-
Notifications
You must be signed in to change notification settings - Fork 692
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into improve-default-oauth-interceptor
- Loading branch information
Showing
133 changed files
with
19,753 additions
and
45,806 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| { | ||
| // Use IntelliSense to learn about possible attributes. | ||
| // Hover to view descriptions of existing attributes. | ||
| // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 | ||
| "version": "0.2.0", | ||
| "configurations": [ | ||
| { | ||
| "type": "chrome", | ||
| "request": "launch", | ||
| "name": "Launch Chrome against localhost", | ||
| "url": "http://localhost:4200", | ||
| "webRoot": "${workspaceFolder}" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # Code Flow | ||
|
|
||
| Since Version 8, this library also supports code flow and [PKCE](https://tools.ietf.org/html/rfc7636) to align with the current draft of the [OAuth 2.0 Security Best Current Practice](https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13) document. | ||
|
|
||
|
|
||
| To configure your solution for code flow + PKCE you have to set the `responseType` to `code`: | ||
|
|
||
| ```TypeScript | ||
|
|
||
| import { AuthConfig } from 'angular-oauth2-oidc'; | ||
|
|
||
| export const authCodeFlowConfig: AuthConfig = { | ||
| // Url of the Identity Provider | ||
| issuer: 'https://demo.identityserver.io', | ||
|
|
||
| // URL of the SPA to redirect the user to after login | ||
| redirectUri: window.location.origin + '/index.html', | ||
|
|
||
| // The SPA's id. The SPA is registerd with this id at the auth-server | ||
| // clientId: 'server.code', | ||
| clientId: 'spa', | ||
|
|
||
| // Just needed if your auth server demands a secret. In general, this | ||
| // is a sign that the auth server is not configured with SPAs in mind | ||
| // and it might not enforce further best practices vital for security | ||
| // such applications. | ||
| // dummyClientSecret: 'secret', | ||
|
|
||
| responseType: 'code', | ||
|
|
||
| // set the scope for the permissions the client should request | ||
| // The first four are defined by OIDC. | ||
| // Important: Request offline_access to get a refresh token | ||
| // The api scope is a usecase specific one | ||
| scope: 'openid profile email offline_access api', | ||
|
|
||
| showDebugInformation: true, | ||
|
|
||
| // Not recommented: | ||
| // disablePKCI: true, | ||
| }; | ||
| ``` | ||
|
|
||
| After this, you can initialize the code flow using: | ||
|
|
||
| ```TypeScript | ||
|
|
||
| this.oauthService.initCodeFlow(); | ||
| ``` | ||
|
|
||
| There is also a convenience method `initLoginFlow` which initializes either the code flow or the implicit flow depending on your configuration. | ||
|
|
||
| ```TypeScript | ||
| this.oauthService.initLoginFlow(); | ||
| ``` | ||
|
|
||
| Also -- as shown in the readme -- you have to execute the following code when bootstrapping to make the library to fetch the token: | ||
|
|
||
| ```TypeScript | ||
| this.oauthService.configure(authCodeFlowConfig); | ||
| this.oauthService.tokenValidationHandler = new JwksValidationHandler(); | ||
| this.oauthService.loadDiscoveryDocumentAndTryLogin(); | ||
| ``` | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| # Code Flow | ||
|
|
||
| Since Version 8, this library also supports code flow and [PKCE](https://tools.ietf.org/html/rfc7636) to align with the current draft of the [OAuth 2.0 Security Best Current Practice](https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13) document. | ||
|
|
||
|
|
||
| To configure your solution for code flow + PKCE you have to set the `responseType` to `code`: | ||
|
|
||
| ```TypeScript | ||
| import { AuthConfig } from 'angular-oauth2-oidc'; | ||
|
|
||
| export const authCodeFlowConfig: AuthConfig = { | ||
| // Url of the Identity Provider | ||
| issuer: 'https://demo.identityserver.io', | ||
|
|
||
| // URL of the SPA to redirect the user to after login | ||
| redirectUri: window.location.origin + '/index.html', | ||
|
|
||
| // The SPA's id. The SPA is registerd with this id at the auth-server | ||
| // clientId: 'server.code', | ||
| clientId: 'spa', | ||
|
|
||
| // Just needed if your auth server demands a secret. In general, this | ||
| // is a sign that the auth server is not configured with SPAs in mind | ||
| // and it might not enforce further best practices vital for security | ||
| // such applications. | ||
| // dummyClientSecret: 'secret', | ||
|
|
||
