diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 00000000..1e8163db --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,33 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**Stackblitz example** +Provide a minimal [stackblitz](https://stackblitz.com/) based example that shows the issue. For this, you can use the example application of this repo and the identity providers used here. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + + +**Desktop (please complete the following information):** + - OS: [e.g. iOS] + - Browser [e.g. chrome, safari] + - Version [e.g. 22] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 00000000..bbcbbe7d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/ISSUE_TEMPLATE/support-request--general-question.md b/.github/ISSUE_TEMPLATE/support-request--general-question.md new file mode 100644 index 00000000..0f12ae6a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/support-request--general-question.md @@ -0,0 +1,33 @@ +--- +name: Support request/ general question +about: Requesting help from the community +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**Stackblitz example** +Provide a minimal [stackblitz](https://stackblitz.com/) based example that shows the issue. For this, you can use the example application of this repo and the identity providers used here. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + + +**Desktop (please complete the following information):** + - OS: [e.g. iOS] + - Browser [e.g. chrome, safari] + - Version [e.g. 22] + +**Additional context** +Add any other context about the problem here. diff --git a/.gitignore b/.gitignore index ee5c9d83..84c8d4f0 100644 --- a/.gitignore +++ b/.gitignore @@ -25,6 +25,7 @@ !.vscode/extensions.json # misc +/.angular/cache /.sass-cache /connect.lock /coverage diff --git a/.prettierignore b/.prettierignore new file mode 100644 index 00000000..d0b804da --- /dev/null +++ b/.prettierignore @@ -0,0 +1,4 @@ +# Add files here to ignore them from prettier formatting + +/dist +/coverage diff --git a/.prettierrc b/.prettierrc new file mode 100644 index 00000000..544138be --- /dev/null +++ b/.prettierrc @@ -0,0 +1,3 @@ +{ + "singleQuote": true +} diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 00000000..1348ba4a --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,15 @@ +{ + // Use IntelliSense to learn about possible attributes. + // Hover to view descriptions of existing attributes. + // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 + "version": "0.2.0", + "configurations": [ + { + "type": "chrome", + "request": "launch", + "name": "Launch Chrome against localhost", + "url": "http://localhost:4200", + "webRoot": "${workspaceFolder}" + } + ] +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json index c5d2e6d0..2d463ecb 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -25,9 +25,12 @@ "typescriptreact", "yml" ], - "spellright.language": "de", + "spellright.language": [ + "en" + ], "spellright.documentTypes": [ "latex", - "plaintext" + "plaintext", + "markdown" ] } \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index e844bd2b..116d1ee3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,27 +1,165 @@ -# Change Log - -## Lates features - -See [Release Notes](https://github.com/manfredsteyer/angular-oauth2-oidc/releases) - -## New Features in Version 2.1 -- New Config API (the original one is still supported) -- New convenience methods in OAuthService to streamline default tasks: - - ``setupAutomaticSilentRefresh()`` - - ``loadDiscoveryDocumentAndTryLogin()`` -- Single Sign out through Session Status Change Notification according to the OpenID Connect Session Management specs. This means, you can be notified when the user logs out using at the login provider. -- Possibility to define the ValidationHandler, the Config as well as the OAuthStorage via DI -- Better structured documentation - -## New Features in Version 2 -- Token Refresh for Implicit Flow by implementing "silent refresh" -- Validating the signature of the received id_token -- Providing Events via the observable ``events``. -- The event ``token_expires`` can be used together with a silent refresh to automatically refresh a token when/ before it expires (see also property ``timeoutFactor``). - -## Breaking Changes in Version 2 -- The property ``oidc`` defaults to ``true``. -- If you are just using oauth2, you have to set ``oidc`` to ``false``. Otherwise, the validation of the user profile will fail! -- By default, ``sessionStorage`` is used. To use ``localStorage`` call method setStorage -- Demands using https as OIDC and OAuth2 relay on it. This rule can be relaxed using the property ``requireHttps``, e. g. for local