5 ms·

Easy to use OpenID Connect client and server library written for Go

165 points by mffap 3y ago

deleted 3y ago
[deleted]
berkes 3y ago
Is OpenID still in use much? I come across it less and less. To the point where I get the feeling it's just some legacy implementions that have it, but nothing more.
- EtienneK 3y ago
  This is for OpenID Connect, which is still widely used almost everywhere. OpenID (not Connect), was its precursor and never really widely adopted.
- Jnr 3y ago
  If you want to add SSO to your software, OIDC is pretty much the standard to go for right now.
- mrweasel 3y ago
  OpenID no, it's not. OpenID Connect (OIDC) which is built on top of OAuth2, yes, it's very much a thing and much easier to deal with than plain. OAuth2
reddec 3y ago
Nice. Once upon a time we created something like this. https://github.com/reddec/oidc-login https://github.com/reddec/oidc-login (Client only)
kjuulh 3y ago
Having built and worked with a variety of oidc implementations. It is an incredibly misused technology, while it initially can be easy to integrate into your app. It increases the complexity of the app to a surprising degree. Now suddenly your little webapp have to handle how various devices handle redirects to external sites, receives callbacks. And all the weird ways oidc implementations uses cookies, handles return urls, logouts, profiles etc. I am not so sure the model of using a central oidc solution as the primary login to your app is such a good idea. There are so many failure points in just getting to and fro the oidc portal that can break in all sorts of ways, with no good way of debugging, leaving users stranded in the middle of redirects. Especially as logs are split between 3 parties, the browser, the client (server) and the oidc server. I ripped out our oidc primary login and implemented comparable features in my current company (this is probably not for everyone though), it has vastly reduced support tickets, and generally been a faster and more intuitive solution, but more expensive, and requires more domain knowledge. Still I'd rather have that than having a team spend years handling support tickets for endless social login issues. If you choose to use oidc, please, please only use it for social logins, don't do oidc within oidc within oidc (I am not exaggerating, I've seen 5 levels of nested oidc and oauth2 flows). Like a lot of these solutions such as Zitadel, Auth0, etc. It becomes a nightmare to support and mature.
- Lucasoato 3y ago
  If you think people misuse OIDC, just imagine how much they could fail implementing a AuthN/AuthZ on their own.
  - kjuulh 3y ago
    What about oidc and authn+z on their own? ;) Failure galore
- harha_ 3y ago
  how various devices handle redirects to external sites Isn't a simple redirect in the same window enough? Redirect to OIDC provider -> login -> redirect back APP -> get OIDC state from URI params?
  - jarym 3y ago
    It should be yes, although I think what the parent was getting at was layers of OIDC where one provider redirects to another and then you get 2 redirects back. I’ve seen it a few time and can only conclude it’s the work of amateurs.
    - kjuulh 3y ago
      It really is, in some of these flows the single sign on nature of oidc isn't even used, or hacked away. And only used for login. Which is absolutely wild.
  - xyzzy123 3y ago
    You can easily end up nested flows if e.g, your app uses auth0 and the user is a business user whose company is saml federated to Azure, for example. You can quickly get to 3 levels if e.g. your app uses auth0, github login is supported and then the user does social login to github etc. 2 or 3 levels of federation is common. More levels are possible which is bad if you value your sanity but I think (well, hope) rare in practice. The way you get to 4 or 5 levels is if you have organisational dysfunction on top of all this and you are forced to do your logins thru e.g. one or more fed servers owned by a different team in your company (who add even more layers of indirection). Mostly as a relying party you will be insulated from all the complexity but if you own your oidc server and manage the brokering you will probably have to deal with a lot of edge cases.
KronisLV 3y ago
I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy configuration: SetEnv proxy-initial-not-pooled 1 SetEnv proxy-nokeepalive 1 otherwise connections would randomly drop. I was looking for other ways to make development a bit easier and also settled on mod_auth_openidc, which is an Apache module that lets it act like a Relying Party and handle lots of the heavy lifting (protecting endpoints, refreshing tokens etc.) for me, and lets me work with just a few headers that are passed to the protected resources: https://github.com/OpenIDC/mod_auth_openidc https://github.com/OpenIDC/mod_auth_openidc It works, but I'm still not happy - I realize that there are many types of attacks that have historically been a problem and that certain OpenID Connect flows try to protect against, in addition to the fact that if I wrote my own security code it'd almost certainly be worse and have vulnerabilities (in the words of Eoin Woods: "Never invent security technology"), and it's a good thing to follow standards... but the whole thing is such a pain. Both OpenID Connect, Keycloak and configuring mod_auth_openidc. Right now I'm moving permissions/roles back into the app DB, because I don't want to have to work with the Keycloak REST API every time I want to change what a user can or cannot do in the system, in addition to permissions which might only apply conditionally (one user might be related to multiple organizations, having different permissions in the context of each). Regardless, it's nice that there are more pieces of software out there to choose from! Do manage your expectations when working with OpenID Connect, though.
