spring-authorization-server
OpenID
spring-authorization-server | OpenID | |
---|---|---|
13 | 10 | |
4,723 | 947 | |
0.6% | 0.2% | |
9.4 | 9.3 | |
4 days ago | 5 days ago | |
Java | C | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
spring-authorization-server
-
Spring + VueJS: What's the best way to implement security?
I use this https://github.com/spring-projects/spring-authorization-server for smaller projects or experimentations. Keeps all the moving parts without going to a 3rd party.
-
Spring Security OAuth2 Login
In this section we will use Spring Authorization Server to build an authorization server.In addition, we will also customize the access_token and custom user information endpoints.
-
Any good free authorization server solutions?
You can spin one up in Spring (Java) fairly quickly and boilerplate - Main page and Getting Started Guide.
-
Spring Authorization Server
Is Spring Authorization Server ready for production? Does it only use OAuth 2.1? We currently use `org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure` in our apps with OAuth2 JWT with grant types `password`, and `refresh_token`. If we update our authorization server with Spring Authorization Server, do we have to change all functionalities? Can we use OAuth2 or do we have to start using OAuth2.1?
-
Spring security new Authorization server (0.3.1) - part 1
At the moment of writing this it seems like the documentation is also in the early stages, although I wouldn't expect too much from the documentation later on either if it was to be judged by the docs for the rest of the spring security. You can find the official docs here.
-
Spring Security WebSecurityConfigurerAdapter deprecated
Your example is pretty unconventional though — it seems like you're sort of rolling your own authorization server which will make things difficult. The project has been diligent about removing support for "issuing" JWTs and things like that. If you asked a maintainer about your current approach they'd probably point you to https://spring.io/projects/spring-authorization-server.
-
Spring security auth
It has becone so boilerplate, Spring is actually helping Take a look at: Spring Auth Server
-
Any good resources to learn JWT based authorization with spring?
Spring Auth Server
-
How to make multiple apps redirect to same login page hosting Google OAuth and make it redirect to corresponding app upon successful authentication?
Most of the time, and most examples, will be about using OAuth as a client. But in your case you want to have your own OAuth and Open ID server which will be federated with Facebook and Google. All that means is that you will then have an OAuth server that is also someone else's client, such that your apps authenticate with your server which then uses their servers to actually identify users. This will also come in handy later if you want to set up permissions and what not. Besides Keycloak you might want to look into WSO2 IS or Auth0. Keycloak and WSO2 IS can be run locally, while Auth0 is a cloud service. I'd go with either Keycloak or Auth0. If you go the Spring Authorization Server route, they rolled up an example of federation on the project's Github page. Oauth can be pretty complicated though so I'd suggest that you start off with a ready-made solution. If you stick to Spring Oauth2 Client and avoid things like using Keycloak's specific adapter, it should be easy enough to swap OAuth servers later on. Regarding SAML, I've never used it. I think OAuth is way more prevalent in web development. Here's a comparison, I found it informative. You mentioned tutorials... I bought this course on Udemy last year and it was pretty nice. I browsed some tutorials, and I think this is what you need if you go with Keycloak, assuming you're using Keycloak on the server. If you want to authenticate users on the frontend (running on the browser), you'll want a PKCE flow example.
-
Keycloak: Open-Source Identity and Access Management
Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-serv...
I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.
OpenID
-
Keycloak SSO with Docker Compose and Nginx
I did something similar, though picked Apache with mod_auth_openidc, which is a certified Relying Party implementation: https://github.com/OpenIDC/mod_auth_openidc
In other words, I can protect arbitrary applications through my reverse proxy and require either certain claims/roles, or simplify auth to the point where my downstream app/API will just receive a bunch of headers like OIDC_CLAIM_sub, OIDC_CLAIM_name, OIDC_CLAIM_email through the internal network, not making me bother with configuring OIDC libraries for all of my APIs and configure them in each stack that I might use, but rather contain all of that complexity in the web server.
Basically:
user <==> Apache (with mod_auth_openidc) <==> API (with OIDC_ headers, if logged in)
-
What Is OIDC?
> Don't outsource either your authentication or authorization. Run it in-house.
This is hard to do, though. I hope people here will drop a lot of combinations that work for them!
Personally, for a small/medium scale project, I went with:
Keycloak: https://www.keycloak.org/
It supports various backing RDBMSes (like PostgreSQL, MariaDB/MySQL and others), allows both users that you persist in your own DB, as well as various external sources, like social login across various platforms, is an absolute pain to configure and sometimes acts in stupid ways behind a reverse proxy, but has most of the features that you might ever want, which sadly comes coupled with some complexity and an enterprise feeling.