| responseType: 'code', | ||
|
|
||
| // set the scope for the permissions the client should request | ||
| // The first four are defined by OIDC. | ||
| // Important: Request offline_access to get a refresh token | ||
| // The api scope is a usecase specific one | ||
| scope: 'openid profile email offline_access api', | ||
|
|
||
| showDebugInformation: true, | ||
|
|
||
| // Not recommented: | ||
| // disablePKCI: true, | ||
| }; | ||
| ``` | ||
|
|
||
| After this, you can initialize the code flow using: | ||
|
|
||
| ```TypeScript | ||
| this.oauthService.initCodeFlow(); | ||
| ``` | ||
|
|
||
| There is also a convenience method `initLoginFlow` which initializes either the code flow or the implicit flow depending on your configuration. | ||
|
|
||
| ```TypeScript | ||
| this.oauthService.initLoginFlow(); | ||
| ``` | ||
|
|
||
| Also -- as shown in the readme -- you have to execute the following code when bootstrapping to make the library to fetch the token: | ||
|
|
||
| ```TypeScript | ||
| this.oauthService.configure(authCodeFlowConfig); | ||
| this.oauthService.tokenValidationHandler = new JwksValidationHandler(); | ||
| this.oauthService.loadDiscoveryDocumentAndTryLogin(); | ||
| ``` | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # Configure custom OAuthStorage | ||
|
|
||
| This library uses `sessionStorage` as the default storage provider. You can customize this by using `localStorage` or your own storage solution. | ||
|
|
||
| ## Using localStorage | ||
| If you want to use `localStorage` instead of `sessionStorage`, you can add a provider to your AppModule. This works as follows: | ||
|
|
||
| ```TypeScript | ||
| import { HttpClientModule } from '@angular/common/http'; | ||
| import { OAuthModule } from 'angular-oauth2-oidc'; | ||
| // etc. | ||
|
|
||
| // We need a factory, since localStorage is not available during AOT build time. | ||
| export function storageFactory() : OAuthStorage { | ||
| return localStorage | ||
| } | ||
|
|
||
| @NgModule({ | ||
| imports: [ | ||
| // etc. | ||
| HttpClientModule, | ||
| OAuthModule.forRoot() | ||
| ], | ||
| declarations: [ | ||
| AppComponent, | ||
| HomeComponent, | ||
| // etc. | ||
| ], | ||
| bootstrap: [ | ||
| AppComponent | ||
| ], | ||
| providers: [ | ||
| { provide: OAuthStorage, useFactory: storageFactory } | ||
| ] | ||
| }) | ||
| export class AppModule { | ||
| } | ||
| ``` | ||
|
|
||
| ## Custom storage solution | ||
|
|
||
| If you want to use a custom storage solution, you can extend the `OAuthStorage` class. Documentation can be found [here](../classes/OAuthStorage.html#info). Then add it as a provider, just like in the `localStorage` example above. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| # Discovery Document Validation | ||
|
|
||
| The configuration parameter `strictDiscoveryDocumentValidation` is set `true` by default. This ensures that all of the endpoints provided via the ID Provider discovery document share the same base URL as the `issuer` parameter. | ||
|
|
||
| Several ID Providers (i.e. Google OpenID, WS02-IS, PingOne) provide different domains or path params for various endpoints in the discovery document. These providers may still adhere to the [OpenID Connect Provider Configuration specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse), but will fail to pass this library's discovery document validation. | ||
|
|
||
| To use this library with an ID Provider that does not maintain a consistent base URL across the discovery document endpoints, set the `strictDiscoveryDocumentValidation` parameter to `false` in your configuration: | ||
|
|
||
| ```TypeScript | ||
| import { AuthConfig } from 'angular-oauth2-oidc'; | ||
|
|
||
| export const authConfig: AuthConfig = { | ||
|
|
||
| // Url of the Identity Provider | ||
| issuer: 'https://steyer-identity-server.azurewebsites.net/identity', | ||
|
|
||
| // URL of the SPA to redirect the user to after login | ||
| redirectUri: window.location.origin + '/index.html', | ||
|
|
||
| // The SPA's id. The SPA is registerd with this id at the auth-server | ||
| clientId: 'spa-demo', | ||
|
|
||
| // set the scope for the permissions the client should request | ||
| // The first three are defined by OIDC. The 4th is a usecase-specific one | ||
| scope: 'openid profile email voucher', | ||
|
|
||
| // turn off validation that discovery document endpoints start with the issuer url defined above | ||
| strictDiscoveryDocumentValidation: false | ||
| } | ||
| ``` |
Oops, something went wrong.