testing. -- Demands that every url provided by the discovery document starts with the issuer's url. This can be relaxed by using the property ``strictDiscoveryDocumentValidation``. +## [12.0.0](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/v10.0.3...v10.0.2) (2021-07-16) + + +### Bug Fixes + +* [#728](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/728) ([51e438a](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/51e438a942773948f17ab108332d704b459fd789)), closes [/github.com/manfredsteyer/angular-oauth2-oidc/issues/728#issuecomment-808969225](https://github.com//github.com/manfredsteyer/angular-oauth2-oidc/issues/728/issues/issuecomment-808969225) +* clear location.hash only if it is present ([c2b2753](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/c2b2753943d59a6b4b5149f1003371338ac1a210)), closes [#970](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/970) +* correctly handle ? and & in location replacements ([70fd826](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/70fd8268832aba954956542e37896252dde5cdab)) +* Disable nonce validation for id token for e2e tests ([f5bd96c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/f5bd96ca81ec6b7af868de72b1098541264347cf)) +* fix scope/state removal for implicit flow with hash ([9e257d0](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/9e257d0d267942d716607f2a1c78700bd9d6e9ef)) +* in code flow pass options to error handler ([c9a2c55](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/c9a2c557178af26154adfbcf39e3db2d12ee0503)), closes [#972](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/972) +* **jwks:** update jsrsasign dependency to 10.2.0 ([a05bd8a](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/a05bd8a106035acb51fb06fd62e17de0de8decb4)), closes [#1061](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/1061) +* multiplying calls to token endpoint in code flow ([59f65d2](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/59f65d2eb9cd1a724301fb3de0b3def796920bd4)) +* Refresh tokens with a plus sign get corrupted before sending to token endpoint ([2204c5a](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/2204c5a307640d11b847a0c266b44ca2c18fd9a7)) +* **revoketokenandlogout:** 'customParameters' should accept boolean ([9761bad](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/9761baded0d85bd831947de4607296fb029579ab)) +* While Using POPUP mode, we click on login button multiple time it opens multiple popup instead of focusing already opened ([bbff95b](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/bbff95b86173fa9262bf962e7fa4cfe4121b787e)) + + +### Features + +* introduce DateTimeProvider ([0c0a4a7](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/0c0a4a7a2574c8c134fa839f7ccdee06273a0676)) +* **logout:** postLogoutRedirectUri should not default to redirectUri ([ff7d1d9](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/ff7d1d915aa19f87bcb1c2d18ac3eb280db78d3b)) +* support JWT response on userinfo endpoint ([da16494](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/da1649499376863b0ebf884748176f3b38d91899)) +* Custom grant type added (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/919) +* Listen for storage to receive auth hash from popup (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/935) +* Add event for unchanged session (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/936) +* Add loginHint to codeFlow (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/938) +* Add a windowRef option to initLoginFlowInPopup to prevent the window from beeing blocked by popup blockers (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/965) +* Use configured revocationEndpoint by default (https://github.com/manfredsteyer/angular-oauth2-oidc/pull/1020) + + + +## 10.0.0 (2020-06-30) + +* chore: increase version in package.json ([84d95a7](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/84d95a7)) +* chore: make version 9.2 ready ([415e053](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/415e053)) +* chore(deps): bump jsrsasign from 8.0.12 to 8.0.19 ([4def1c1](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4def1c1)) +* chore(deps): bump websocket-extensions from 0.1.3 to 0.1.4 ([cae715e](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/cae715e)) +* chore(release): 9.2.1 ([7a15194](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/7a15194)) +* chore(release): 9.2.2 ([40f5ae5](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/40f5ae5)) +* chore(release): 9.3.0 ([f42f943](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/f42f943)) +* refactor: inline js-sha256 ([ca435c0](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/ca435c0)) +* refactor: remove dep on contributer-table ([b486546](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/b486546)) +* refactor: use esm for sha-256 ([92ee76d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/92ee76d)) +* feat(oauth-service): pass custom url params to logOut ([4607d55](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4607d55)) +* feat(oauth-service): revokeTokenAndLogout with cust params ([026dcb3](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/026dcb3)) +* 'disableAtHashCheck' by default if responseType is 'id_token' ([169d749](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/169d749)) +* #825: ([38c7c3f](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/38c7c3f)), closes [#825](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/825) +* #825: ([fb3afe4](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/fb3afe4)), closes [#825](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/825) +* Fix issue with ambient type in constructor when running Universal with Ivy ([9e95c73](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/9e95c73)) +* Fix typo in code-flow.md ([1816e7b](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/1816e7b)) +* Replaced document by this.document #773 ([678ff95](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/678ff95)), closes [#773](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/773) +* response_types including 'code' gets a code_challenge ([58a8132](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/58a8132)) +* Update code-flow.md ([5c5288c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/5c5288c)) +* docs(readme): use our own idsvr ([65c2b95](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/65c2b95)) +* fix: loadDiscoveryDocumentAndLogin should pass state into initLoginFlow ([132c624](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/132c624)) +* fix(lib): copying LICENSE file to output build ([e89aa6d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/e89aa6d)) + + +# [10.0.0](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/9.2.0...10.0.0) (2020-06-30) + + +### Bug Fixes + +* loadDiscoveryDocumentAndLogin should pass state into initLoginFlow ([132c624](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/132c62426cfe07ddaf0eebb85bdf062ee49e4a06)) +* **lib:** copying LICENSE file to output build ([e89aa6d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/e89aa6d90054dc4ad20f234db2107e82b11a9386)) + + +### Features + +* **oauth-service:** pass custom url params to logOut ([4607d55](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4607d55c6bdf608a32a2a029feac9eb37bfb493d)) +* **oauth-service:** revokeTokenAndLogout with cust params ([026dcb3](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/026dcb38e4299afbab8faff1d54dba94cadc1aa6)) + + + +# [10.0.0](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/v9.3.0...v10.0.0) (2020-06-30) + + + +# Changelog + +All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. + + +### Features + +* **automatic silent refresh:** stopAutomaticRefresh stops all timers. ([8ab853b](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/8ab853bf38dd162060d7b6cbd18f7b4fd5a84f18)) +* **code-flow:** allow using implicit flow by setting useSilentRefresh to true ([93902a5](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/93902a5808bb9b75a41d4bde44c6ab763bcfa9f6)) +* **oauth-service:** pass custom url params to logOut ([4607d55](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4607d55c6bdf608a32a2a029feac9eb37bfb493d)) +* **oauth-service:** revokeTokenAndLogout with cust params ([026dcb3](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/026dcb38e4299afbab8faff1d54dba94cadc1aa6)) +* **sample:** also use new idsvr 4 for implicit flow demo to prevent issues with same site cookies ([58c6354](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/58c63541bc7d83d72c30577da2b68ac2d1dc35b7)) +* **session checks:** Session checks work now for code flow too. Pls see Docs for details. ([4bf8901](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4bf89014d8cc5d50ed716500e3f3ad265b4ae2db)) +* **token-revocation:** also revoke refresh_token ([429ed2c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/429ed2c5b50c60ac857ff0ffe84c1d7fc995c6dd)) +* remove jsrsasign dependancy ([77cb37a](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/77cb37abfd08762a59b221257ed8d5d5b7c795d4)) +* Upgrade to angular 8 ([31c6273](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/31c6273b388af7e796a9ad663e346f1e33ff331c)) + + +### Bug Fixes + +* loadDiscoveryDocumentAndLogin should pass state into initLoginFlow ([132c624](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/132c62426cfe07ddaf0eebb85bdf062ee49e4a06)) +* **lib:** copying