I quite like that it offers the login/registration views that you need with redirects, as well as user management, storing roles/permissions and other custom attributes. It's on par with what you'd expect and should serve you nicely.
mod_auth_openidc: https://github.com/OpenIDC/mod_auth_openidc
This one's a certified OpenID Connect Relying Party implementation for... Apache2/httpd.
Some might worry about the performance and there are other options out there (like a module for OpenResty, which is built on top of Nginx), but when coupled with mod_md Apache makes for a great reverse proxy/ingress for my personal needs.
The benefit here is that I don't need 10 different implementations for each service/back end language that's used, I can outsource the heavy lifting to mod_auth_openidc (protected paths, needed roles/permissions, redirect URLs, token renewal and other things) and just read a few trusted headers behind the reverse proxy if further checks are needed, which is easy in all technologies.
That said, the configuration there is also hard and annoying to do, as is working with OpenID Connect in general, even though you can kind of understand why that complexity is inherent. Here's a link with some certified implementations, by the way: https://openid.net/developers/certified-openid-connect-imple...
-
Easy to use OpenID Connect client and server library written for Go
otherwise connections would randomly drop. I was looking for other ways to make development a bit easier and also settled on mod_auth_openidc, which is an Apache module that lets it act like a Relying Party and handle lots of the heavy lifting (protecting endpoints, refreshing tokens etc.) for me, and lets me work with just a few headers that are passed to the protected resources: https://github.com/OpenIDC/mod_auth_openidc
It works, but I'm still not happy - I realize that there are many types of attacks that have historically been a problem and that certain OpenID Connect flows try to protect against, in addition to the fact that if I wrote my own security code it'd almost certainly be worse and have vulnerabilities (in the words of Eoin Woods: "Never invent security technology"), and it's a good thing to follow standards... but the whole thing is such a pain. Both OpenID Connect, Keycloak and configuring mod_auth_openidc.
Right now I'm moving permissions/roles from Keycloak back into the app DB, with references to the Keycloak user IDs, because I don't want to have to work with the Keycloak REST API every time I want to change what a user can or cannot do in the system, in addition to permissions which might only apply conditionally (one user might be related to multiple organizations, having different permissions in the context of each).
Regardless, it's nice that there are more pieces of software out there to choose from!
-
Show HN: Obligator – An OpenID Connect server for self-hosters
Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-doc... although the fact that they want you to create an "optimized" image yourself and have a long build/setup process on startup instead is slightly annoying: https://www.keycloak.org/server/containers
Regardless, with something like mod_auth_openidc or another Relying Party implementation, all of the sudden authn/authz becomes easier to manage (you can literally get user information including roles in headers that are passed from your gateway/relying party to apps behind the reverse proxy), regardless of what you have actually running in your APIs: https://github.com/OpenIDC/mod_auth_openidc (there are other options, of course, but I went with that because I already use mod_md).
It's actually cool that there are plentiful options in the space, since OIDC is pretty complex in of itself and attempts at creating something pleasant to actually use are always welcome, I've also heard good things about Authentik: https://goauthentik.io/
-
Password protect a static HTML page
> The user experience with basic auth is not so good.
Apache actually also has an OpenID Connect module, which you can enable to have it work as a relying party: https://github.com/zmartzone/mod_auth_openidc
Basically, the actual UI will be handled by another system that you might be using, for example, in my case that might be a self-hosted Keycloak instance: https://www.keycloak.org/
I'd say that Keycloak is a pretty good solution in general, because it does some of the heavy lifting for you, maybe its shorter release cycle not being the best thing ever, though. I think IdentityServer also tried to fill this niche, but they went full on commercial recently, without OSS offerings.
-
SSO - For Plex, Emby and AudioBookShelf etc... How are you exposing these for remote access?
E.g. for Apache httpd there's mod_auth_openidc available.
-
What Is a Service Mesh?
More information: https://docs.docker.com/network/
> Load balancing
The above will also distribute the traffic based on how many instances you have running, from as many web servers as you have running. Throw in health checks (such as the container running curl against itself, to check that the API/web interface is available when starting up, as well as periodically during operation) so no traffic gets routed before your application can receive them and you're good for the most part: https://docs.docker.com/engine/swarm/services/#publish-ports
> TLS encryption
Let's Encrypt as well as your own custom certificates are supported by most web servers out there rather easily, even Apache now has mod_md for automating this: https://httpd.apache.org/docs/trunk/mod/mod_md.html
Also, if you want, you can encrypt the network traffic between the nodes as well and not worry about having to manage the internal certificates manually either: https://docs.docker.com/engine/swarm/networking/#customize-a...
