OAuth 2.0 provider for Elixir and Phoenix

News Announcing
,
1

In short
Plug n’ play OAuth 2.0 provider library. Just set up a resource owner schema with Ecto (your user schema), install the dependency and run the install task. That’s it! :rocket:

ExOauth2Provider
PhoenixOauth2Provider

Background
This is my first full project in Elixir. The reason for building these hex libraries was that I needed a flexible plug n’ play OAuth 2.0 provider for a Phoenix project I’m working on. The other options I found didn’t cut it for me, and I was looking for something akin to Doorkeeper for Rails. Basically a no brainer library, that I can adjust after getting it up and running.

Use case
I wrote a blog post on how you can create a versioned API using OAuth 2.0 access tokens in minutes using this library: https://dreamconception.com/tech/phoenix-full-fledged-api-in-five-minutes/

I hope this can be useful for some of you. Please feel free to help improve the libraries with suggestions or PR’s!

13 Likes
2

I’ve made a few updates since I wrote this post. Now there’s added support for UUID (or custom primary key type), and works with Phoenix 1.3. Blog post has been updated too. All feedback is welcome :rocket:

7 Likes
3

Thanks a ton @danschultzer

4

Finally got around to rewriting these libraries. With Pow I got a much better idea how these libraries should work.

It will be much easier to contribute to them moving forward :rocket: It was a major rewrite so there are probably a lot of things that can be refactored, and I have overlooked. Any help would be much appreciated!

ExOauth2Provider v0.5.0 changes

Changelog

  • Schema modules are now generated (with mix ex_oauth2_provider.gen.schemas). Now all configuration (e.g. binary id) are done on the individual schema modules. Previously there were issues if e.g. some app environment was not available during compilation, and configuration wasn’t particularly explicit.
  • Configuration are primarily passed through the method calls with fallback to app environment.
  • Ecto 3.0 support.

PhoenixOauth2Provider 0.5.0

Changelog

  • Templates are now built in so you can get started without generating any views/templates!
  • Phoenix 1.4 support.
2 Likes
5

Just updated the tutorial and demo app too:

https://dreamconception.com/tech/phoenix-full-fledged-api-in-five-minutes/

https://github.com/danschultzer/phoenix_ex_oauth2_provider_demo

Happy coding!

4 Likes
6

Thanks @danschultzer for the awesome work on the Oauth2.0 Provider. It’s been very helpful.

I was just wondering if an update for phoenix_oauth2_provider is on the way since the library currently depends on {:ex_oauth2_provider, "~> 0.5.1"} while the latest version of that library is {:ex_oauth2_provider, "~> 0.5.6"} which I imagine brings a bunch of improvements.

1 Like
7

the link provided seems to be a place where attackers may be lurking.

8

The TLS certificate used by dreamconception.com expired on 21 Jul 2022, so I think it’s safe to assume the site is unmaintained.

9

As is the project, I assume, last commit 4 years ago: GitHub - danschultzer/phoenix_oauth2_provider: Get an OAuth 2 provider running in your phoenix with controllers, views and models in just two minutes · GitHub

EDIT: I missed the fresh project from the OP: GitHub - danschultzer/ex_oauth2_provider: Making OAuth 2 provider and authentication with http bearer as simple as possible for Elixir and Phoenix apps · GitHub

1 Like
10

Hi, I have an app that uses Pow for authentication, and I have set up ExOauth2Provider - it works great!

I have a security concern, though. The OAuth tokens and refresh tokens are stored as plain text in the database. That seems risky; if the DB gets compromised, then the attacker gets the credentials.

Shouldn’t the tokens and refresh tokens be encrypted at rest? What’s your approach to this?

Maybe using cloak_ecto | Hex would help here, but we’d have to tweak ExOauth2Provider to get the tokens by hash?