LICENSE file to output build ([e89aa6d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/e89aa6d90054dc4ad20f234db2107e82b11a9386)) +* **revoketokenandlogout:** explicit way to revoke an access token ([c799ead](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/c799eadbfa616d459af8be1a667499834745d78f)) +* **sample:** make sense of the guard ([1cae011](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/1cae011532dc91a250368c95120812d2f78f8109)) +* [#687](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/687) ([e2599e0](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/e2599e071307ae1efe1592c83bb3b7a01642a61d)) +* **code flow:** Fixed code flow for IE 11 ([0f03d39](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/0f03d393aac9fe4e26444a73884dd154318d530f)) +* **sample:** use hash-based routing ([3f44eca](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/3f44ecae157305c56ae377fcd6d2df8dfde8adf5)) +* **session state:** save session_state also when using code flow ([8fa99ff](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/8fa99ff721ea2b08f28bc5e9fa3e48a459e2a59a)) +* **state:** passing an url with a querystring as the state, e. g. url?x=1 ([71b705c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/71b705cb5105f6dfb49aabc55607745b881c5dc3)) +* missing HttpModule dependency ([7eac8ae](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/7eac8ae5cd1fd549f3933c30790f4b802c2c09f0)) +* run tokensetup outside ngzone ([07bb62d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/07bb62d06abb84ef2da010977d07bfd2a3805b16)) +* typo ([3d331f2](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/3d331f2166340db43f0aaca42ce8abc4913cd027)) + +### [9.2.2](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/v9.2.1...v9.2.2) (2020-05-09) + +### [9.2.1](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/v9.2.0...v9.2.1) (2020-04-23) + +## [9.2.0](https://github.com/manfredsteyer/angular-oauth2-oidc/compare/v9.1.0...v9.2.0) (2020-03-28) + + +### Features + +* **revoketokenandlogout:** explicit way to revoke an access token according to [RFC 7009](https://tools.ietf.org/html/rfc7009) ([c799ead](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/c799eadbfa616d459af8be1a667499834745d78f)) + +* **token-revocation:** also revoke refresh_token ([429ed2c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/429ed2c5b50c60ac857ff0ffe84c1d7fc995c6dd)) + + +### Bug Fixes + +* **sample:** make sense of the guard ([1cae011](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/1cae011532dc91a250368c95120812d2f78f8109)) + +## 9.1.0 (2020-03-23) + + +### Features + +* **automatic silent refresh:** stopAutomaticRefresh stops all timers. ([8ab853b](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/8ab853bf38dd162060d7b6cbd18f7b4fd5a84f18)) +* **code-flow:** allow using silent refresh by setting useSilentRefresh to true ([93902a5](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/93902a5808bb9b75a41d4bde44c6ab763bcfa9f6)) +* **sample:** Also use new Identity Server 4 for implicit flow demo to prevent issues with same site cookies ([58c6354](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/58c63541bc7d83d72c30577da2b68ac2d1dc35b7)) +* **session checks:** Session checks work now for code flow too. Please see docs for details. ([4bf8901](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/4bf89014d8cc5d50ed716500e3f3ad265b4ae2db)) + + +### Bug Fixes + +* **code flow:** Fixed code flow for IE 11 ([0f03d39](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/0f03d393aac9fe4e26444a73884dd154318d530f)) +* **sample:** use hash-based routing ([3f44eca](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/3f44ecae157305c56ae377fcd6d2df8dfde8adf5)) +* **session state:** save session_state also when using code flow ([8fa99ff](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/8fa99ff721ea2b08f28bc5e9fa3e48a459e2a59a)) +* **state:** passing an url with a querystring as the state, e. g. url?x=1 ([71b705c](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/71b705cb5105f6dfb49aabc55607745b881c5dc3)) +* [#687](https://github.com/manfredsteyer/angular-oauth2-oidc/issues/687) ([e2599e0](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/e2599e071307ae1efe1592c83bb3b7a01642a61d)) +* missing HttpModule dependency ([7eac8ae](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/7eac8ae5cd1fd549f3933c30790f4b802c2c09f0)) +* run tokensetup outside ngzone ([07bb62d](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/07bb62d06abb84ef2da010977d07bfd2a3805b16)) +* typo ([3d331f2](https://github.com/manfredsteyer/angular-oauth2-oidc/commit/3d331f2166340db43f0aaca42ce8abc4913cd027)) + +### Pull