> Authentication and authorization
Once again, web servers are pretty good at this, you can configure most forms or auth easily and even the aforementioned Apache now has mod_auth_openidc which supports OpenID Connect, so you can even configure it to be a Relying Party and not worry as much about letting your applications themselves manage that (given that if you have 5 different tech stacks running, you'd need 5 bits of separate configuration and libraries for that): https://github.com/zmartzone/mod_auth_openidc
> Metrics aggregation, such as request throughput and response time, Distributed tracing
This might be a little bit more tricky! The old Apache outputs its server status with a handler that you can configure (see a live example here: https://issues.apache.org/server-status ) thanks to mod-status: https://httpd.apache.org/docs/2.4/mod/mod_status.html and there's similar output for the ACME certificate status as well, which you can configure. The logs also contain metrics about the requests, which once again are configurable.
Other web servers might give you more functionality in that regard (or you might shop around for Apache modules), Traefik, Caddy as well as Nginx Proxy Manager might all be good choices both when you're looking to hook up for something external to aggregate the metrics with minimal work, or want a dashboard of some sort, for example: https://doc.traefik.io/traefik/operations/dashboard/
> Rate limiting
In Apache, it's a bit more troublesome (other servers do this better most of the time), depending on which approach you use, but something basic isn't too hard to set up: https://httpd.apache.org/docs/2.4/mod/mod_ratelimit.html
> Routing and traffic management, Traffic splitting, Request retries
I'm grouping these together, because what people expect from this sort of functionality might vary a lot. You can get most of the basic stuff out of most web servers, which will be enough for the majority of the web servers out there.
Something like blue/green deployments, A/B testing or circuit breaking logic is possible with a bit more work, but here I'll concede that for the more advanced setups out there something like Istio and Kiali would be better solutions. Then again, those projects won't be the majority of the ones out there.
> Error handling
Depends on what you want to do here, custom error pages (or handlers), or something in regards to routing or checking for the presence of resources isn't too hard and has been done for years.
But what's my point here? Should everyone abandon using Linkerd or Istio? Not at all! I'm just saying that even with lightweight technologies and for simpler tech stacks, having and ingress as well as something that covers most of what a service mesh would (e.g. the aforementioned Docker overlay networking, or similar solutions) can be immensely useful.
After putting Nginx in front of many of the services for projects at work, path rewriting, as well as handling special rules for certain apps has become way easier, certificate management is a breeze since it can be done with Ansible just against a single type of service, in addition to something like client certs or OIDC (though admittedly, that's mostly on my homelab, with Apache).
Once you actually grow past that, or have your entire business built on Kubernetes, then feel free to adopt whatever solutions you deem necessary! But don't shy away from things like this even when you have <10 applications running in about as many containers (or when you have some horizontal scalability across your nodes).
-
Keycloak: Open-Source Identity and Access Management
I really like https://tools.ietf.org/html/draft-ietf-oauth-security-topics with it's evergreen approach and looking forward to oauth2.1 to sum up the current best practices.
Depending on your use case I have good experience with https://github.com/zmartzone/mod_auth_openidc and https://github.com/panva/node-oidc-provider.
https://github.com/OpenIDC/pyoidc also might be a good choice as security researchers in that area did take a look in it...
-
Please suggest web portal to access intranet resources.
My prod proxies are apache with https://github.com/zmartzone/mod_auth_openidc for the oidc stuff, for x509 certs, SSLVerifyClient require
-
How to Use OAuth to Add Authentication to Your React App
I leave that the the module, I believe it uses client cookies by default, but I use a persistent server cache on disk (the session tokens are stored encrypted)
https://github.com/zmartzone/mod_auth_openidc/wiki/Session-m...
What are some alternatives?
Keycloak - Open Source Identity and Access Management For Modern Applications and Services
FreeIPA - Mirror of FreeIPA, an integrated security information management solution
keycloak-ui - keycloak-ui repo is moved.
Samba - https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git -- Merge requests should be made on GitLab (not on GitHub)
zitadel - ZITADEL - The best of Auth0 and Keycloak combined. Built for the serverless era.
LDAP Account Manager (LAM) - LDAP Account Manager
Spring Security - Spring Security
easy-rsa - easy-rsa - Simple shell based CA utility
oidc-client-ts - OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript applications
Pomerium - Pomerium is an identity and context-aware reverse proxy for zero-trust access to web applications and services.
a12n-server - An open source lightweight OAuth2 server
BounCA - BounCA is a web tool to generate self-signed SSL certificates and setup a key infrastructure