 0 tags 101 KiB
Jinja 79.2%
Makefile 20.8%
Find a file
Jan Dittberner 4023cfc718 Update to Debian 12 Bookworm 
- improve README.md add test scenarios
- update Vagrant setup to Debian 12
- update dependency installation to be compatible with Debian 12
- use mkcert from Debian 12 package
2023-06-19 19:46:25 +02:00
cacert_resources@28347cb3df Update cacert_resources ref commit 2023-06-19 18:30:10 +02:00
deployment Update to Debian 12 Bookworm 2023-06-19 19:46:25 +02:00
hydra_config@4d3f908958 Reference new hydra_config commit 2022-08-09 18:20:30 +02:00
oidc_app@f980c1acc3 Update submodule versions 2022-11-21 17:15:10 +01:00
oidc_idp@9fad7ef3a6 Update oidc_idp reference commit 2023-05-15 16:48:05 +02:00
oidc_registration@be9006546d Add Makefile based build process 2022-08-17 20:30:03 +02:00
.gitignore Add local preconditions and Vagrantfile 2022-08-18 11:58:24 +02:00
.gitmodules Switch submodule URLs to code.cacert.org 2022-07-28 18:03:06 +02:00
Makefile Add Makefile based build process 2022-08-17 20:30:03 +02:00
README.md Update to Debian 12 Bookworm 2023-06-19 19:46:25 +02:00
Vagrantfile Update to Debian 12 Bookworm 2023-06-19 19:46:25 +02:00

README.md

CAcert OpenID connect parent project

This repository references several repositories for the CAcert OpenID connect setup.

Clone the repository

git clone --recurse-submodules https://code.cacert.org/cacert/oidc-parent.git
cd oidc-parent
# cause pull, fetch and other git commands to consider submodules
git config submodule.recurse true

Get started

Make sure you have the necessary prerequisites installed (tested on Debian 12 Bookworm) and ~/.local/bin in your $PATH variable:

sudo apt update
sudo apt install make mkcert python3-pip python3-venv golang-go yarnpkg
mkdir -p $HOME/.local/share/virtualenvs ~/.local/bin
python3 -m venv $HOME/.local/share/virtualenvs/ansible
$HOME/.local/share/virtualenvs/ansible/bin/pip install ansible
ln -s $HOME/.local/share/virtualenvs/ansible/bin/ansible* $HOME/.local/bin/
export PATH=$HOME/.local/bin:$PATH

Note: It is a good idea to put the PATH export line into your .bashrc or .zshenv.

Build the applications

Use make to build the web app resources and applications:

go install github.com/nicksnyder/go-i18n/v2/goi18n@latest
make

Deployment options

There are two deployment options for the Hydra server and for the custom applications:

  1. local deployment
  2. Vagrant deployment

You only need one of these options.

Both options use ansible to:

  • setup the Hydra authorization server
  • setup IDP (provides login and consent screens)
  • setup demo application
  • setup OpenID Connect client registration application

Local deployment

Use ansible-playbook to deploy Hydra, IDP, Client registration and the demo application:

cd deployment
ansible-playbook 01_install_cacert_oidc.yml

Note: If ansible-playbook fails early in the process with "sudo: a password is required," then confirm that your user has sudo privileges and execute that command like

ansible-playbook -K 01_install_cacert_oidc.yml

Vagrant setup

You can also use Vagrant with the libvirt-provider. The included Vagrantfile is configured to apply the ansible-playbook to the Vagrant managed virtual machine.

sudo apt install vagrant-libvirt virt-manager libvirt-clients
vagrant up
vagrant ssh -- cat .local/share/mkcert/rootCA.pem | sudo tee /usr/local/share/ca-certificates/mkcert-vagrant-oidc.crt
sudo update-ca-certificates

Note: You may also want to configure your browser to trust the CA certificate in /usr/local/share/ca-certificates/mkcert-vagrant-oidc.crt. If you do not add this trust configuration you will get browser warnings for an unknown certificate authority.

Testing your local setup

Test the authorization server

Request the OpenID connect auto discovery information from Hydra

curl https://hydra.cacert.localhost:4444/.well-known/openid-configuration | python3 -m json.tool

This should give you a JSON document with information about the authorization server.

Test the identity provider

Open https://login.cacert.localhost:3000/ this should ask you for a CAcert class 3 client certificate and should render a 404 page with a CAcert logo.