- pzmarzly 3y ago
  Have you considered/tried Ory Kratos + Hydra [0]? I've never used either Ory or Keycloak, but out of these 2, Keycloak feels more opinionated and harder to set up, though it does have more features. [0] https://www.ory.sh/open-source/ https://www.ory.sh/open-source/
  - _cenw 3y ago
    Hydra and Kratos do not come with any frontend components, it's essentially just an API you have to write a a much more opinionated client for.
spapas82 3y ago
Just two days ago I wrote a comprehensive tutorial on how openid connect works using simple http requests to understand the flow: https://spapas.github.io/2023/11/29/openid-connect-tutorial/ https://spapas.github.io/2023/11/29/openid-connect-tutorial/ It has been written with keycloak as the auth server but should work for any proper openid connect implementation since I used the specification as a guide.
- bbkane 3y ago
  This is excellent, thank you!!
oglop 3y ago
Oidc and keycloak have been great for my project. We stear users to it as it also allows for user impersonation by an admin. Thi is a huge help to debug issues for users, while also keeping any authentication work out of our app and the concern oof the authentication layer. This alone sets it apart for us. Lots of other solutions don’t offer this. And then users make requests to our software for this ability and like I tell them, there’s no way our software is going to insert itself into your authentication system. That’s for your authentication system!! Anyway, I seem to be the minority here but maybe that’s the domain I work in.
johnchristopher 3y ago
I would like to become more knowledgeable about authentication and identification tech stacks (LDAP, OIDC, Oauth, CAS, etc.) and have hands-on experience. I already dabbled a bit with some LDAP, I have professional experience in administering linux boxes and intranet infrastructure. Where should I begin if I want to set up a simple homelab with maybe a raspberry and some NUC ?
- candiddevmike 3y ago
  Take a historical journey by setting up an LDAP server like OpenLDAP or Samba, add Keycloak on it (or just use Keycloak for LDAP too), then integrate it to AWS using SAML and Google using OIDC.
adeptima 3y ago
I can't recommend enough Zitadel and its OIDC library. Code is very well-writen and informative. Highly encourage everyone jump into source code and explore how IntrospectionResponse struct work with all related code around https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspection.go https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspec... // IntrospectionResponse implements RFC 7662, section 2.2 and // OpenID Connect Core 1.0, section 5.1 (UserInfo). // https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2 https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2. // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims https://openid.net/specs/openid-connect-core-1_0.html#Standa.... type IntrospectionResponse struct { Active Scope ClientID TokenType ... exp iat nbf sub Audience ... aud ... JWTID ... Claims map[string]any } If you want to explore the difference between identity providers, click through https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/providers https://github.com/nextauthjs/next-auth/tree/main/packages/c... Azure is the most insane ... and it's a lot of fun to compare them all against each other. Next go though PKCE (Proof Key for Code Exchange) and look how code_challenge, code_verifier works or at least see interfaces . Ory Fosite is a great alternative too https://github.com/ory/fosite https://github.com/ory/fosite Support PKCE #59835 in x/oauth2 https://github.com/golang/go/issues/59835 https://github.com/golang/go/issues/59835 Scott Brady's content is great for undetstanding the topic SPA Identity and Access Control with OpenID Connect https://www.youtube.com/watch?v=rP3St0GU_Bk https://www.youtube.com/watch?v=rP3St0GU_Bk OAuth is Not Authentication https://www.scottbrady91.com/oauth/oauth-is-not-authentication https://www.scottbrady91.com/oauth/oauth-is-not-authenticati... SPA is a landmine .. OAuth 2 0 and OpenID Connect for Single Page Applications Philippe De Ryck https://www.youtube.com/watch?v=XoBtUn4XczU https://www.youtube.com/watch?v=XoBtUn4XczU The deeper you go into the topic the more you will discover. It's an ultimate "rabbit hole" - web, native, SPA flows, PKCE, JWT, session storage, custome middleware for your favorite flavor of backend framework, etc

165 points by mffap 3y ago

deleted 3y ago

[deleted]

Is OpenID still in use much? I come across it less and less. To the point where I get the feeling it's just some legacy implementions that have it, but nothing more.