Requests +- Update sample app and silent-refresh.html script #755, linjie997 +- Add optional state parameter for logout, pmccloghrylaing +- fix customHashFragment usage in tryLoginCodeFlow, roblabat +- replace document with injectionToken #741, d-moos +- Support predefined custom parameters extraction from the TokenResponse, vdveer +- Fixed not working silent refresh when using 'code' #735, ErazerBrecht + +### Thanks + +Big Thanks to all contributers: Brecht Carlier, Daniel Moos, Jie Lin, Manfred Steyer, Phil McCloghry-Laing, robin labat, vdveer + +Also, big thanks to jeroenheijmans for doing an awesome job with moderating and analyzing the issues! \ No newline at end of file diff --git a/CREDITS.md b/CREDITS.md new file mode 100644 index 00000000..95d30cbd --- /dev/null +++ b/CREDITS.md @@ -0,0 +1 @@ +This lib uses an inlined version of [js-sha256](https://www.npmjs.com/package/js-sha256) (MIT license) diff --git a/README.md b/README.md index c4bc72b3..44b87299 100644 --- a/README.md +++ b/README.md @@ -1,27 +1,50 @@ -# angular-oauth2-oidc +# lacuna-oauth2-oidc -Support for OAuth 2 and OpenId Connect (OIDC) in Angular. +Support for OAuth 2 and OpenId Connect (OIDC) in Angular. Already prepared for the upcoming OAuth 2.1.  ## Credits -- [generator-angular2-library](https://github.com/jvandemo/generator-angular2-library) for scaffolding an Angular library -- [jsrasign](https://kjur.github.io/jsrsasign/) until version 5: For validating token signature and for hashing; beginning with version 6, we are using browser APIs to minimize our bundle size -- [Identity Server](https://github.com/identityserver) (used for testing with an .NET/.NET Core Backend) +- [jsrsasign](https://kjur.github.io/jsrsasign/) for validating token signature and for hashing +- [Identity Server](https://github.com/identityserver) for testing with an .NET/.NET Core Backend - [Keycloak (Redhat)](http://www.keycloak.org/) for testing with Java +- [Auth0](https://auth0.com/) ## Resources -- Sources and Sample: -https://github.com/manfredsteyer/angular-oauth2-oidc +- Sources and Sample: [https://github.com/manfredsteyer/angular-oauth2-oidc](https://github.com/manfredsteyer/angular-oauth2-oidc) +- Source Code Documentation: [https://manfredsteyer.github.io/angular-oauth2-oidc/docs](https://manfredsteyer.github.io/angular-oauth2-oidc/docs) +- Community-provided sample implementation: [https://github.com/jeroenheijmans/sample-angular-oauth2-oidc-with-auth-guards/](https://github.com/jeroenheijmans/sample-angular-oauth2-oidc-with-auth-guards/) -- Source Code Documentation -https://manfredsteyer.github.io/angular-oauth2-oidc/docs ## Tested Environment -Successfully tested with **Angular 7** and its Router, PathLocationStrategy as well as HashLocationStrategy and CommonJS-Bundling via webpack. At server side we've used IdentityServer (.NET/ .NET Core) and Redhat's Keycloak (Java). +Successfully tested with **Angular 4.3 to Angular 15** and its Router, PathLocationStrategy as well as HashLocationStrategy and CommonJS-Bundling via webpack. + +At server side we've used **IdentityServer** (.NET / .NET Core), Redhat's **Keycloak** (Java), and **Auth0** (Auth0 is officially supported since version 10 of this lib). For Auth0, please have a look into the respective documentation page here. + +For using this library with **Azure Active Directory** (**Azure AD**), we recommend an additional look to this [blog post](https://dev.to/yuriburger/azure-active-directory-b2c-with-pkce-for-your-angular-app-1dcg) and the example linked at the end of this blog post. + +Also, the Okta community created some guidelines on how to use this lib with Okta. See the links at the end of this page for more information. + +**Angular 15**: Use 15.x versions of this library (**should also work with older Angular versions!**). + +**Angular 14**: Use 14.x versions of this library (**should also work with older Angular versions!**). + +**Angular 13**: Use 13.x versions of this library (**should also work with older Angular versions!**). + +**Angular 12**: Use 12.x versions of this library (**should also work with older Angular versions!**). + +**Angular 11**: Use 10.x versions of this library (**should also work with older Angular versions!**). + +**Angular 10**: Use 10.x versions of this library (**should also work with older Angular versions!**). + +**Angular 9**: Use 9.x versions of this library (**should also work with older Angular versions!