Solid-OIDC login #123

srosset81 · 2023-11-15T08:39:04Z

Closes #121
Closes #120
Closes #112
Closes #113

⚠️ Requires assemblee-virtuelle/semapps#1206

Implements node-oidc-provider, a full OIDC provider
Follow Solid authorization flow like the Community Solid Server
Don't implement yet the request flow with DPoP token
- This will require additional time but, with a working OIDC provider, it shouldn't be so complicated.
The frontend app use the returned ID token to connect to the Pod (it includes the client URI as well so that we may authorize it to see only the data the app requested)
The Pod provider frontend keeps on using a custom JWT to connect with the backend

Laurin-W · 2023-11-22T10:26:06Z

app-boilerplate/frontend/.env

@@ -5,7 +5,7 @@ REACT_APP_LANG="en"
 # This is useful to test a pod provider in a local dev environment
 REACT_APP_POD_PROVIDER_DOMAIN_NAME=

-REACT_APP_BACKEND_DOMAIN_NAME=localhost:3001
+REACT_APP_BACKEND_CLIENT_ID=http://localhost:3001/actors/app


Isn't the client identifier identifying the frontend application?

The client_id is where the Client ID document is, and that's on the backend.
On the same URL, you have the as:Application (which must be backend) and interop:Application.
But I agree there is a possible confusion. Should we have two clients ID for backend and frontend ? That wouldn't make much sense since it's the same app requesting the same rights. I haven't seen anything on Solid for this case. Maybe something to discuss with them...

I want to add that, for production app, I plan to use the same domain name. Traefik will redirect all /api and /.well-known calls to the middleware. It will thus be an hybrid application, much like NextJS API routes.

Laurin-W · 2023-11-22T11:00:56Z

packages/app/services/actors.js

+                'oidc:grant_types': ['refresh_token', 'authorization_code'],
+                'oidc:response_types': ['code'],
+                'oidc:default_max_age': 3600,
+                'oidc:require_auth_time': true


To the list, I would add:

"token_endpoint_auth_method": "none", <- to comply with oidc spec (where default is `client_secret_basic`) "policy_uri": "", "contacts": [], "application_type": "web",

Also, maybe it's better to leave out the prefixes, to improve compatibility with services that doen't speak jsonld? And adding https://www.w3.org/ns/solid/oidc-context.jsonld explicitly.

See also:
https://solidproject.org/TR/oidc#clientids-document
https://solid-client-identifier-helper.vercel.app/documentation

To the list I would add:

"token_endpoint_auth_method": "none", <- to comply with oidc spec (where default is `client_secret_basic`) "policy_uri": "", "contacts": [], "application_type": "web",

We cannot have empty strings or arrays when we use a triple store for storage.
Adding token_endpoint_auth_method is a good idea, thanks.
For application_type, is it really "web" since this is a backend client ID ?

Also, maybe it's better to leave out the prefixes, to improve compatibility with services that doen't speak jsonld? And adding https://www.w3.org/ns/solid/oidc-context.jsonld explicitly.

That's the whole problem of handling contexts correctly, that I haven't tackled yet.
Unfortunately https://www.w3.org/ns/solid/oidc-context.jsonld is a terrible context, with all @id being changed to client_id and entering into conflict with the AS context. So it cannot be used in the whole code base.
I've looked at the CSS code and, if it doesn't find the https://www.w3.org/ns/solid/oidc-context.jsonld context, it will parse the data as regular RDF and it will work.

We cannot have empty strings or arrays when we use a triple store for storage.

My bad, that was suppoed to be this.settings.oidc.plicy_uri and so on :)

For application_type, is it really "web" since this is a backend client ID ?

It doesn't have to be but it defaults to web, if not specified.

That's the whole problem of handling contexts correctly, that I haven't tackled yet.
Unfortunately https://www.w3.org/ns/solid/oidc-context.jsonld is a terrible context, with all @id being changed to client_id and entering into conflict with the AS context. So it cannot be used in the whole code base.
I've looked at the CSS code and, if it doesn't find the https://www.w3.org/ns/solid/oidc-context.jsonld context, it will parse the data as regular RDF and it will work.

Mh, that's annoying. Would it make sense though for client identifier documents, go with both anyways and make use of jsonld context overriding?

Would it make sense though for client identifier documents, go with both anyways and make use of jsonld context overriding?

I don't understand. For information, when fetching the document from the OIDC provider, we use the JsonLdContext header with https://www.w3.org/ns/solid/oidc-context.jsonld to have nicely formatted data.

For information, when fetching the document from the OIDC provider, we use the JsonLdContext header with https://www.w3.org/ns/solid/oidc-context.jsonld to have nicely formatted data.

Ah ok, I think that was the information missing for me, thanks! :)
How is it formatted, if no JsonLdContext header is passed though?

It is correct JSON-LD data, but it will not be understood by a software that only reads JSON (as mentionned elsewhere, the Community Solid Server is able to understand JSON-LD no matter the context used).

Laurin-W · 2023-11-22T11:12:18Z

packages/core/services/jwk.js

+      this.privateJwk = JSON.parse(fs.readFileSync(privateKeyPath));
+      this.publicJwk = JSON.parse(fs.readFileSync(publicKeyPath));
+    }
+  },


Why are the keys stored on the filesystem and not the db?

That's what we do with the similar auth.jwt service. But indeed it could be saved in the private settings dataset

packages/core/services/oidc-provider/oidc-provider.js

Laurin-W · 2023-11-22T16:27:22Z

packages/core/services/oidc-provider/oidc-provider.js

+      return Promise.reject(new E.UnAuthorizedError(E.ERR_NO_TOKEN));
+    },
+    async proxyConfig() {
+      const res = await fetch(`${this.settings.baseUrl}.oidc/auth/.well-known/openid-configuration`);


Why the fetch?

The node-oidc-provider library use koa internally, and I haven't found a way to proxy directly to this route.

Laurin-W · 2023-11-22T16:29:42Z

packages/core/services/oidc-provider/oidc-provider.js

@@ -0,0 +1,133 @@
+const Redis = require('ioredis');


What is redis required for?

The node-oidc-provider library needs to store data. We chose a Redis adapter since it's already in the stack, for cache and queue management.

srosset81 · 2023-11-27T13:08:29Z

I will go and merge this PR, and we can continue these discussions here or on issues if this feels important.

srosset81 added 6 commits November 15, 2023 09:36

Add OIDC client document to application

4b93683

First iteration of OIDC provider

ce9ba41

Add OIDC login to PodLoginPage

6f8252e

Merge branch 'external-apps' into solid-oidc-login

2bb4a98

Merge branch 'external-apps' into solid-oidc-login

33e829b

Use SemApps 0.6.0-alpha.4 for app boilerplate to remove node-sass

4496a55

srosset81 linked an issue Nov 16, 2023 that may be closed by this pull request

Use part of Solid-OIDC to login #121

Closed

Working Oauth login and logout

c42c729

srosset81 marked this pull request as ready for review November 20, 2023 17:13

srosset81 linked an issue Nov 20, 2023 that may be closed by this pull request

Use Solid Client ID document for applications #120

Closed

srosset81 mentioned this pull request Nov 20, 2023

Implement refresh tokens #113

Closed

This was linked to issues Nov 20, 2023

Adapt existing code to take into account app-specific JWT tokens #112

Closed

Implement refresh tokens #113

Closed

srosset81 mentioned this pull request Nov 21, 2023

ActivityPod as OIDC provider? #67

Open

Laurin-W reviewed Nov 22, 2023

View reviewed changes

srosset81 added 2 commits November 27, 2023 10:37

Set cookie secret as an env variable

e98e4d2

Fix tests configuration

5b9d1b2

srosset81 merged commit 59f81b8 into external-apps Nov 27, 2023

srosset81 deleted the solid-oidc-login branch November 27, 2023 13:09

srosset81 mentioned this pull request Nov 27, 2023

Release v2.0 #106

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Solid-OIDC login #123

Solid-OIDC login #123

srosset81 commented Nov 15, 2023 •

edited

Laurin-W Nov 22, 2023

srosset81 Nov 22, 2023 •

edited

srosset81 Nov 22, 2023

Laurin-W Nov 22, 2023

srosset81 Nov 22, 2023

Laurin-W Nov 22, 2023

srosset81 Nov 23, 2023

Laurin-W Dec 5, 2023

srosset81 Dec 5, 2023

Laurin-W Nov 22, 2023

srosset81 Nov 22, 2023 •

edited

Laurin-W Nov 22, 2023

srosset81 Nov 23, 2023

Laurin-W Nov 22, 2023

srosset81 Nov 23, 2023

srosset81 commented Nov 27, 2023

Solid-OIDC login #123

Solid-OIDC login #123

Conversation

srosset81 commented Nov 15, 2023 • edited

Choose a reason for hiding this comment

srosset81 Nov 22, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

srosset81 Nov 22, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

srosset81 commented Nov 27, 2023

srosset81 commented Nov 15, 2023 •

edited

srosset81 Nov 22, 2023 •

edited

srosset81 Nov 22, 2023 •

edited