Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feature: Implement support for authorization_code OAuth flow #269

Draft
wants to merge 5 commits into
base: develop
Choose a base branch
from

Conversation

okushchenko
Copy link

@okushchenko okushchenko commented Aug 4, 2023

In this PR I implement support for authorization_code OAuth flow. See https://www.oauth.com/oauth2-servers/access-tokens/authorization-code-request/ and https://www.oauth.com/oauth2-servers/server-side-apps/authorization-code/ for details.

New functionality:

  1. AuthorizationCodeClient. Very similar to ClientCredentialsClient, but it implements authorization_code flow. Similarly to ClientCredentialsClient it accepts clientID, but instead of clientSecret it accepts authorizationCode, which is something that you need to obtain in a flow that's handled by AuthorizationCodeHandler.
  2. AuthorizationCodeHandler. This one implements the callback handler that should receive the redirect from the browser with the authorization code once user finishes their login.
  3. AuthorizationCodeLoginFlowManager. A helper service that orchestrates the full authorization_code flow across both AuthorizationCodeClient and AuthorizationCodeHandler.

I think that some users may want to implement a custom login flow manager, so I think it's useful to provide individual building blocks for these, while still providing a sane default implementation.

Rough steps that are orchestrated by AuthorizationCodeLoginFlowManager:

  1. AuthorizationCodeHandler starts a web server on https://localhost:8401/ (un-privileged port, so doesn't require root)
  2. AuthorizationCodeHandler opens https://oauth.example.com/oauth2/authorize (plus some parameters there) in the browser
  3. OAuth Server redirects the user to their OAuth Provider in the browser
  4. OAuth Provider redirects the user back to OAuth Server once login is finished in the browser
  5. OAuth Server redirects the user to https://localhost:8401/callback/oauth2?code=SECRET_CODE in the browser
  6. Local server receives an authorization code from the browser
  7. AuthorizationCodeClient exchanges the authorization code for an access token from OAuth Server

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants