boruta-server

boruta-server copied to clipboard

Boruta is a standalone authorization server implementing OAuth 2.0 and Openid Connect specifications. It provides administration tools and a customizable identity provider out of the box to manage authorization, but also a gateway to apply access rules to incoming traffic.

Status

This server is on an ongoing beta stage. Developments are moving fast on master then are keen to be less stable. Tagged versions are said to be more stable and sanity tested.

Documentation

The documentation of boruta server is available here it provides insights about its usage.

Implemented specifications and certification

As it, boruta server aim to follow the RFCs from IETF:

• RFC 6749 - The OAuth 2.0 Authorization Framework
• RFC 7662 - OAuth 2.0 Token Introspection
• RFC 7009 - OAuth 2.0 Token Revocation
• RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
• RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
• RFC 7523 - JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

And the specifications from the OpenID Foundation:

• OpenID Connect core 1.0
• OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1

This server has been certified for the Basic, Implicit, and Hybrid OpenID Provider profiles by the OpenID Foundation on October, 18th 2022 for the tagged version 0.1.0

This server has been also certified for the Config and Dynamic OpenID Provider profiles by the OpenID Foundation on May, 16th 2023 for the tagged version 0.2.0

Installation

A loom presentation about how to get a server up and running.

Note that the easiest way to try the server is by using docker compose.

During the installation, an optional prompt will ask for statistical info, it would be great if you could fill them.

System wide setup (Debian based)

You can perform a system wide installation performing the following command. It will create a systemd service to run the server. During the installation, you will be asked to fill out the environment variables for the server. The environment takes .env.example as a basis.

Remember to change admin username / password for the install to be secured

curl -s https://raw.githubusercontent.com/malach-it/boruta-server/master/scripts/setup.debian.sh | sudo sh

The applications will be available on different ports (depending on the filled out environment configuration):

• http://localhost:8080 for the authorization server
• http://localhost:8081 for the admin interface
• http://localhost:8082 for the gateway
• http://localhost:8083 for the microgateway

Run an instance from docker

Note this image is built for x86_64 architecture, for other architectures build yourself the image or use docker compose install that will build the image for your architecture.

A docker image is available at malachit/boruta-server on DockerHub, you will need a postgres instance installed on your system with credentials provided as environment variables in .env.*.

1. Get environment file

wget https://raw.githubusercontent.com/malach-it/boruta-server/master/.env.dev

Once done you will be able to launch the server.

docker run -it --env-file .env.dev --network=host malachit/boruta-server:0.3.0

The applications will be available on different ports (depending on the values provided in .env.dev):

• http://localhost:4000 for the authorization server
• http://localhost:4001 for the admin interface
• http://localhost:4002 for the gateway
• http://localhost:4003 for the microgateway

Admin credentials are the one seeded and available in environment file.

Run an instance from docker-compose

You can build and run the docker images as follow:

docker-compose up

The applications will be available on different ports (depending on the docker compose environment configuration):

• http://localhost:8080 for the authorization server
• http://localhost:8081 for the admin interface
• http://localhost:8082 for the gateway
• http://localhost:8083 for the microgateway

Admin credentials are the one seeded and available in environment file.

Requirements

• Elixir >= 1.13
• postgreSQL >= 13
• node >= 16.5 (if you need to prepare assets)

Run a release from scratch

1. first you need to get project dependencies

mix deps.get

2. you need to prepare assets in order for them to be included in the release

./scripts/prepare_assets.sh

3. then you can craft the release

MIX_ENV=prod mix release boruta

Once done, you can run the release as follow:

env $(cat .env.example | xargs) _build/prod/rel/boruta/bin/boruta start

The applications will be available on different ports (depending on the values provided in .env.example):

• http://localhost:8080 for the authorization server
• http://localhost:8081 for the admin interface
• http://localhost:8082 for the gateway
• http://localhost:8083 for the microgateway

Admin credentials are the one seeded and available in environment file.

Run a development server

1. first you need to get project dependencies

mix deps.get

2. you need to prepare assets in order to fetch javascript dependencies

./scripts/prepare_assets.sh

3. because of the forwarding of requests between web and identity modules, you need to add the /accounts path prefix in configuration

--- a/apps/boruta_identity/config/config.exs
+++ b/apps/boruta_identity/config/config.exs
@@ -4,8 +4,8 @@ config :boruta_identity,
   ecto_repos: [BorutaAuth.Repo, BorutaIdentity.Repo]

 config :boruta_identity, BorutaIdentityWeb.Endpoint,
-  url: [host: "localhost"],
-  # url: [host: "localhost", path: "/accounts"],
+  # url: [host: "localhost"],
+  url: [host: "localhost", path: "/accounts"],

You now should be able to start the development server

env $(cat .env.dev | xargs) MIX_ENV=dev mix boruta.server

The applications will be available on different ports (depending on the values provided in .env.dev):

• http://localhost:4000 for the authorization server
• http://localhost:4001 for the admin interface
• http://localhost:4002 for the gateway
• http://localhost:4003 for the microgateway

Admin credentials are the one seeded and available in environment file.

Default admin credentials

In order to authenticate to the administration interface you will be asked for credentials that are by default (seeded from environment variables) [email protected] / imaynotknowthat.

Environment variables

Code of Conduct

This product community follows the code of conduct available here

License

This code is released under the Apache 2.0 license.