A mock implementation of an OIDC server that authenticate users using the Authorization Code Flow. The mandatory presence of some optional parameters and the Form Post Response Mode are opinionated. The renaming of some required standard fields follows Okta specifications. Only the required fields of the Authentication and the Identity tokens are included in the responses.
- The OAuth 2.0 Authorization Framework
- OpenID Connect Core 1.0
- Proof Key for Code Exchange by OAuth Public Clients
- Form Post Response mode
- OAuth 2.0 Threat Model and Security Considerations
- Json Web Token
- The errors are unstructured human-readable strings, useful for debugging purposes
- Okta uses a custom
groupsscope
The simplest way is to use the provided Dockerfile:
services:
idp:
image: ghcr.io/dartheian/oidcms:latest
ports:
- 4000:4000The script directory contains some shell scripts that show the interactions with the server. To run them you need httpie installed in your path and overwrite any value in the scripts that does not match the default ones provided by the container.
cargo run
./script/health.sh
./script/authenticate.sh
./script/token.sh <code value from previous response>
./script/userinfo.sh <access token value from previous response>The configuration is loaded from the environment and can be overwritten using docker compose (e.g. using the environment or the env_file attributes)
services:
idp:
image: ghcr.io/dartheian/oidcms:latest
environment:
- PORT=5000
expose:
- 5000AUDIENCE: The audience (aud) claim value to put in the tokens (defaults toapi.example.com)CLIENT_SECRET: The client secret to access protected endpoints such as/token(defaults to6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc)EXPIRATION: The expiration time of the tokens expressed in seconds (defaults to60)HOST: The host of the oidcms server (defaults to0.0.0.0)ISSUER: The issuer (iss) claim value to put in the tokens (defaults tohttps://login.helloprima.com)PORT: The port of the oidcms server (defaults to4000)RNG_SEED: The seed of the pseudorandom number generator (defaults to0)SECRET: The secret key used to sign the tokens (defaults toc2VjcmV0)
USER__ADDRESS__COUNTRY: defaults toUSUSER__ADDRESS__LOCALITY: defaults toLos AngelesUSER__ADDRESS__POSTAL_CODE: defaults to90210USER__ADDRESS__REGION: defaults toCAUSER__ADDRESS__STREET_ADDRESS: defaults to123 Hollywood Blvd.USER__EMAIL_VERIFIED: defaults totrueUSER__EMAIL: defaults tojohn.doe@example.comUSER__FAMILY_NAME: defaults toDoeUSER__GIVEN_NAME: defaults toJohnUSER__LOCALE: defaults toen-USUSER__MIDDLE_NAME: defaults toJamesUSER__NAME: defaults toJohn DoeUSER__NICKNAME: defaults toJimmyUSER__PHONE_NUMBER: defaults to+1 (425) 555-1212USER__PROFILE: defaults tohttps://example.com/john.doeUSER__UPDATED_AT: defaults to946681200(Thu Jul 21 2011 20:42:50 GMT+0000)USER__ZONEINFO: defaults toAmerica/Los_Angeles
- Implement error responses as per RFCs
- Logs