OpenID Connect & Discovery client library using async / await

Legal

Dual-licensed under MIT or the UNLICENSE.

Features

Implements OpenID Connect Core 1.0 and OpenID Connect Discovery 1.0.

Implements UMA2 - User Managed Access, an extension to OIDC/OAuth2. Use feature flag uma2 to enable this feature.

It supports Microsoft OIDC with feature microsoft. This adds methods for authentication and token validation, those skip issuer check.

This library is a quick and dirty rewrite of inth-oauth2 and oidc to use async / await. The basic idea was to solve a specific problem, with the result that most of the good ideas from the original boxes were perverted and oversimplified.

Using reqwest for the HTTP client and biscuit for Javascript Object Signing and Encryption (JOSE).

Usage

Add dependency to Cargo.toml:

toml [dependencies] openid = "0.12"

By default it uses native tls, if you want to use rustls:

toml [dependencies] openid = { version = "0.12", default-features = false, features = ["rustls"] }

Use case: Warp web server with JHipster generated frontend and Google OpenID Connect

This example provides only Rust part, assuming just default JHipster frontend settings.

Cargo.toml:

```toml [package] name = "openid-example" version = "0.1.0" authors = ["Alexander Korolev alexander.korolev.germany@gmail.com"] edition = "2021"

[dependencies] anyhow = "1.0" cookie = "0.14" log = "0.4" openid = "0.12" prettyenvlogger = "0.4" reqwest = "0.11" serde = { version = "1", features = [ "derive" ] } tokio = { version = "1", features = [ "full" ] } uuid = { version = "0.8", features = [ "v4" ] } warp = "0.3" ```

src/main.rs:

```rust use std::{collections::HashMap, convert::Infallible, env, sync::Arc};

use log::{error, info}; use openid::{Client, Discovered, DiscoveredClient, Options, StandardClaims, Token, Userinfo}; use openidwarpexample::INDEX_HTML; use serde::{Deserialize, Serialize}; use tokio::sync::RwLock; use warp::{ http::{Response, StatusCode}, reject, Filter, Rejection, Reply, };

type OpenIDClient = Client;

const EXAMPLECOOKIE: &str = "openidwarp_example";

[derive(Deserialize, Debug)]

pub struct LoginQuery { pub code: String, pub state: Option, }

[derive(Serialize, Deserialize, Debug, Default, Clone)]

[serde(rename_all = "camelCase")]

pub(crate) struct User { pub(crate) id: String, pub(crate) login: Option, pub(crate) firstname: Option, pub(crate) lastname: Option, pub(crate) email: Option, pub(crate) imageurl: Option, pub(crate) activated: bool, pub(crate) langkey: Option, pub(crate) authorities: Vec, }

[derive(Default)]

struct Sessions { map: HashMap

[tokio::main]

async fn main() -> anyhow::Result<()> { if env::varos("RUSTLOG").isnone() { // Set RUST_LOG=openid_warp_example=debug to see debug logs, // this only shows access logs. env::setvar("RUSTLOG", "openidwarpexample=info"); } prettyenv_logger::init();

let client_id = env::var("CLIENT_ID").unwrap_or("<client id>".to_string());
let client_secret = env::var("CLIENT_SECRET").unwrap_or("<client secret>".to_string());
let issuer_url = env::var("ISSUER").unwrap_or("https://accounts.google.com".to_string());
let redirect = Some(host("/login/oauth2/code/oidc"));
let issuer = reqwest::Url::parse(&issuer_url)?;

eprintln!("redirect: {:?}", redirect);
eprintln!("issuer: {}", issuer);

let client =
    Arc::new(DiscoveredClient::discover(client_id, client_secret, redirect, issuer).await?);

eprintln!("discovered config: {:?}", client.config());

let with_client = |client: Arc<Client<_>>| warp::any().map(move || client.clone());

let sessions = Arc::new(RwLock::new(Sessions::default()));

let with_sessions = |sessions: Arc<RwLock<Sessions>>| warp::any().map(move || sessions.clone());

let index = warp::path::end()
    .and(warp::get())
    .map(|| warp::reply::html(INDEX_HTML));

let authorize = warp::path!("oauth2" / "authorization" / "oidc")
    .and(warp::get())
    .and(with_client(client.clone()))
    .and_then(reply_authorize);

let login = warp::path!("login" / "oauth2" / "code" / "oidc")
    .and(warp::get())
    .and(with_client(client.clone()))
    .and(warp::query::<LoginQuery>())
    .and(with_sessions(sessions.clone()))
    .and_then(reply_login);

let api_account = warp::path!("api" / "account")
    .and(warp::get())
    .and(with_user(sessions))
    .map(|user: User| warp::reply::json(&user));

let routes = index
    .or(authorize)
    .or(login)
    .or(api_account)
    .recover(handle_rejections);

let logged_routes = routes.with(warp::log("openid_warp_example"));

warp::serve(logged_routes).run(([127, 0, 0, 1], 8080)).await;

Ok(())

}

async fn requesttoken( oidcclient: Arc, loginquery: &LoginQuery, ) -> anyhow::Resultclient.requesttoken(&loginquery.code).await?.into();

if let Some(mut id_token) = token.id_token.as_mut() {
    oidc_client.decode_token(&mut id_token)?;
    oidc_client.validate_token(&id_token, None, None)?;
    info!("token: {:?}", id_token);
} else {
    return Ok(None);
}

let userinfo = oidc_client.request_userinfo(&token).await?;

info!("user info: {:?}", userinfo);

Ok(Some((token, userinfo)))

        let login = user_info.preferred_username.clone();
        let email = user_info.email.clone();

        let user = User {
            id: user_info.sub.clone().unwrap_or_default(),
            login,
            last_name: user_info.family_name.clone(),
            first_name: user_info.name.clone(),
            email,
            activated: user_info.email_verified,
            image_url: user_info.picture.clone().map(|x| x.to_string()),
            lang_key: Some("en".to_string()),
            authorities: vec!["ROLE_USER".to_string()],
        };

        let authorization_cookie = ::cookie::Cookie::build(EXAMPLE_COOKIE, &id)
            .path("/")
            .http_only(true)
            .finish()
            .to_string();

        sessions
            .write()
            .await
            .map
            .insert(id, (user, token, user_info));

        let redirect_url = login_query.state.clone().unwrap_or_else(|| host("/"));

        Ok(Response::builder()
            .status(StatusCode::MOVED_PERMANENTLY)
            .header(warp::http::header::LOCATION, redirect_url)
            .header(warp::http::header::SET_COOKIE, authorization_cookie)
            .body("")
            .unwrap())
    }
    Ok(None) => {
        error!("login error in call: no id_token found");

        Ok(Response::builder()
            .status(StatusCode::UNAUTHORIZED)
            .body("")
            .unwrap())
    }
    Err(err) => {
        error!("login error in call: {:?}", err);

        Ok(Response::builder()
            .status(StatusCode::UNAUTHORIZED)
            .body("")
            .unwrap())
    }
}

let auth_url = oidc_client.auth_url(&Options {
    scope: Some("openid email profile".into()),
    state: Some(origin_url),
    ..Default::default()
});

info!("authorize: {}", auth_url);

let url = auth_url.into_string();

Ok(warp::reply::with_header(
    StatusCode::FOUND,
    warp::http::header::LOCATION,
    url,
))

Ok(warp::reply::with_status(warp::reply(), code))