simov/grant
Grant
Grant est un proxy d'authentification OAuth qui interface les applications avec des fournisseurs d'identité tiers pour gérer les poignées de main et les échanges de jetons via une couche proxy transparente. Il fournit une implémentation client OAuth sécurisée qui valide les jetons OpenID Connect et gère l'identité multi-fournisseur sous une configuration unifiée.
Le projet se différencie par la prise en charge des flux d'authentification sans serveur (serverless), permettant à la logique proxy d'être déployée en tant que fonctions cloud. Il implémente des mécanismes de sécurité avancés, incluant Proof Key for Code Exchange et l'authentification JWT par clé privée pour protéger les points de terminaison de jetons.
Le système couvre un large éventail de capacités d'identité, incluant la gestion d'état basée sur les sessions, les remplacements de configuration dynamiques et des méthodes de transport de réponse personnalisables telles que les chaînes de requête ou le stockage de session. Il prend également en charge des variantes de configuration spécifiques aux fournisseurs et la génération d'URL dynamiques pour gérer divers scopes et identifiants.
Features
- Authentication Proxies - Acts as a transparent proxy layer that manages OAuth handshakes and token exchanges between applications and identity providers.
- OAuth Proxy Services - Acts as a transparent proxy layer managing the OAuth handshake and token exchange between applications and identity providers.
- OpenID Connect Token Validations - Validates audience and nonce claims of OpenID Connect identity tokens to ensure they are intended for the current request.
- OAuth Provider Integrations - Links the proxy to pre-configured OAuth providers or custom identity services via a shared configuration.
- Claim Validators - Validates standard OpenID Connect identity token claims including audience and nonce to ensure token authenticity.
- OAuth Token Exchanges - Performs the OAuth handshake and token exchange with third-party identity providers using a standardized proxy mechanism.
- OAuth 2.0 Client Implementations - Implements a secure OAuth 2.0 client with advanced protections like PKCE and private key JWTs.
- PKCE Authorization Flows - Implements Proof Key for Code Exchange to protect authorization codes from interception during the exchange process.
- Identity Providers - Integrates multiple external identity providers under a unified configuration to manage authentication and sessions.
- OpenID Connect Support - Implements OpenID Connect for identity verification, including the validation of ID tokens and nonce claims.
- Session Authentication - Provides a system to maintain user state by storing and retrieving session data via cookies and pluggable backends.
- Serverless Event Handlers - Wraps proxy logic in environment-specific handlers for deployment as cloud functions across various serverless platforms.
- Session State Management - Maintains user authentication state using customizable cookies and pluggable storage backends across the OAuth lifecycle.
- Serverless Deployment - Provides dedicated handlers to deploy the authentication proxy within event-driven cloud function environments.
- OAuth Scope Management - Requests specific levels of access from identity providers using defined scope arrays and authorization parameters.
- Serverless Flows - Enables authentication logic to be deployed as cloud functions to handle OAuth flows in serverless environments.
- Request Parameter Customization - Adds custom authorization parameters and overrides redirect URIs for specific identity provider calls.
- Provider Configuration Variants - Allows defining multiple configuration sets for a single provider to request different scopes or credentials.
- Provider Configurations - Defines multiple configuration sets for a single provider to manage different scopes or credentials.
- Custom Provider Definitions - Enables the definition of new identity providers by specifying authorization URLs, access keys, and scopes.
- Multi-Provider Standardization - Unifies authentication across different services by configuring multiple external identity providers with shared defaults.
- Private Key JWT Assertions - Authenticates clients at the token endpoint using private key JWT assertions instead of shared secrets.
- User Profile Retrieval - Retrieves detailed user information from a provider's profile endpoint following the initial authentication flow.
- Pluggable Response Transports - Ships a pluggable architecture to deliver authentication results via query strings, session storage, or request state.
- Runtime Configuration Overrides - Adjusts authentication behavior at runtime via request parameters without requiring a server restart.
- Authentication Response Transports - Provides configurable transport methods like query strings and session storage to deliver authentication results to the application.
- OAuth URL Generators - Generates provider-specific OAuth URLs by injecting dynamic values into predefined URL tokens.
- Authentication and Authorization - OAuth provider integration for various web frameworks.
- Authentication & Authorization - OAuth middleware for various web frameworks.
- Sécurité et confidentialité - Authentication middleware for Express applications.
