akiel/lens-auth repository overview

Please start at the Top-Level Lens Repo⁠.

⁠Lens Auth Service

The central OAuth 2.0 authorization service for all Lens backend services.

Lens auth currently supports only the Resource Owner Password Credentials Grant described in section 4.3⁠ of the spec. An OAuth 2.0 compatible token endpoint⁠ is implemented under the /token path. An OAuth 2.0 compatible introspection endpoint⁠ is implemented under the /introspect path.

⁠Client Identifiers

Client identifiers issued by this authorization service are opaque strings with a length not longer than 255 chars.

⁠Usage with Leiningen

To start the service with leiningen, run the following command

lein with-profile production trampoline run

This starts the Lens Auth service on localhost port 8080.

⁠Usage on Heroku Compatible PaaS

This application uses the following environment vars:

• PORT - the port to listen on
• CONTEXT_PATH - an optional context path under which the workbook service runs
• TOKEN_STORE - how to store the generated tokens. Currently atom and riak are supported (defaults to atom)
• RIAK_TOKEN_HOST - Must be specified if token-store is riak
• RIAK_TOKEN_PORT - the Riak HTTP port (defaults to 8098)
• RIAK_TOKEN_BUCKET - the name of the Riak bucket to store generated tokens in (defaults to auth-tokens)
• EXPIRE - the time in seconds after which a token expires
• AUTH - how to check user credentials, currently noop (all credentials are valid) and ldap are supported (defaults to noop)
• LDAP_HOSTS - the host or hosts (comma separated) to use for ldap connect, must be specified if auth is ldap
• LDAP_USER_BASE_DN - the ldap base dn⁠ to locate users, must be specified if auth is ldap
• LDAP_BIND_DN - the server connects to ldap using this user dn, must be specified if auth is ldap
• LDAP_BIND_PASSWORD - the server connects to ldap using this password, must be specified if auth is ldap
• LDAP_SEARCH_TPL - the filter string template used to find users (defaults to (sAMAccountName=%s))
• CLIENT_STORE - how to store the generated tokens. Currently atom and riak are supported (defaults to atom)
• RIAK_CLIENT_HOST - Must be specified if client-store is riak
• RIAK_CLIENT_PORT - the Riak HTTP port (defaults to 8098)
• RIAK_CLIENT_BUCKET - the name of the Riak bucket to store generated clients in (defaults to auth-clients)

If you have foreman⁠ installed you can create an .env file listing the environment vars specified above and just type foreman start.

⁠Usage through Docker Container

You have to start the auth container:

docker run -d -p 8080:80 --name lens-auth akiel/lens-auth

After starting the container, a curl http://localhost:8080/token should show Method not allowed. which is okay for the moment.

⁠Develop

Running a REPL will load the user namespace. Use (startup) to start the server and (reset) to reload after code changes.

⁠License

Copyright © 2015 Alexander Kiel

Distributed under the Eclipse Public License, the same as Clojure.