simov/grant
Grant
Grant is an OAuth authentication proxy that interfaces applications with third-party identity providers to manage handshakes and token exchanges through a transparent proxy layer. It provides a secure OAuth client implementation that validates OpenID Connect tokens and manages multi-provider identity under a unified configuration.
The project differentiates itself through support for serverless authentication flows, allowing the proxy logic to be deployed as cloud functions. It implements advanced security mechanisms including Proof Key for Code Exchange and private key JWT authentication to protect token endpoints.
The system covers a broad range of identity capabilities, including session-based state management, dynamic configuration overrides, and customizable response transport methods such as query strings or session storage. It also supports provider-specific configuration variants and dynamic URL generation for managing diverse scopes and credentials.
Features
- Authentication Proxies - Acts as a transparent proxy layer that manages OAuth handshakes and token exchanges between applications and identity providers.
- OAuth Proxy Services - Acts as a transparent proxy layer managing the OAuth handshake and token exchange between applications and identity providers.
- OpenID Connect Token Validations - Validates audience and nonce claims of OpenID Connect identity tokens to ensure they are intended for the current request.
- OAuth Provider Integrations - Links the proxy to pre-configured OAuth providers or custom identity services via a shared configuration.
- Claim Validators - Validates standard OpenID Connect identity token claims including audience and nonce to ensure token authenticity.
- OAuth Token Exchanges - Performs the OAuth handshake and token exchange with third-party identity providers using a standardized proxy mechanism.
- OAuth 2.0 Client Implementations - Implements a secure OAuth 2.0 client with advanced protections like PKCE and private key JWTs.
- PKCE Authorization Flows - Implements Proof Key for Code Exchange to protect authorization codes from interception during the exchange process.
- Identity Providers - Integrates multiple external identity providers under a unified configuration to manage authentication and sessions.
- OpenID Connect Support - Implements OpenID Connect for identity verification, including the validation of ID tokens and nonce claims.
- Session Authentication - Provides a system to maintain user state by storing and retrieving session data via cookies and pluggable backends.
- Serverless Event Handlers - Wraps proxy logic in environment-specific handlers for deployment as cloud functions across various serverless platforms.
- Session State Management - Maintains user authentication state using customizable cookies and pluggable storage backends across the OAuth lifecycle.
- Serverless Deployment - Provides dedicated handlers to deploy the authentication proxy within event-driven cloud function environments.
- OAuth Scope Management - Requests specific levels of access from identity providers using defined scope arrays and authorization parameters.
- Serverless Flows - Enables authentication logic to be deployed as cloud functions to handle OAuth flows in serverless environments.
- Request Parameter Customization - Adds custom authorization parameters and overrides redirect URIs for specific identity provider calls.
- Provider Configuration Variants - Allows defining multiple configuration sets for a single provider to request different scopes or credentials.
- Provider Configurations - Defines multiple configuration sets for a single provider to manage different scopes or credentials.
- Custom Provider Definitions - Enables the definition of new identity providers by specifying authorization URLs, access keys, and scopes.
- Multi-Provider Standardization - Unifies authentication across different services by configuring multiple external identity providers with shared defaults.
- Private Key JWT Assertions - Authenticates clients at the token endpoint using private key JWT assertions instead of shared secrets.
- User Profile Retrieval - Retrieves detailed user information from a provider's profile endpoint following the initial authentication flow.
- Pluggable Response Transports - Ships a pluggable architecture to deliver authentication results via query strings, session storage, or request state.
- Runtime Configuration Overrides - Adjusts authentication behavior at runtime via request parameters without requiring a server restart.
- Authentication Response Transports - Provides configurable transport methods like query strings and session storage to deliver authentication results to the application.
- OAuth URL Generators - Generates provider-specific OAuth URLs by injecting dynamic values into predefined URL tokens.
- Authentication and Authorization - OAuth provider integration for various web frameworks.
- Authentication & Authorization - OAuth middleware for various web frameworks.
- Security And Privacy - Authentication middleware for Express applications.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