**). + +**Angular 8**: Use 8.x versions of this library. + +**Angular 7**: Use 7.x versions of this library. **Angular 6**: Use Version 4.x of this library. Version 4.x was tested with Angular 6. You can also try the newer version 5.x of this library which has a much smaller bundle size. @@ -30,47 +53,109 @@ Successfully tested with **Angular 7** and its Router, PathLocationStrategy as w ## Release Cycle - We plan one major release for each Angular version - - Will contain new features - - Will contain bug fixes and PRs -- Critical Bugfixes on demand + - Will contain new features + - Will contain bug fixes and PRs +- Critical bugfixes on demand ## Contributions + - Feel free to file pull requests -- The closed issues contain some ideas for PRs and enhancements (see labels) +- The issues contain some ideas for PRs and enhancements (see labels) +- If you want to contribute to the docs, you can do so in the `docs-src` folder. Make sure you update `summary.json` as well. Then generate the docs with the following commands: + + ```sh + npm install -g @compodoc/compodoc + npm run docs + ``` + +## Features -# Features -- Logging in via OAuth2 and OpenId Connect (OIDC) Implicit Flow (where a user is redirected to Identity Provider) +- Logging in via Code Flow + PKCE + - Hence, you are safe for the upcoming OAuth 2.1 +- Logging in via Implicit Flow (where a user is redirected to Identity Provider) - "Logging in" via Password Flow (where a user enters their password into the client) -- Token Refresh for Password Flow by using a Refresh Token +- Token Refresh for all supported flows - Automatically refreshing a token when/some time before it expires - Querying Userinfo Endpoint - Querying Discovery Document to ease configuration - Validating claims of the id_token regarding the specs - Hook for further custom validations - Single-Sign-Out by redirecting to the auth-server's logout-endpoint +- Tested with all modern browsers and IE +- Token Revocation according to [RFC 7009](https://tools.ietf.org/html/rfc7009#section-2.2) ## Sample-Auth-Server -You can use the OIDC-Sample-Server mentioned in the samples for Testing. It assumes, that your Web-App runs on http://localhost:8080. +You can use the OIDC-Sample-Server used in our examples. It assumes, that your Web-App runs on http://localhost:4200 -Username/Password: max/geheim +Username/Password: -*clientIds:* -- spa-demo (implicit flow) -- demo-resource-owner (resource owner password flow) +- max/geheim +- bob/bob +- alice/alice -*redirectUris:* -- localhost:[8080-8089|4200-4202] -- localhost:[8080-8089|4200-4202]/index.html -- localhost:[8080-8089|4200-4202]/silent-refresh.html +_clientIds:_ + +- spa (Code Flow + PKCE) +- implicit (implicit flow) + +_redirectUris:_ + +- localhost:[4200-4202] +- localhost:[4200-4202]/index.html +- localhost:[4200-4202]/silent-refresh.html ## Installing -``` +```sh npm i angular-oauth2-oidc --save ``` -## Importing the NgModule + +## Option 1: Standalone APIs + +If you use Standalone Components introduced with Angular 14, you can use our standalone API (call to ``provideOAuthClient``) in your ``main.ts`` to setup the ``OAuthClient``: + +```TypeScript +// main.ts -- Angular 15+ version +import { bootstrapApplication } from '@angular/platform-browser'; + +import { provideHttpClient } from '@angular/common/http'; + +import { AppComponent } from './app/app.component'; +import { provideOAuthClient } from 'angular-oauth2-oidc'; + +bootstrapApplication(AppComponent, { + providers: [ + provideHttpClient(), + provideOAuthClient() + ] +}); +``` + +As Angular 14 does have Standalone Components but no Standalone API for its ``HttpClient``, you need to go with the traditional ``HttpClientModule`` in this version: + +```TypeScript +// main.ts -- Angular 14 version +import { bootstrapApplication } from '@angular/platform-browser'; + +import { HttpClientModule } from '@angular/common/http'; + +import { AppComponent } from './app/app.component'; +import { provideOAuthClient } from 'angular-oauth2-oidc'; +import { importProvidersFrom } from '@angular/core'; + +bootstrapApplication(AppComponent, { + providers: [ + importProvidersFrom(HttpClientModule), + provideOAuthClient() + ] +}); +``` + +The ``provideOAuthClient`` function takes the same parameters as the forRoot function of the OAuthModule that is still in place for the sake of compatibility with existing code bases. + +## Option 2: Using NgModules ```TypeScript import { HttpClientModule } from '@angular/common/http'; @@ -78,7 +163,7 @@ import { OAuthModule } from 'angular-oauth2-oidc'; // etc. @NgModule({ - imports: [ + imports: [ // etc. HttpClientModule, OAuthModule.forRoot() @@ -89,149 +174,93 @@ import { OAuthModule } from 'angular-oauth2-oidc'; // etc. ], bootstrap: [ - AppComponent + AppComponent ] }) export class AppModule { } -``` +``` -## Configuring for Implicit Flow +# Logging in -This section shows how to implement login