EtienneK 3y ago
This is for OpenID Connect, which is still widely used almost everywhere. OpenID (not Connect), was its precursor and never really widely adopted.
Jnr 3y ago
If you want to add SSO to your software, OIDC is pretty much the standard to go for right now.
mrweasel 3y ago
OpenID no, it's not. OpenID Connect (OIDC) which is built on top of OAuth2, yes, it's very much a thing and much easier to deal with than plain. OAuth2

reddec 3y ago

Nice. Once upon a time we created something like this. https://github.com/reddec/oidc-login https://github.com/reddec/oidc-login (Client only)

kjuulh 3y ago

Having built and worked with a variety of oidc implementations. It is an incredibly misused technology, while it initially can be easy to integrate into your app. It increases the complexity of the app to a surprising degree. Now suddenly your little webapp have to handle how various devices handle redirects to external sites, receives callbacks. And all the weird ways oidc implementations uses cookies, handles return urls, logouts, profiles etc. I am not so sure the model of using a central oidc solution as the primary login to your app is such a good idea. There are so many failure points in just getting to and fro the oidc portal that can break in all sorts of ways, with no good way of debugging, leaving users stranded in the middle of redirects. Especially as logs are split between 3 parties, the browser, the client (server) and the oidc server. I ripped out our oidc primary login and implemented comparable features in my current company (this is probably not for everyone though), it has vastly reduced support tickets, and generally been a faster and more intuitive solution, but more expensive, and requires more domain knowledge. Still I'd rather have that than having a team spend years handling support tickets for endless social login issues. If you choose to use oidc, please, please only use it for social logins, don't do oidc within oidc within oidc (I am not exaggerating, I've seen 5 levels of nested oidc and oauth2 flows). Like a lot of these solutions such as Zitadel, Auth0, etc. It becomes a nightmare to support and mature.

Lucasoato 3y ago
If you think people misuse OIDC, just imagine how much they could fail implementing a AuthN/AuthZ on their own.
- kjuulh 3y ago
  What about oidc and authn+z on their own? ;) Failure galore
harha_ 3y ago
how various devices handle redirects to external sites Isn't a simple redirect in the same window enough? Redirect to OIDC provider -> login -> redirect back APP -> get OIDC state from URI params?
- jarym 3y ago
  It should be yes, although I think what the parent was getting at was layers of OIDC where one provider redirects to another and then you get 2 redirects back. I’ve seen it a few time and can only conclude it’s the work of amateurs.
  - kjuulh 3y ago
    It really is, in some of these flows the single sign on nature of oidc isn't even used, or hacked away. And only used for login. Which is absolutely wild.
- xyzzy123 3y ago
  You can easily end up nested flows if e.g, your app uses auth0 and the user is a business user whose company is saml federated to Azure, for example. You can quickly get to 3 levels if e.g. your app uses auth0, github login is supported and then the user does social login to github etc. 2 or 3 levels of federation is common. More levels are possible which is bad if you value your sanity but I think (well, hope) rare in practice. The way you get to 4 or 5 levels is if you have organisational dysfunction on top of all this and you are forced to do your logins thru e.g. one or more fed servers owned by a different team in your company (who add even more layers of indirection). Mostly as a relying party you will be insulated from all the complexity but if you own your oidc server and manage the brokering you will probably have to deal with a lot of edge cases.

KronisLV 3y ago

I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy configuration: SetEnv proxy-initial-not-pooled 1 SetEnv proxy-nokeepalive 1 otherwise connections would randomly drop. I was looking for other ways to make development a bit easier and also settled on mod_auth_openidc, which is an Apache module that lets it act like a Relying Party and handle lots of the heavy lifting (protecting endpoints, refreshing tokens etc.) for me, and lets me work with just a few headers that are passed to the protected resources: https://github.com/OpenIDC/mod_auth_openidc https://github.com/OpenIDC/mod_auth_openidc It works, but I'm still not happy - I realize that there are many types of attacks that have historically been a problem and that certain OpenID Connect flows try to protect against, in addition to the fact that if I wrote my own security code it'd almost certainly be worse and have vulnerabilities (in the words of Eoin Woods: "Never invent security technology"), and it's a good thing to follow standards... but the whole thing is such a pain. Both OpenID Connect, Keycloak and configuring mod_auth_openidc. Right now I'm moving permissions/roles back into the app DB, because I don't want to have to work with the Keycloak REST API every time I want to change what a user can or cannot do in the system, in addition to permissions which might only apply conditionally (one user might be related to multiple organizations, having different permissions in the context of each). Regardless, it's nice that there are more pieces of software out there to choose from! Do manage your expectations when working with OpenID Connect, though.

