panva/node-oidc-provider

Features

• OAuth 2.0 Authorization Servers - Implements a full-featured OAuth 2.0 authorization server for managing client registrations and token issuance.
• Middleware-Based Request Pipelines - Processes incoming HTTP requests through a series of configurable hooks to handle authentication, validation, and authorization logic.
• Access and Refresh Token Issuances - Generates and validates cryptographically signed access and refresh tokens for secure resource access.
• Client Authentications - Verifies client identities using secrets, digital certificates, or cryptographic assertions to ensure only authorized applications access protected resources.
• Identity Providers - Provides a centralized identity provider service for managing user authentication and session state across applications.
• OpenID Connect Providers - Acts as an OpenID Connect provider to issue identity tokens and manage standardized single sign-on flows.
• Secure Token Exchange - Implements secure token exchange protocols to transmit identity and access claims between services while preventing interception and replay attacks.
• Session Initiation Flows - Tracks user login states, maintains session persistence, and executes logout procedures including backchannel and relying party initiated flows.
• OAuth2 Access Token Issuance - Generates access, identity, and refresh tokens using standard protocols to authenticate users and authorize applications.
• Server-Side Session Storages - Stores authorization data like sessions and tokens in external databases or persistent storage systems using custom storage adapters.
• Authorization State Adapters - Abstracts data storage behind a standardized interface to allow integration with various external databases for sessions and tokens.
• Server Capability Discovery - Generates and serves configuration documents automatically to allow clients to programmatically discover server capabilities and endpoint locations.
• Server Discovery APIs - Publishes discovery documents and configuration endpoints to allow external clients to programmatically locate and interact with the server.
• OAuth Client Registrations - Provides programmatic interfaces for registering, updating, and maintaining client application metadata to automate onboarding and configuration lifecycles.
• Login and Consent Handlers - Redirects users to custom login or consent screens and processes their authentication decisions to resume the authorization flow securely.
• Authorization Policies - Enforces fine-grained access control policies and custom claim validations for sensitive application resources.
• Cryptographic Key Management - Manages cryptographic keys for signing and decryption, including support for key rotation and external hardware modules.
• Custom OAuth Grant Types - Supports extending standard OAuth 2.0 flows with unique grant types to accommodate specialized token issuance workflows.
• Identity Token Services - Provides a secure engine for the full lifecycle of identity tokens, including generation, validation, and revocation.
• OAuth 2.0 and OIDC Token Issuance - Serves as an OAuth 2.0 identity provider for managing user authentication and secure token issuance.
• Token Introspection and Revocation Endpoints - Validates the current status of access tokens or invalidates them immediately to maintain security and control over active user sessions.
• Authentication Middleware - Ships modular authentication middleware for integrating identity management directly into Node.js web application stacks.
• Web Framework Integrations - Supports mounting authentication services directly into existing application stacks to share middleware and infrastructure for handling authentication requests.

Star history