pwrdrvr/microapps-core

Release OIDC Package

huntharo opened this issue 2 years ago · 0 comments

huntharo commented 2 years ago

Motivations

The OIDC package and documentation could be useful to others

See #227 for details and docs

To-Do

Implement nonce with DynamoDB backing (auto expiration)
Handle refresh tokens
Add documentation
Create a new construct

Tutorial and Sample

Documentation

Authorization Code Flow RFC
- https://www.rfc-editor.org/rfc/rfc6749#section-4.1
Okta Sample Lambda Node.js OAuth Integration
- https://github.com/oktadev/okta-nodejs-aws-lambda-example
Sample implementation from Auth.js
- https://authjs.dev/
- Concerns
  - Does not use a DB persisted nonce to avoid replay attacks
  - Sends the refresh token to the browser - not clear if this encrypted
OAuth Threat Models RFC
- https://datatracker.ietf.org/doc/rfc6819/
Nonce and State
- https://medium.com/@benjamin.botto/oauth-replay-attack-mitigation-18655a62fe53
One Login Examples / Code - Useful for pointers on OIDC
- https://github.com/onelogin/lambda_authorizor_demo
- https://developers.onelogin.com/api-authorization/authorizing-aws-api-gateway-requests-with-onelogin-oauth-access-tokens
Using Google as a Social Provider for AWS Cognito User Pools
- Set Up Google as a social identity provider in an Amazon Cognito user pool
Cognito with External Identity Provider
- https://github.com/aws-samples/amazon-cognito-example-for-external-idp
SAML for Serverless Apps - 2017
- SAML for Your Serverless JavaScript Application: Part II | AWS Compute Blog (amazon.com)
Open Banking OIDC Example
- aws-samples/openbanking-brazilian-auth-samples (github.com)
Google Workspace OIDC Support Added
- Google Workspace expands identity services
Google Identity Platform for Work
- Google Identity | Google Developers
Google Identity API OpenID Connect Setup (OIDC)
- OpenID Connect | Google Identity | Google Developers