anvilresearch / connect Goto Github PK

View Code? Open in Web Editor NEW

364.0 364.0 86.0 1.18 MB

A modern authorization server built to authenticate your users and protect your APIs

Home Page: http://anvil.io

License: MIT License

JavaScript 41.77% CSS 1.31% CoffeeScript 54.21% HTML 2.57% Shell 0.15%

connect's People

Contributors

Stargazers

Watchers

Forkers

radu-c zhengt sridharaj gcrahay kaba-cceac nrhope adi-ads ovi-tamasan-3pg oren hafeez3000 wynkk yoshylord adamliechty maverickhacks cynfusion ckarande tony-evans-enactus henrjk eternaldeiwos ikb42 bauglir nelsonic camfou fnet123 floby garethmj john-banks andrewrothstein amokrushin saakaifoundry mati-o ubiratanbraga cavyio vymarkov petervyvey franck-romano cesine pingchen fjmartins gingerich marton987 dopry praveenmunagapati peveuve qaavi ya-kostik parse-alex nicolasbonduel carlchan iainmackay 1242035 gqadonis smanne pedrofolim lanphan jkoby pieterpottie maniacs-oss starsy ascension nixava italocomini manishbhatias sirinartk evertonteotonio yerzhanm arvinhubert rachid ksmore boazblake winsonsun bhardwajrahul lsadehaan pitipon techxbase

connect's Issues

Authorization flow

The following behaviors are present which seem to be out of line with my expectations:

When signing into a client application:

If the visitor has already logged into the auth server, the session is not "remembered" forcing them to log in every time.
When a visitor has logged out of a client application and attempts to log back into an application they have already authorized, they are prompted with an authorization request every time (vs remembering they had previously authorized the application).
Trusted applications are prompting for authorization.

Configurable token expiration

The server needs to support setting the IDToken exp claim and AccessToken ei (expires in) property via the max_age authorization parameter or the client's default_max_age.

JWT Access Tokens

Anvil Connect should optionally issue signed JWT access tokens as a performance optimization. Local JWT verification can be up to two orders of magnitude faster than round trip verification.

nv-commands fail without env variables set

On a clean installation, if the environment variables here are not set, an error is thrown.

The error is:

TypeError: First argument needs to be a number, array or string.
    at new Buffer (buffer.js:188:15)
    at module.exports (/usr/local/lib/node_modules/anvil-connect/config/server.js:564:16)
    at Object.<anonymous> (/usr/local/lib/node_modules/anvil-connect/server.js:15:27)
    at Module._compile (module.js:456:26)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)
    at require (module.js:380:17)
    at Object.<anonymous> (/usr/local/lib/node_modules/anvil-connect/lib/cli/init-db.js:6:14)
Usage: nv [--version] [--help] <command> [<args>]

Info:

$ node -v
v0.10.28

$ nv --version
Anvil Connect v0.1.15

$ echo $ANVIL_CONNECT_PUBLIC_KEY

$ echo $ANVIL_CONNECT_PRIVATE_KEY

After setting these...the command works fine.

Support global install for `nv` cli

Anvil Connect should serve static assets from a public directory. This will be used for overriding the styling of views, adding custom javascript behavior, and other kinds of static assets (favicon, policy/tos, etc)

Node Cluster

Take advantage of multiple cores.

Hooks for programming custom policies

Pairwise Identifier Algorithm

http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg

Selecting a template language

We used Jade for view rendering out of the gate, since it's the default template language for Express and it was easy to get started. However, Jade is, by all accounts, the worst performer among JavaScript templating engines and the syntax is controversial and foreign to many developers.

Since performance is a major objective and we're exposing templates to be overridden and customized for a given deployment, it makes sense to evaluate alternatives. I'm leaning strongly toward choosing Hogan.js for its speed (third in the benchmarks among 15 contenders) and simple, familiar syntax.

Does anyone want to weigh in before we go down this path?

Rewrite `nv init db`

Rewrite this command.

it should be config/prompt driven
it should be called nv migrate instead of nv init db
it should not overwrite or recreate existing stuff unless asked to
it should write a version property to the database for reference in upgrades
it should solve problems we don't know we have yet
...

Issuing API keys

In some cases, a client may want to make API requests of its own account, not on behalf of a user. For example, a protected resource may want to implement metered access to general, non-user-specific data.

