tangui
Releasing Plugoid, an OpenID Connect library for Phoenix
I’m glad to release the first version of Plugoid, an OpenID Connect library for Phoenix.
This library can be useful if you delegate authentication completely to an OpenID Connect Provider.
Example configuration:
defmodule MyApp.Router do
use MyApp, :router
use Plugoid.RedirectURI
pipeline :oidc_auth do
plug Plugoid,
issuer: "https://repentant-brief-fishingcat.gigalixirapp.com",
client_id: "client1",
client_config: MyApp.OpenIDConnect.Client
end
scope "/private", MyApp do
pipe_through :browser
pipe_through :oidc_auth
get "/", PageController, :index
post "/", PageController, :index
end
end
More information here:
Although it’s version 0.1.0, it has a quite comprehensive support of the standard (see the README for more information). Any feedback is welcome on the issue tracker!
You can try it out with the https://github.com/tanguilp/plugoid_demo application.
For those working with OAuth2 or OpenID Connect, a few additional libraries that were needed to build Plugoid could prove useful:
-
Oauth2MetadataUpdater: retrieves OAuth2 and OpenID Connect metadata -
JWKSURIUpdater: JWKS key downloader -
OAuth2TokenManager: manages OAuth2 tokens and OpenID Connect claims and ID tokens -
JOSEUtils: Convenience functions to work with JOSE (JSON Object Signing and Encryption) on top of theJOSElibrary -
TeslaOAuth2ClientAuth: Tesla middlewares for OAuth2 and OpenID Connect client authentication
Also I’ve seen that some people were looking for some project to contribute too - for those, feel free to look at the issue trackers of these libraries and contact me if you’re interested on working on an issue.
Have a good evening!
Most Liked
tangui
Thanks!
State is always used, this is how we found the challenge when redirected back from the OP. Nonce is used when mandatory (implicit and hybrid flows), but can be forced with the :use_nonce option.
Depends what you mean by verify, but the state is used to match the correct OIDC challenge generated before redirecting to the OP. State is a secure random string (and not a encrypted token).
Yes, and also "c_hash". Nonce can also be checked against replay (see the :jti_register option in Plugoid.RedirectURI, the demo app uses it).
tangui
Exadra37
Congrats for your release 
Some questions
Do you enforce the use of state and nonce when getting the OpenID Connect Token?
Do you verify the state param in the provider callback?
Do you verify the nonce and the at_hash in the OpenID Connect token claims?
Exadra37
So this means that by default you are open to replay attacks. I enforce the use of a nonce as an encrypted token in my implementation.
In my opinion security should be opt-out not opt-in, therefore I would prefer to this parameter be used by default, and if people really want to disable it then you gaive them that option with :disable_nonce.
By verify I mean to check that was the one you sent, but it seems that you do it, once you use to match the correct OIDC, but I have not looked into your code.
I prefer encrypted tokens, because then I can check the signature and the expire time. Call me paranoid, but with hackers security is never enough.
Thats awesome 
Awesome that you detect replay attacks :), but its a pity that is not enforced by default as I mention above.
tangui
Thanks for your feedback!
Not in the authorization code flow, because the authorization code can be used only once. And nonce is used in the other flows. Also, PKCE is used by default (if supported by the server) which adds another layer of defense.
Good point, I think I should add a maximum timeout for challenges.
It would be useless in the authorization code flow, and also it’s hard to setup a distributed token ID register from a library but I plan to work on this point. That said, the library defaults to the implicit flow with "form_post" response type if available at the OP (and authorization code flow otherwise). I don’t see a scenario where an attacker could access POST data without having access to browser cookies (in which case protecting against replay is meaningless) but I’ll review this choice further.
Popular in Libraries
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
Develop your skills with books, videos, and courses.
Categories:
Sub Categories:
Forums
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Practical resources that improve the lives of professional developers.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"