125 lines
3.5 KiB
TypeScript
125 lines
3.5 KiB
TypeScript
// import * as oidc from "openid-client";
|
|
// import * as dotenv from "dotenv";
|
|
|
|
// dotenv.config();
|
|
|
|
|
|
|
|
// process.env
|
|
// const server = new URL("http://localhost:3000");
|
|
|
|
// // Discover the provider metadata
|
|
|
|
// // const as = await oidc.discovery(server, "application", undefined, undefined, { execute: [oidc.allowInsecureRequests] });
|
|
|
|
// // console.dir(as.clientMetadata());
|
|
|
|
// // // Register a new client
|
|
// const client = await oidc.dynamicClientRegistration(server, {
|
|
// redirect_uris: ["http://foo.com"],
|
|
// grant_types: ["authorization_code", "refresh_token"],
|
|
// response_types: ["code"],
|
|
// token_endpoint_auth_method: "client_secret_basic",
|
|
// }, undefined, {execute: [oidc.allowInsecureRequests]});
|
|
|
|
// console.log(client.serverMetadata())
|
|
// console.log(client.clientMetadata())
|
|
|
|
// const state = oidc.randomState();
|
|
// const codeVerifier = oidc.randomPKCECodeVerifier();
|
|
|
|
// const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
|
|
|
|
// const authUrl = oidc.buildAuthorizationUrl(as, {
|
|
// client_id: client.client_id,
|
|
// redirect_uri: "http://localhost:4000/callback",
|
|
// response_type: "code",
|
|
// scope: "openid offline_access",
|
|
// state,
|
|
// code_challenge: codeChallenge,
|
|
// code_challenge_method: "S256",
|
|
// });
|
|
|
|
|
|
// console.log(Object.getOwnPropertyNames(client));
|
|
|
|
import * as oid from 'openid-client'
|
|
|
|
// Prerequisites
|
|
|
|
let getCurrentUrl!: (...args: any) => URL
|
|
let server!: URL // Authorization server's Issuer Identifier URL
|
|
let clientId!: string
|
|
let clientSecret!: string
|
|
/**
|
|
* Value used in the authorization request as redirect_uri pre-registered at the
|
|
* Authorization Server.
|
|
*/
|
|
let redirect_uri!: string
|
|
|
|
// End of prerequisites
|
|
|
|
let config = await oid.discovery(server, clientId, clientSecret)
|
|
|
|
let code_challenge_method = 'S256'
|
|
/**
|
|
* The following (code_verifier and potentially nonce) MUST be generated for
|
|
* every redirect to the authorization_endpoint. You must store the
|
|
* code_verifier and nonce in the end-user session such that it can be recovered
|
|
* as the user gets redirected from the authorization server back to your
|
|
* application.
|
|
*/
|
|
let code_verifier = oid.randomPKCECodeVerifier()
|
|
let code_challenge = await oid.calculatePKCECodeChallenge(code_verifier)
|
|
let nonce!: string
|
|
|
|
{
|
|
// redirect user to as.authorization_endpoint
|
|
let parameters: Record<string, string> = {
|
|
redirect_uri,
|
|
scope: 'openid email',
|
|
code_challenge,
|
|
code_challenge_method,
|
|
}
|
|
|
|
/**
|
|
* We cannot be sure the AS supports PKCE so we're going to use nonce too. Use
|
|
* of PKCE is backwards compatible even if the AS doesn't support it which is
|
|
* why we're using it regardless.
|
|
*/
|
|
if (!config.serverMetadata().supportsPKCE()) {
|
|
nonce = oid.randomNonce()
|
|
parameters.nonce = nonce
|
|
}
|
|
|
|
let redirectTo = oid.buildAuthorizationUrl(config, parameters)
|
|
|
|
console.log('redirecting to', redirectTo.href)
|
|
// now redirect the user to redirectTo.href
|
|
}
|
|
|
|
// one eternity later, the user lands back on the redirect_uri
|
|
// Authorization Code Grant
|
|
let sub: string
|
|
let access_token: string
|
|
{
|
|
let currentUrl: URL = getCurrentUrl()
|
|
let tokens = await oid.authorizationCodeGrant(config, currentUrl, {
|
|
pkceCodeVerifier: code_verifier,
|
|
expectedNonce: nonce,
|
|
idTokenExpected: true,
|
|
})
|
|
|
|
console.log('Token Endpoint Response', tokens)
|
|
;({ access_token } = tokens)
|
|
let claims = tokens.claims()!
|
|
console.log('ID Token Claims', claims)
|
|
;({ sub } = claims)
|
|
}
|
|
|
|
// UserInfo Request
|
|
{
|
|
let userInfo = await oid.fetchUserInfo(config, access_token, sub)
|
|
|
|
console.log('UserInfo Response', userInfo)
|
|
}
|