OpenID Connect registration management application to be used with ORY Hydra

Find a file

Jan Dittberner 0c88fb5447 Fix useless err parameter		2022-01-16 14:07:00 +01:00
cmd	Fix useless err parameter	2022-01-16 14:07:00 +01:00
handlers	Add initial project setup	2021-09-11 14:52:52 +02:00
services	Add initial project setup	2021-09-11 14:52:52 +02:00
templates	Add initial project setup	2021-09-11 14:52:52 +02:00
.gitignore	Add initial project setup	2021-09-11 14:52:52 +02:00
active.de.toml	Add initial project setup	2021-09-11 14:52:52 +02:00
active.en.toml	Add initial project setup	2021-09-11 14:52:52 +02:00
go.mod	Add initial project setup	2021-09-11 14:52:52 +02:00
go.sum	Add initial project setup	2021-09-11 14:52:52 +02:00
README.md	Add initial project setup	2021-09-11 14:52:52 +02:00

README.md

OpenID Connect client registration for CAcert

This repository contains an implementation for a OAuth2/OpenID Connect client registration application that is meant to be used with ORY Hydra.

The code in this repository is licensed under the terms of the Apache License Version 2.0.

Setup

Certificates

You need a set of certificates for the client registration application. You can use the Test CA created by the setup_test_ca.sh script from the CAcert developer setup repository like this:

create signing request

mkdir certs
cd certs
openssl req -new -newkey rsa:3072 -nodes \
    -keyout registration.cacert.localhost.key \
    -out registration.cacert.localhost.csr.pem \
    -subj /CN=registration.cacert.localhost \
    -addext subjectAltName=DNS:registration.cacert.localhost
cp *.csr.pem $PATH_TO_DEVSETUP_TESTCA/

Use the CA to sign the certificates

pushd $PATH_TO_DEVSETUP_TESTCA/
openssl ca -config ca.cnf -name class3_ca -extensions server_ext \
    -in registration.cacert.localhost.csr.pem \
    -out registration.cacert.localhost.crt.pem -days 365
popd
cp $PATH_TO_DEVSETUP_TESTCA/registration.cacert.localhost.crt.pem .

Copy CA certificate for client certificates

openssl x509 -in $PATH_TO_DEVSETUP_TESTCA/class3/ca.crt.pem \
    -out client_ca.pem

Configure registration

The client registration application requires a strong random key for its CSRF cookie. You can generate such a key using the following openssl command:

openssl rand -base64 32

Use this value and the URL of the Hydra admin API to create registration.toml:

[security]
csrf.key = "<32 bytes of base64 encoded data>"

[hydra]
admin.url = "https://hydra.cacert.localhost:4445/"

Start

Now you can start Hydra, the IDP and the demo app in 3 terminal windows:

go run cmd/registration/main.go

Visit https://registration.cacert.localhost:5000/ in a Browser to use the client registration application.

Translations

This application uses go-i18n for internationalization (i18n) support.

The translation workflow needs the go18n binary which can be installed via

go get -u  github.com/nicksnyder/go-i18n/v2/goi18n

To extract new messages from the code run

goi18n extract .

Then use

goi18n merge active.*.toml

to create TOML files for translation as translate.<locale>.toml. After translating the messages run

goi18n merge active.*.toml translate.*.toml

to merge the messages back into the active translation files. To add a new language you need to add the language code to the languages configuration option (default is defined in the configmap in cmd/idp/main.go and cmd/app/main.go).