leveraging implicit flow. This is the OAuth2/OIDC flow best suitable for -Single Page Application. It sends the user to the Identity Provider's login page. After logging in, the SPA gets tokens. -This also allows for single sign on as well as single sign off. +Since Version 8, this library supports code flow and [PKCE](https://tools.ietf.org/html/rfc7636) to align with the current draft of the [OAuth 2.0 Security Best Current Practice](https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13) document. This is also the foundation of the upcoming OAuth 2.1. -To configure the library, the following sample uses the new configuration API introduced with Version 2.1. -Hence, the original API is still supported. +To configure your solution for code flow + PKCE you have to set the `responseType` to `code`: ```TypeScript -import { AuthConfig } from 'angular-oauth2-oidc'; + import { AuthConfig } from 'angular-oauth2-oidc'; -export const authConfig: AuthConfig = { + export const authCodeFlowConfig: AuthConfig = { + // Url of the Identity Provider + issuer: 'https://idsvr4.azurewebsites.net', - // Url of the Identity Provider - issuer: 'https://steyer-identity-server.azurewebsites.net/identity', + // URL of the SPA to redirect the user to after login + redirectUri: window.location.origin + '/index.html', - // URL of the SPA to redirect the user to after login - redirectUri: window.location.origin + '/index.html', + // The SPA's id. The SPA is registerd with this id at the auth-server + // clientId: 'server.code', + clientId: 'spa', - // The SPA's id. The SPA is registerd with this id at the auth-server - clientId: 'spa-demo', + // Just needed if your auth server demands a secret. In general, this + // is a sign that the auth server is not configured with SPAs in mind + // and it might not enforce further best practices vital for security + // such applications. + // dummyClientSecret: 'secret', - // set the scope for the permissions the client should request - // The first three are defined by OIDC. The 4th is a usecase-specific one - scope: 'openid profile email voucher', -} -``` + responseType: 'code', -Configure the OAuthService with this config object when the application starts up: + // set the scope for the permissions the client should request + // The first four are defined by OIDC. + // Important: Request offline_access to get a refresh token + // The api scope is a usecase specific one + scope: 'openid profile email offline_access api', -```TypeScript -import { OAuthService } from 'angular-oauth2-oidc'; -import { JwksValidationHandler } from 'angular-oauth2-oidc'; -import { authConfig } from './auth.config'; -import { Component } from '@angular/core'; - -@Component({ - selector: 'flight-app', - templateUrl: './app.component.html' -}) -export class AppComponent { + showDebugInformation: true, + }; +``` - constructor(private oauthService: OAuthService) { - this.configureWithNewConfigApi(); - } +After this, you can initialize the code flow using: - private configureWithNewConfigApi() { - this.oauthService.configure(authConfig); - this.oauthService.tokenValidationHandler = new JwksValidationHandler(); - this.oauthService.loadDiscoveryDocumentAndTryLogin(); - } -} +```TypeScript +this.oauthService.initCodeFlow(); ``` -### Implementing a Login Form - -After you've configured the library, you just have to call ``initImplicitFlow`` to login using OAuth2/ OIDC. +There is also a convenience method `initLoginFlow` which initializes either the code flow or the implicit flow depending on your configuration. ```TypeScript -import { Component } from '@angular/core'; -import { OAuthService } from 'angular-oauth2-oidc'; - -@Component({ - templateUrl: "app/home.html" -}) -export class HomeComponent { +this.oauthService.initLoginFlow(); +``` - constructor(private oauthService: OAuthService) { - } +Also -- as shown in the readme -- you have to execute the following code when bootstrapping to make the library to fetch the token: - public login() { - this.oauthService.initImplicitFlow(); - } +```TypeScript +this.oauthService.configure(authCodeFlowConfig); +this.oauthService.loadDiscoveryDocumentAndTryLogin(); +``` - public logoff() { - this.oauthService.logOut(); - } +### Logging out - public get name() { - let claims = this.oauthService.getIdentityClaims(); - if (!claims) return null; - return claims.given_name; - } +The logOut method clears the used token store (by default ``sessionStorage``) and forwards the user to the auth servers logout endpoint if one was configured (manually or via the discovery document). -} +```typescript +this.oauthService.logOut(); ``` -The following snippet contains the template for the login page: - -```HTML -