autentia/openid-connect-server-spring-boot

A Spring Boot Configuration for the MITREid OpenID Connect Server.

Spring Boot MITREid Connect

---

A Spring Boot Configuration for the MITREid OpenID Connect Server.

This project separates the OpenID Connect Server configuration from the UI, and includes sample applications.

The default sample application attempts to be as close as possible to the maven overlay web application from MITREid, while other samples give examples of how to customize the OpenID Connect server to fit your needs.

Pull requests and feature improvements are welcome.

Currently supports Spring Boot 1.5.21, MitreId Connect 1.3.3, and Spring Security 4.3.22

Password Encoders

The possibility of using a different password encoders for users and clients has been added through configuration. From now on you can configure MIDTREID Connect with some of the four types of encoders that come out-of-the-box in Spring.

To configure a different encoder type (the default encoder NoOpPasswordEncoder), the following configuration must be added to the yml file:

openid:
  connect:
    crypto:
      password-encoder:
        clients:
          bcrypt:
            enabled: true
            strength: -1
        users:
          bcrypt: 
            enabled: true
            strength: -1    `

openid.connect.crypto.password-encoder.clients defines the password encoder for clients and in openid.crypto.password-encoder.users for users.

The configuration of the different types of encoders is shown below.

BCrypt Password Encoder

To configure a BCrypt password encoder you will need to add the bcrypt property with the following properties:

• enabled: enables (true) or disables (false) the encoder
• strength: the log rounds to use, between 4 and 31

openid:
  connect:
    crypto:
      password-encoder:
        clients:
          bcrypt:
            enabled: true
            strength: -1
        users:
          bcrypt: 
            enabled: true
            strength: -1   

SCrypt Password Encoder

To configure a SCrypt password encoder you will need to add the scrypt property with the following properties:

• enabled: enables (true) or disables (false) the encoder
• cpu-cost: cpu cost of the algorithm (as defined in scrypt this is N). must be power of 2 greater than 1. Default is currently 16,348 or 2^14)
• memory-cost: memory cost of the algorithm (as defined in scrypt this is r) Default is currently 8.
• parallelization: the parallelization of the algorithm (as defined in scrypt this is p) Default is currently 1. Note that the implementation does not currently take advantage of parallelization.
• key-length: key length for the algorithm (as defined in scrypt this is dkLen). The default is currently 32.
• salt-length: salt length (as defined in scrypt this is the length of S). The default is currently 64.

openid:
  connect:
    crypto:
      password-encoder:
        clients:
          scrypt:
            enabled: true
            cpu-cost: 16384
            memory-cost: 8
            parallelization: 1
            key-length: 32
            salt-length: 64
        users:
          scrypt: 
            enabled: true
            cpu-cost: 16384
            memory-cost: 8
            parallelization: 1
            key-length: 32
            salt-length: 64 

Standard Password Encoder

To configure a Standard password encoder you will need to add the standard property with the following properties:

• enabled: enables (true) or disables (false) the encoder
• secret: the secret key used in the encoding process (should not be shared). Default ""

openid:
  connect:
    crypto:
      password-encoder:
        clients:
          standard:
            enabled: true
            secret: a_secret_word
        users:
          standard: 
            enabled: true
            secret: a_secret_word     

Pbkdf2 Password Encoder

To configure a Pbkdf2 password encoder you will need to add the pbkdf2 property with the following properties:

• enabled: enables (true) or disables (false) the encoder
• secret: the secret key used in the encoding process (should not be shared)

openid:
  connect:
    crypto:
      password-encoder:
        clients:
          pbkdf2:
            enabled: true
            secret: a_secret_word
        users:
          pbkdf2: 
            enabled: true
            secret: a_secret_word

openid-connect-server-spring-boot's Issues

Cluster configuration

Hi. Is there any special configuration to set a cluster server? Or simply setting a balancer above the nodes would be enough to have a configuration in high availability?

psql_database.tables.sql syntax error

The script has syntax error using unknown keyword for PostgreSQL

CREATE TABLE IF NOT EXISTS device_code (
id BIGINT AUTO_INCREMENT PRIMARY KEY,

should I believe be

id SERIAL PRIMARY KEY

Password encoder doesnt work from Web Interface

Hi!

I have bcrypt encoder enabled for both, clients and users, at application.yml file and everything works correctly when I use the exposed API.

The problem I have is that the encoder is not being used from the web interface and client passwords are kept clear and not encrypted.

In the application.yml I have the following configuration:

crypto:
   password-encoder:
     clients:
       bcrypt:
         enabled: true
     users:
       bcrypt:
         enabled: true

"#" instead of"$" approve.html

[THYMELEAF][http-nio-8080-exec-9] Exception processing template "approve": Exception evaluating SpringEL expression: "approve.dynamically_registered(${client.createdAt})" (approve:45)

"${approve.dynamically_registered(${client.createdAt})}" --->"#" instead of"$"
"#{approve.dynamically_registered(${client.createdAt})}"

Upgrade MitreId Connect to 1.3.0

A few days ago version 1.3.0 of MITREid Connect was released: https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/tree/mitreid-connect-1.3.0

Dependency conflicts when converting to maven

This is a question basically. I tried to convert the project to use maven instead of gradle. But faced several dependency conflicts. spring-beans version was overridden to 4.0.9 due to spring-security-oauth dependency and so on. The compiler started to complain of various things. Any guidance on how can I transition your project to use maven? What I basically tried was to use the pom file generated in the build folder and use it as the main pom.xml file.

UI menu empty

Hi, when I start this up the lefthand menu is empty (section headers ADMINISTRATIVE, PERSONAL, DEVELOPER).

I'm running it inside a container on port 8081 but I've done the necessary forwarding so I have CSS+images loaded.

Release current master

I'd like to make use of your library and it's latest changes, but cannot use a snapshot version. Are you planning on releasing the latest changes soon?