Comments (6)
Any recommendations regarding my authorization requirements? I cannot do authorization with oidc currently and have to query a separate backend (ldap). Whats the best way to pair that with oidc? check roles on every request (+cache)? Using a session ? or any other idea?
Your IdP could query the LDAP and append the groups as claim to the userinfo/introspect endpoint or the tokens. The decision to cache or refresh depends on how much risk your service can take. Or in other words, if you need a high level of guarantees don't cache.
from oidc.
Thanks i consider that. Everything is clear now, so ill close.
from oidc.
Hey @fl0wx
I'm unsure if I understand the question correctly. Do you want to create a REST API in Go and us it with a SPA?
If so, I would not recommend using the steps described. The SPA should get the token(s) on its own and just send the access_token to the REST API. The API then can for example verify it using the token introspection.
from oidc.
I'm unsure if I understand the question correctly. Do you want to create a REST API in Go and us it with a SPA?
yes, but authorization will be done separate (ldap groups).
If so, I would not recommend using the steps described. The SPA should get the token(s) on its own and just send the access_token to the REST API. The API then can for example verify it using the token introspection.
i read many times that this approach is not recommended because of security concerns. In that case i need to store the access token in the browser, right?
and even if i fetch the access token directly in my spa, i have the issue where to save / transmit the secret key?
from oidc.
@fl0wx :
If so, I would not recommend using the steps described. The SPA should get the token(s) on its own and just send the access_token to the REST API. The API then can for example verify it using the token introspection.
i read many times that this approach is not recommended because of security concerns. In that case i need to store the access token in the browser, right?
and even if i fetch the access token directly in my spa, i have the issue where to save / transmit the secret key?
If you use PKCE (Proof Key for Code Exchange: RFC 7636) correctly then there's not much of a concern. You will have a randomly generated validation token instead of client_secret and store the access_token in the session storage of the browser.
There are a lot of certified OIDC libraries for all common SPA languages / frameworks which will do exactly this.
For more info, please checkout the docs of our IAM as well on how to login a user into a (SPA) app:
https://docs.zitadel.ch/docs/guides/authentication/login-users
And we also have some quickstarts for some SPA frameworks (incl. Angular and React): https://docs.zitadel.ch/docs/quickstarts/introduction
On the API side, you can then use the introspection endpoint to validate if the token is (still) valid. A boolean active
will be returned and depending on the implementation of your Auth Server it might return more information (username, ...)
This library will help you with that call. Check out the api example (/example/client/api) and the resource server package (/pkg/client/rs)
You could of course cache the introspection response of a token for some time (e.g. 5min) and not always introspect it on every request.
from oidc.
ok thanks, i´ll try that.
Any recommendations regarding my authorization requirements? I cannot do authorization with oidc currently and have to query a separate backend (ldap). Whats the best way to pair that with oidc? check roles on every request (+cache)? Using a session ? or any other idea?
from oidc.
Related Issues (20)
- Allow custom forwarded header HOT 2
- [Bug]: client invalid signature when OIDC server is restarted HOT 2
- The automated release is failing 🚨
- [Bug]: nil pointer dereference in `crypto.BytesToPrivateKey` HOT 3
- Access to auto discovery configuration HOT 3
- Allow empty nonce from ID Tokens issued from Refresh Tokens HOT 10
- Support form_post OIDC response mode HOT 4
- Do not ignore all JWKS parsing errors HOT 3
- [Bug]: nil pointer dereference when not setting unauthorized handler HOT 2
- Switch to `log/slog` HOT 2
- [Bug]: The behavior of response_mode does not adhere to the guidelines HOT 2
- Support ``verification_url`` mispelling in the device auth response HOT 6
- Set IDTokenSigningAlgValuesSupported of DiscoveryConfiguration obtained by Discover when initializing RelyingParty. HOT 3
- Update to go-jose/v4 HOT 4
- add prometheus metrics for apis HOT 2
- JWT Profile Grant: return id_token if openid scope is set HOT 11
- I want to increase the defaults for signature algorithm. HOT 2
- Question about licensing HOT 5
- Help: native client app use?
- [Bug]: Validation of redirect_uri is not performed before redirect HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oidc.