Anvil Connect does not presently support this scenario well, because access tokens are obtained via OAuth 2.0 flows.

If we wanted to support generating API keys, there are probably several ways we could go about it. I can think of at least two:

implement an entirely new endpoint for this purpose
add a "grant_type" for "api_key" that could be handled at the /token endpoint
use the "client_registration_token"

Questions:

Should API keys expire and/or be refreshed?
Can we issue signed JWTs as API keys and reuse existing methods for verifying API requests?

I'm not sure what's the best approach. Anyone care to discuss?

Individual Claim Requests

http://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests

Default Policy/TOS documents

Alternate email for signin

Throw error for malformed JSON in config file

"service" client type for registering protected APIs

When I npm install in my test of anvil-connect in my windows7 box, it fails as below

[email protected] install D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\bcrypt
node-gyp rebuild

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\inquirer\node_modules\cli-color\node_modules\es5-ext\ob
ject\assign\shim.js
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\inquirer\node_modules\cli-color\node_modules\es
5-ext\object\assign\shim.js
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! fstream_finish_call chmod
npm ERR! code ENOENT
npm ERR! errno 34
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:305:19
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm ERR! Error: ENOENT, lstat 'D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\with\node_modules\ug
lify-js\test\compress\concat-strings.js'
npm ERR! If you need help, you may report this entire log,
npm ERR! including the npm and node versions, at:
npm ERR! http://github.com/npm/npm/issues

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\with\node_modules\uglify-js\test\comp
ress\concat-strings.js
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\with\node_modules\uglify-js\t
est\compress\concat-strings.js
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! code ENOENT
npm ERR! errno 34
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:284:26
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm ERR! EEXIST, mkdir 'D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\bucker\node_modules\moment\test\moment'
File exists: D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\bucker\node_modules\moment\test\moment
Move it away, and try again.

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\bucker\node_modules\moment\test\moment
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\bucker\node_modules\moment\test\moment\getters_
setters.js
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! code EEXIST
npm ERR! errno 47
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:171:23
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\mkdirp\index.js:37:53
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm ERR! Error: ENOENT, lstat 'D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\monocle\node_modules
\readdirp\examples\node_modules\tap-stream\node_modules\through\LICENSE.APACHE2'
npm ERR! If you need help, you may report this entire log,
npm ERR! including the npm and node versions, at:
npm ERR! http://github.com/npm/npm/issues

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\monocle\node_modules\readdirp\example
s\node_modules\tap-stream\node_modules\through\LICENSE.APACHE2
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\monocle\node_modules\readdirp
\examples\node_modules\tap-stream\node_modules\through\LICENSE.APACHE2
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! code ENOENT
npm ERR! errno 34
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:284:26
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm http 304 https://registry.npmjs.org/optimist
npm http GET https://registry.npmjs.org/wordwrap
npm http 304 https://registry.npmjs.org/wordwrap
npm ERR! Error: ENOENT, lstat 'D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_mo
dules\uglify-js\node_modules\source-map\build\test-suffix.js'
npm ERR! If you need help, you may report this entire log,
npm ERR! including the npm and node versions, at:
npm ERR! http://github.com/npm/npm/issues

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_modules\uglify-js\n
ode_modules\source-map\build\test-suffix.js
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_modules\ugl
ify-js\node_modules\source-map\build\test-suffix.js
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! code ENOENT
npm ERR! errno 34
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:284:26
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm ERR! Error: ENOENT, lstat 'D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_mo
dules\uglify-js\node_modules\optimist\node_modules\wordwrap\test\idleness.txt'
npm ERR! If you need help, you may report this entire log,
npm ERR! including the npm and node versions, at:
npm ERR! http://github.com/npm/npm/issues

