mirror of
https://github.com/CloudNebulaProject/barycenter.git
synced 2026-04-10 13:10:42 +00:00
9b0481b258
Replace all remaining references to "crabidp" with "barycenter" across: - Source code (error diagnostics, CLI name, comments) - Configuration files and defaults - Environment variable prefixes (CRABIDP__ → BARYCENTER__) - Documentation (CLAUDE.md, README.md, DEPLOYMENT.md) - Deployment configurations (Docker Compose, Helm, systemd, FreeBSD, illumos) - Database filenames (crabidp.db → barycenter.db) Add Kubernetes Gateway API support to Helm chart: - New HTTPRoute template for Gateway API - Configurable parentRefs, hostnames, filters, and weights - Support for advanced traffic management features - Gateway API as modern alternative to traditional Ingress - Documentation and examples in DEPLOYMENT.md Benefits of Gateway API: - More expressive and extensible routing - Role-oriented design with separation of concerns - Better vendor portability - Advanced traffic management capabilities The Helm chart now supports both traditional Ingress and Gateway API, allowing users to choose based on their cluster capabilities and requirements. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
163 lines
3.9 KiB
Markdown
163 lines
3.9 KiB
Markdown
# Barycenter
|
|
|
|
An OpenID Connect Identity Provider (IdP) implementing OAuth 2.0 Authorization Code flow with PKCE.
|
|
|
|
## Overview
|
|
|
|
Barycenter is a lightweight, standards-compliant OpenID Connect Identity Provider written in Rust. It implements the OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE), making it suitable for modern web and mobile applications.
|
|
|
|
## Features
|
|
|
|
- **OAuth 2.0 Authorization Code Flow** with PKCE (S256)
|
|
- **Dynamic Client Registration** - RFC 7591 compliant
|
|
- **Token Endpoint** - Multiple authentication methods (client_secret_basic, client_secret_post)
|
|
- **ID Token Signing** - RS256 with proper at_hash and nonce support
|
|
- **UserInfo Endpoint** - Bearer token authentication
|
|
- **Discovery** - OpenID Connect Discovery and JWKS publication
|
|
- **Property Storage** - Simple key-value storage for user properties
|
|
|
|
## Technology Stack
|
|
|
|
- **Language**: Rust
|
|
- **Web Framework**: [axum](https://github.com/tokio-rs/axum)
|
|
- **Database**: SQLite via [SeaORM](https://www.sea-ql.org/SeaORM/)
|
|
- **Cryptography**: [josekit](https://github.com/hidekatsu-izuno/josekit-rs) for JOSE/JWT operations
|
|
- **Configuration**: [config-rs](https://github.com/mehcode/config-rs) with TOML support
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- Rust 1.70 or later
|
|
- SQLite 3
|
|
|
|
### Installation
|
|
|
|
```bash
|
|
# Clone the repository
|
|
git clone https://github.com/CloudNebulaProject/barycenter.git
|
|
cd barycenter
|
|
|
|
# Build the project
|
|
cargo build --release
|
|
```
|
|
|
|
### Configuration
|
|
|
|
Create a `config.toml` file (see `config.toml` for example):
|
|
|
|
```toml
|
|
[server]
|
|
host = "127.0.0.1"
|
|
port = 8080
|
|
public_base_url = "http://localhost:8080"
|
|
|
|
[database]
|
|
connection_string = "sqlite://barycenter.db?mode=rwc"
|
|
|
|
[keys]
|
|
jwks_path = "data/jwks.json"
|
|
private_key_path = "data/private_key.pem"
|
|
signing_algorithm = "RS256"
|
|
```
|
|
|
|
### Running
|
|
|
|
```bash
|
|
# Run with default config
|
|
cargo run
|
|
|
|
# Run with custom config
|
|
cargo run -- --config path/to/config.toml
|
|
|
|
# Run with debug logging
|
|
RUST_LOG=debug cargo run
|
|
```
|
|
|
|
## Development
|
|
|
|
### Building
|
|
|
|
```bash
|
|
# Debug build
|
|
cargo build
|
|
|
|
# Release build
|
|
cargo build --release
|
|
|
|
# Check without building
|
|
cargo check
|
|
```
|
|
|
|
### Testing
|
|
|
|
**This project uses [cargo-nextest](https://nexte.st/) for running tests.**
|
|
|
|
```bash
|
|
# Install nextest (one-time setup)
|
|
cargo install cargo-nextest
|
|
|
|
# Run all tests
|
|
cargo nextest run
|
|
|
|
# Run tests with logging
|
|
RUST_LOG=debug cargo nextest run
|
|
```
|
|
|
|
### Logging
|
|
|
|
Set the `RUST_LOG` environment variable to control logging levels:
|
|
|
|
```bash
|
|
# Debug level for all modules
|
|
RUST_LOG=debug cargo run
|
|
|
|
# Trace level for barycenter only
|
|
RUST_LOG=barycenter=trace cargo run
|
|
```
|
|
|
|
## API Endpoints
|
|
|
|
### Discovery
|
|
- `GET /.well-known/openid-configuration` - OpenID Provider metadata
|
|
- `GET /.well-known/jwks.json` - Public signing keys
|
|
|
|
### OAuth/OIDC
|
|
- `GET /authorize` - Authorization endpoint
|
|
- `POST /token` - Token endpoint
|
|
- `GET /userinfo` - UserInfo endpoint
|
|
- `POST /connect/register` - Dynamic client registration
|
|
|
|
### Properties (Non-standard)
|
|
- `GET /properties/:owner/:key` - Get property value
|
|
- `PUT /properties/:owner/:key` - Set property value
|
|
|
|
## Project Status
|
|
|
|
This is an early-stage implementation. See `docs/next-iteration-plan.md` for planned features and `docs/oidc-conformance.md` for OpenID Connect compliance details.
|
|
|
|
**Currently Implemented:**
|
|
- Authorization Code flow with PKCE (S256)
|
|
- Dynamic client registration
|
|
- Token issuance and validation
|
|
- ID Token generation with RS256 signing
|
|
- UserInfo endpoint
|
|
|
|
**Pending Implementation:**
|
|
- User authentication and session management
|
|
- Consent flow
|
|
- Refresh tokens
|
|
- Token revocation and introspection
|
|
- OpenID Federation support
|
|
|
|
## Contributing
|
|
|
|
Please read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct, development workflow, and the process for submitting pull requests.
|
|
|
|
## License
|
|
|
|
[Add your license here]
|
|
|
|
## Acknowledgments
|
|
|
|
Built with support from the OpenID Connect and OAuth 2.0 communities.
|