liboauth2

Generic library that can be used to build OAuth 2.x and OpenID Connect C-based servers and clients e.g. web-server plugins.

Overview

• extends cjose into OAuth 2.x and OpenID Connect specific claims, secrets and hashes
• adds OAuth 2.x / OpenID Connect protocols by abstracting HTTP requests/responses from web server implementation specifics
• reusable code across for other OAuth 2.x (and REST) related protocols e.g. token exchange with endpoint authentication, source token retrieval, target pass settings etc.
• generic code with plugins for Apache, NGINX and possibly more (e.g. Envoy, HA Proxy, IIS)
• configurable cache backend/size/options per cache element type
• cookie-based session management (i.e. enforce inactivity timeout, expiry)

Features

• OpenID Connect 1.0 https://openid.net/specs/openid-connect-core-1_0.html
• OAuth 2.0 Resource Owner Password Credentials https://tools.ietf.org/html/rfc6749#section-4.3
• OAuth 2.0 Token Introspection https://tools.ietf.org/html/rfc7662
• JWT bearer token validation using: JWK, JWKS URI, shared symmetric key, X.509 cert, RSA public key https://tools.ietf.org/html/rfc6750
• OAuth 2.0 Authorization Server Metadata https://tools.ietf.org/html/rfc8414
• Proof Key for Code Exchange by OAuth Public Clients (PCKE) [https://tools.ietf.org/html/rfc7636]
• OAuth 2.0 Mutual-TLS Certificate-Bound Access Tokens (MTLS) [https://tools.ietf.org/html/rfc8705]
• (draft) OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) [https://tools.ietf.org/html/draft-ietf-oauth-dpop]
• Amazon ALB EC key URL based x-amzn-oidc-data JWT verification
• endpoint authentication methods: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, TLS client certificate and HTTP basic authentication
• configurable cache backends: shared memory, file-based, memcache and Redis
• retrieving a token from a header, a query parameter, a post parameter or a cookie
• setting a token as a header, a query parameter, a post parameter or a cookie
• Apache and NGINX bindings

Dependencies

liboauth2 depends on the following libraries:

• openssl for SSL and crypto support
• libcurl for HTTP client support
• jansson for JSON parsing
• cjose for JSON Object Signing and Encryption (JOSE) support
• (optional) libmemcached for memcache cache backend support
• (optional) libhiredis for Redis cache backend support
• (optional) Apache 2.x for Apache 2.x bindings support
• (optional) NGINX for NGINX bindings support
• (optional, build time only) check for unit test support

Support

Community Support

For generic questions, see the Wiki pages with Frequently Asked Questions at:
https://github.com/zmartzone/liboauth2/wiki
Any questions should go to the Discussions tracker.

Commercial Support

For commercial support contracts, professional services, training and use-case specific support you can contact (ZmartZone IAM)[https://www.zmartzone.eu] at:
[email protected]

Disclaimer

This software is open sourced by ZmartZone IAM. For commercial support you can contact ZmartZone IAM as described above in the Support section.