go-oidc - A Configurable OpenID Provider built in Go.

go-oidc is a client module that provides a configurable Authorization Server with support for OpenID Connect and other standards.

This library implements the following specifications:

• OpenID Connect Core 1.0
• OpenID Connect Discovery 1.0
• RFC 6749 - The OAuth 2.0 Authorization Framework
• OpenID Connect Dynamic Client Registration 1.0
• RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol (DCR)
• RFC 7592 - OAuth 2.0 Dynamic Client Registration Management Protocol (DCM)
• RFC 9126 - OAuth 2.0 Pushed Authorization Requests (PAR)
• RFC 9101 - The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
• JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)
• RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients (PKCE)
• RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification
• RFC 8705 - OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
• RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP)
• RFC 9396 - OAuth 2.0 Rich Authorization Requests (RAR)
• RFC 8707 - Resource Indicators for OAuth 2.0
• RFC 7662 - OAuth 2.0 Token Introspection
• RFC 7009 - OAuth 2.0 Token Revocation
• OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0 (CIBA)

Certification

Luiky Vasconcelos has certified that go-oidc conforms to the following profile of the OpenID Connect™ protocol.

• Basic OP
• FAPI 2.0

Get Started

To start using the go-oidc module in your project, install it with

go get github.com/luikyv/go-oidc@latest

Once installed, you can instantiate an openid provider and run it as shown below.

key, _ := rsa.GenerateKey(rand.Reader, 2048)
jwk := goidc.JSONWebKey{
  KeyID:     "server_key",
  Key:       key,
  Algorithm: string(goidc.RS256),
  Use:       string(goidc.KeyUsageSignature),
}

op, _ := provider.New(
  goidc.ProfileOpenID,
  "http://localhost",
  func(_ context.Context) (goidc.JSONWebKeySet, error) {
    return goidc.JSONWebKeySet{
      Keys: []goidc.JSONWebKey{jwk},
    }, nil
  },
)
op.Run(":80")

You can then check the default configurations by accessing http://localhost/.well-known/openid-configuration.