pzmarzly 3y ago
Have you considered/tried Ory Kratos + Hydra [0]? I've never used either Ory or Keycloak, but out of these 2, Keycloak feels more opinionated and harder to set up, though it does have more features. [0] https://www.ory.sh/open-source/ https://www.ory.sh/open-source/
- _cenw 3y ago
  Hydra and Kratos do not come with any frontend components, it's essentially just an API you have to write a a much more opinionated client for.

spapas82 3y ago

Just two days ago I wrote a comprehensive tutorial on how openid connect works using simple http requests to understand the flow: https://spapas.github.io/2023/11/29/openid-connect-tutorial/ https://spapas.github.io/2023/11/29/openid-connect-tutorial/ It has been written with keycloak as the auth server but should work for any proper openid connect implementation since I used the specification as a guide.

bbkane 3y ago
This is excellent, thank you!!

oglop 3y ago

Oidc and keycloak have been great for my project. We stear users to it as it also allows for user impersonation by an admin. Thi is a huge help to debug issues for users, while also keeping any authentication work out of our app and the concern oof the authentication layer. This alone sets it apart for us. Lots of other solutions don’t offer this. And then users make requests to our software for this ability and like I tell them, there’s no way our software is going to insert itself into your authentication system. That’s for your authentication system!! Anyway, I seem to be the minority here but maybe that’s the domain I work in.

johnchristopher 3y ago

I would like to become more knowledgeable about authentication and identification tech stacks (LDAP, OIDC, Oauth, CAS, etc.) and have hands-on experience. I already dabbled a bit with some LDAP, I have professional experience in administering linux boxes and intranet infrastructure. Where should I begin if I want to set up a simple homelab with maybe a raspberry and some NUC ?

candiddevmike 3y ago
Take a historical journey by setting up an LDAP server like OpenLDAP or Samba, add Keycloak on it (or just use Keycloak for LDAP too), then integrate it to AWS using SAML and Google using OIDC.

adeptima 3y ago

I can't recommend enough Zitadel and its OIDC library. Code is very well-writen and informative. Highly encourage everyone jump into source code and explore how IntrospectionResponse struct work with all related code around https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspection.go https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspec... // IntrospectionResponse implements RFC 7662, section 2.2 and // OpenID Connect Core 1.0, section 5.1 (UserInfo). // https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2 https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2. // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims https://openid.net/specs/openid-connect-core-1_0.html#Standa.... type IntrospectionResponse struct { Active Scope ClientID TokenType ... exp iat nbf sub Audience ... aud ... JWTID ... Claims map[string]any } If you want to explore the difference between identity providers, click through https://github.com/nextauthjs/next-auth/tree/main/packages/core/src/providers https://github.com/nextauthjs/next-auth/tree/main/packages/c... Azure is the most insane ... and it's a lot of fun to compare them all against each other. Next go though PKCE (Proof Key for Code Exchange) and look how code_challenge, code_verifier works or at least see interfaces . Ory Fosite is a great alternative too https://github.com/ory/fosite https://github.com/ory/fosite Support PKCE #59835 in x/oauth2 https://github.com/golang/go/issues/59835 https://github.com/golang/go/issues/59835 Scott Brady's content is great for undetstanding the topic SPA Identity and Access Control with OpenID Connect https://www.youtube.com/watch?v=rP3St0GU_Bk https://www.youtube.com/watch?v=rP3St0GU_Bk OAuth is Not Authentication https://www.scottbrady91.com/oauth/oauth-is-not-authentication https://www.scottbrady91.com/oauth/oauth-is-not-authenticati... SPA is a landmine .. OAuth 2 0 and OpenID Connect for Single Page Applications Philippe De Ryck https://www.youtube.com/watch?v=XoBtUn4XczU https://www.youtube.com/watch?v=XoBtUn4XczU The deeper you go into the topic the more you will discover. It's an ultimate "rabbit hole" - web, native, SPA flows, PKCE, JWT, session storage, custome middleware for your favorite flavor of backend framework, etc