feat(oidc): a Serverpod module for signing in with OpenID Connect, SimpleLogin a preset (ADR 0023)
halkyon_oidc_server and its generated client halkyon_oidc_client: any
provider following OpenID Connect's code flow, beside Serverpod's own
providers, with a preset for SimpleLogin (no PKCE, no `typ`). Nothing
of Halkyon's is in it; BSD-3-Clause, `publish_to: none` for now.
- Attempts in `halkyon_oidc_attempt` (ADR 0020's D13): the ID
PostgreSQL's gen_random_uuid(), a state and a nonce of 32 random
bytes, PKCE's verifier where used, the caller if signed in; ten
minutes, taken once. A host may begin the state with a marker.
- The code exchanged by the module itself, so a provider out of reach
(a timeout, a 5xx) is told apart from a refused code; the ID token
checked with dart_jsonwebtoken's algorithms (ADR 0020's D12): the
provider's algorithms alone, the key its `kid` names, of the right
type; issuer, audience and `azp`, expiry, time issued, `nbf`, a
minute's leeway; the attempt's nonce; a `sub`.
- Keys kept an hour, fetched again for an unknown `kid` at most once
a minute; discovery checked against the issuer; every request with
a timeout.
- Identities in `halkyon_oidc_identity`: the provider's key and the
`sub`, one per person and provider, deleted with the person.
- The stock endpoint (`OidcIdpBaseEndpoint`), and the parts for a host
with rules of its own: begin, verify, keep and takeKept, link,
accountOf, unlink; merging people; a limit per network.
- The forwarding page, moved here from halkyon_base in the next commit.
The package's main library is the code generator's, as halkyon_base's;
a host imports `package:halkyon_oidc_server/oidc.dart`. ADR 0023's
point 5 no longer names OAuth2PkceUtil, which the module doesn't use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-23 20:28:37 +02:00
|
|
|
name: halkyon_oidc_server
|
|
|
|
|
description: >-
|
|
|
|
|
Signing in with OpenID Connect for Serverpod, as a module: any provider
|
|
|
|
|
that follows OpenID Connect's code flow, SimpleLogin a preset. Keeps only
|
|
|
|
|
the provider's ID of a person; the ID token checked against the provider's
|
|
|
|
|
keys, the nonce and the attempt the device holds.
|
|
|
|
|
version: 0.1.0
|
|
|
|
|
# In the Halkyon repository until it runs on learn.halkyon.eu (ADR 0023, D3).
|
|
|
|
|
publish_to: none
|
|
|
|
|
|
|
|
|
|
environment:
|
|
|
|
|
sdk: ^3.13.0
|
|
|
|
|
|
|
|
|
|
resolution: workspace
|
|
|
|
|
|
|
|
|
|
dependencies:
|
|
|
|
|
clock: ^1.1.3
|
|
|
|
|
# The PKCE challenge's SHA-256.
|
|
|
|
|
crypto: ^3.0.7
|
|
|
|
|
# Checks ID tokens' signatures (ADR 0020, D12). Pinned exactly, as what checks
|
|
|
|
|
# who someone is must never move by accident; the version Serverpod's own
|
|
|
|
|
# sign-ins resolve to (^3.1.0).
|
|
|
|
|
dart_jsonwebtoken: 3.4.1
|
|
|
|
|
# The providers' discovery documents, keys and token endpoints.
|
|
|
|
|
http: ^1.6.0
|
|
|
|
|
meta: ^1.16.0
|
2026-10-23 20:33:13 +02:00
|
|
|
# Makes the RSA keys the fake provider signs its tokens with (`testing.dart`,
|
|
|
|
|
# for hosts' tests); dart_jsonwebtoken signs and checks with it too.
|
|
|
|
|
pointycastle: ^4.0.0
|
feat(oidc): a Serverpod module for signing in with OpenID Connect, SimpleLogin a preset (ADR 0023)
halkyon_oidc_server and its generated client halkyon_oidc_client: any
provider following OpenID Connect's code flow, beside Serverpod's own
providers, with a preset for SimpleLogin (no PKCE, no `typ`). Nothing
of Halkyon's is in it; BSD-3-Clause, `publish_to: none` for now.
- Attempts in `halkyon_oidc_attempt` (ADR 0020's D13): the ID
PostgreSQL's gen_random_uuid(), a state and a nonce of 32 random
bytes, PKCE's verifier where used, the caller if signed in; ten
minutes, taken once. A host may begin the state with a marker.
- The code exchanged by the module itself, so a provider out of reach
(a timeout, a 5xx) is told apart from a refused code; the ID token
checked with dart_jsonwebtoken's algorithms (ADR 0020's D12): the
provider's algorithms alone, the key its `kid` names, of the right
type; issuer, audience and `azp`, expiry, time issued, `nbf`, a
minute's leeway; the attempt's nonce; a `sub`.
- Keys kept an hour, fetched again for an unknown `kid` at most once
a minute; discovery checked against the issuer; every request with
a timeout.
- Identities in `halkyon_oidc_identity`: the provider's key and the
`sub`, one per person and provider, deleted with the person.
- The stock endpoint (`OidcIdpBaseEndpoint`), and the parts for a host
with rules of its own: begin, verify, keep and takeKept, link,
accountOf, unlink; merging people; a limit per network.
- The forwarding page, moved here from halkyon_base in the next commit.
The package's main library is the code generator's, as halkyon_base's;
a host imports `package:halkyon_oidc_server/oidc.dart`. ADR 0023's
point 5 no longer names OAuth2PkceUtil, which the module doesn't use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-23 20:28:37 +02:00
|
|
|
serverpod: 4.0.4
|
|
|
|
|
serverpod_auth_idp_server: 4.0.4
|
|
|
|
|
|
|
|
|
|
dev_dependencies:
|
|
|
|
|
serverpod_test: 4.0.4
|
|
|
|
|
test: ^1.25.5
|