npm ERR! System Windows_NT 6.1.7601
npm ERR! command "D:\dev\nodejs\node.exe" "D:\dev\nodejs\node_modules\npm\bin\npm-cli.js" "install"
npm ERR! cwd D:\dev\codebase\cn\xdf\centrum
npm ERR! node -v v0.10.29
npm ERR! npm -v 1.4.9
npm ERR! path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_modules\uglify-js\n
ode_modules\optimist\node_modules\wordwrap\test\idleness.txt
npm ERR! fstream_path D:\dev\codebase\cn\xdf\centrum\node_modules\anvil-connect\node_modules\jade\node_modules\transformers\node_modules\ugl
ify-js\node_modules\optimist\node_modules\wordwrap\test\idleness.txt
npm ERR! fstream_type File
npm ERR! fstream_class FileWriter
npm ERR! code ENOENT
npm ERR! errno 34
npm ERR! fstream_stack D:\dev\nodejs\node_modules\npm\node_modules\fstream\lib\writer.js:284:26
npm ERR! fstream_stack Object.oncomplete (fs.js:107:15)
npm http GET https://registry.npmjs.org/amdefine
npm ERR! [email protected] install: node-gyp rebuild
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] install script.
npm ERR! This is most likely a problem with the bcrypt package,
npm ERR! not with npm itself.
npm ERR! Tell the author that this fails on your system:
npm ERR! node-gyp rebuild
npm ERR! You can get their info via:
npm ERR! npm owner ls bcrypt
npm ERR! There is likely additional logging output above.

Flag scope as default

.gitignore on `nv init deployment`

When I run nv init deployment it does not generate all the necessary files. I have tracked it down to 2 issues:

#28
When I install v0.1.5, the .gitignore file from lib/cli/deployments is not present. However, when I view 0eed81a (v0.1.5's associated commit)...it's present. I'm not sure if this is a git issue, npm, ...or something with this release in particular.

This error causes the RSA keys not to be generated as well...but when both of these missing files/dirs are present, it works fine.

Multiple response types

The server should comply with OAuth 2.0 Multiple Response Type Encoding Practices, including all response modes and response types.

Aggregated/Distributed Claims

http://openid.net/specs/openid-connect-core-1_0.html#ClaimTypes

Does it make sense to encrypt entire user documents in storage?

Password reset

Client Secret JWT Authentication

http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

Key pair environment variable values

@tomkersten

140431805724480:error:0906D06C:PEM routines:PEM_read_bio:no start line:../deps/openssl/openssl/crypto/pem/pem_lib.c:703:Expecting: ANY PRIVATE KEY

Environment variables ANVIL_CONNECT_[PUBLIC|PRIVATE]_KEY are being read correctly when the server bootstraps, but the values we assigned to those variables are invalid.

I suspect the cause is that values selected/copied from the terminal or a text editor replace line break characters with spaces when pasted. Removing the spaces didn't work, because line breaks are expected. Try firing up a REPL and logging the values there.

$ node
> var fs = require('fs');
> fs.readFile('keys/public.pem', 'ascii', function (err, file) { console.log(err, file); })
> null '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhki...etc...AQAB\n-----END PUBLIC KEY-----\n'

Copying this value with the \ns included should solve the problem. Can you give this a try and let me know if it solves the problem for you?

To make getting these values easier and less error prone, I'm thinking about a CLI command that would copy the correct value onto a users clipboard. For example:

$ nv copy public-key

Thoughts?

Private Key JWT Authentication

http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

Error display for `nv init deployment` and other commands

Hybrid Authorization Flow

Anvil Connect currently implements authorization code and implicit flows. It should also support the hybrid flow.

Default clients should only be registered once by "nv init db"

Make password signin optional

Some deployments may want to avoid password signups altogether. It should be possible to disable password signups by configuration, so long as at least one third party provider is configured.

Reissue client_registration_token

Should a client be able to retrieve or reissue the client_registration_token from the dynamic client registration response?

Signin via third party where there is an existing account with the same email

When a user has already registered with an email address and they try to auth via a third party that's registered with the same email address, we get a unique error.

What's the sensible way to handle this situation? Do we want to automatically merge the accounts? Prompt to merge? Require additional authentication with the existing account? To connect an account, should we require a user to already be signed in?

Project/deployment generator

We should be able to initialize a new deployment via CLI. This tool should generate/copy:

a deployment directory
a git repository
.gitignore
package.json
configuration files for dev and production environments
server.js
default view templates and public assets
keypairs for signing and encryption

Split CLI to separate repo and communicate w/server via REST API

Throw error for unreachable Redis instance

Requests hang up when Redis isn't available. We need to fail with a meaningful error right away.

cli help

The cli tool has subcommands, similar to git or npm, and should support command-specific help.

$ nv assign --help

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.