doorkeeper-gem/doorkeeper
Doorkeeper
Doorkeeper est un serveur d'autorisation OAuth 2 et un fournisseur pour les applications Ruby on Rails et Grape. Il fournit le framework nécessaire pour construire un serveur d'autorisation qui émet et valide des jetons de sécurité pour des applications tierces, agissant efficacement comme un middleware de sécurité pour protéger les endpoints API.
Le projet intègre une couche d'identité via OpenID Connect pour vérifier les identités des utilisateurs et récupérer les informations de profil. Il prend en charge une variété de modèles de sécurité, incluant l'implémentation du flux PKCE pour les clients publics et l'émission de JSON Web Tokens (JWT) sans état.
Ses capacités plus larges couvrent tout le cycle de vie du jeton, incluant le hachage cryptographique des jetons et des secrets, la restriction d'accès basée sur les scopes et la révocation de jetons. Il gère l'enregistrement des applications tierces et fournit des mécanismes pour l'identification du propriétaire de la ressource et l'exécution du flux d'autorisation.
Le système inclut une couche de persistance avec prise en charge de plusieurs adaptateurs de base de données, incluant Active Record, Sequel et MongoDB.
Features
- OAuth 2.0 Authorization Servers - Provides a full authorization server to manage client registrations and execute flows to issue access tokens.
- Client Application Registrations - Provides a system to register and manage client identifiers and secrets for third-party application authentication.
- Request Token Validators - Intercepts incoming requests to verify access tokens and identify resource owners before reaching controllers.
- OAuth Scope Management - Allows for the definition and enforcement of specific OAuth scopes to limit the permissions granted to a client.
- Token Revocation - Allows for the immediate invalidation of access and refresh tokens to terminate a client's session.
- API Access Control - Protecting API endpoints by validating access tokens and enforcing specific permission scopes for incoming requests.
- Request Access Restrictions - Enforces scope-based access restrictions to ensure tokens possess the required permissions for a specific action.
- Token Lifecycle Management - Manages the full lifecycle of security tokens, including generation, cryptographic hashing, and revocation.
- OAuth 2.0 Authorization Flows - Executes standard OAuth 2.0 authorization flows to grant secure access to users and applications.
- Protocol Endpoints - Provides standardized routes for authorization and token exchange to manage third-party authentication flows.
- OAuth Providers - Implements OAuth 2.0 flows to store and authenticate client identifiers and secrets.
- OpenID Connect Providers - Implements an identity authority that issues tokens and provides profile information via the OpenID Connect protocol.
- OpenID Connect Support - Integrates the OpenID Connect protocol to provide an identity layer for user authentication.
- Resource Owner Identification - Retrieves the identity of the user associated with a token to provide personalized data to authorized clients.
- Token Validation - Validates tokens on incoming requests to verify their scope and ownership before granting access.
- OAuth2 Access Token Issuance - Generates short-lived access tokens to facilitate secure communication between clients and resources.
- Middleware-Based Endpoint Protections - Provides middleware that intercepts incoming requests to verify token validity before allowing access to protected API routes.
- Authorization Server Implementations - Implements a complete OAuth 2 authorization server tailored for Ruby on Rails and Grape applications.
- ORM Integrations - Extends data access by implementing specific patterns to support both relational and non-relational databases.
- ORM Agnostic Persistence - Persists authorization codes and tokens using various database adapters like Active Record or MongoDB.
- Access and Refresh Token Issuances - Generates long-lived refresh tokens allowing clients to obtain new access tokens without re-authentication.
- JWT Format Tokens - Issues access tokens in JWT format to enable stateless verification without database lookups.
- Pluggable Token Formats - Uses customizable generator objects to define the format and structure of issued security tokens.
- User Identity Verification - Verifies the identity of the resource owner before granting access and handles redirection to login pages.
- JSON Web Tokens - Generates and validates stateless JSON Web Tokens for API authorization.
- PKCE Authorization Flows - Implements the PKCE flow to secure authorization codes for public clients and prevent interception attacks.
- OAuth Grant Type Handlers - Processes various OAuth grant types to securely exchange authorization codes for tokens.
- Token Hashing - Implements cryptographic hashing for access tokens and client secrets to protect them against database compromises.
- Credential Hashing - Ensures that third-party application secrets are stored as cryptographic hashes rather than plain text.
- Token Introspection - Provides token introspection capabilities to check the current validity and properties of an active token.
- Custom Token Generators - Supports custom generator objects to produce security tokens that meet specific data format requirements.
- Token Hashing - Protects sensitive credentials and access tokens by storing cryptographic hashes instead of plain text values.
- Grant Management - Provides a mechanism for users to view and revoke access permissions they have granted to third-party applications.
- ORM Adapters - Provides a persistence layer that supports multiple database backends via interchangeable ORM adapters.
- Stateless Token Validation - Employs JSON Web Tokens to enable authorization verification without requiring a database lookup.
- Security Middleware - Provides security middleware for Ruby on Rails to protect API endpoints and manage third-party access.
- Authentication and Authorization - Introduces OAuth2 provider functionality.
- Authentication and OAuth - An OAuth2 provider for Rails.
