# Authable
OAuth2 Provider implementation modules and helpers using `ecto` and `postgress` for any `elixir` application.
## Installation
The package can be installed as:
1. Add authable to your list of dependencies in `mix.exs`:
def deps do
[{:authable, "~> 0.4.0"}]
end
2. Ensure authable is started before your application:
def application do
[applications: [:authable]]
end
3. Add authable configurations to your `config/config.exs` file:
config :authable,
repo: Authable.Repo,
resource_owner: Authable.Models.User,
token_store: Authable.Models.Token,
client: Authable.Models.Client,
app: Authable.Models.App,
expires_in: %{
access_token: 3600,
refresh_token: 24 * 3600,
authorization_code: 300,
session_token: 30 * 24 * 3600
},
strategies: %{
authorization_code: Authable.GrantTypes.AuthorizationCode,
client_credentials: Authable.GrantTypes.ClientCredentialsGrantType,
password: Authable.GrantTypes.Password,
refresh_token: Authable.GrantTypes.RefreshToken
},
scopes: ~w(read write session)
If you want to disable a strategy then delete from strategies config.
If you want to add a new strategy then add your own module with `authorize(params)` function and return a `Authable.Models.Token` struct.
4. Add database configurations for the `Authable.Repo` on env config files:
config :authable, Authable.Repo,
adapter: Ecto.Adapters.Postgres,
username: "",
password: "",
database: "",
hostname: "",
pool_size: 10
5. Run migrations for Authable.Repo (Note: all id fields are UUID type):
mix ecto.migrate -r Authable.Repo
6. You are ready to go!
## Usage
### Generic Token Storage
To handle all possible token types, a generic token storage scheme is used for `Authable.Models.Token`. So, it can be used for all OAuth2 tokens and any other token scheme like confirmation token, password recovery tokens, mail list tokens, session tokens and etc...
:name, :string # Name of the token
:value, :string # Value of the token
:expires_at, :integer # Unix timestamp for when the token will expire
:details, :jsonb # Storage for all other information
:user_id # User(resource owner) foreign key
### Authorizing an App (Install App)
To authorize an app `Authable.OAuth2.authorize_app/2` function can be used.
### Generating Access Token
Authable has 4 grant types (authorization_code, password, client_credentials and refresh_token) to get an access token by default. To extend or use your own grant-type strategy, add your strategy into config and implement `authorize(params)` function and return a `Authable.Models.Token` struct.
`Authable.OAuth2.authorize(params)` will automatically determine which strategy to use by grant type. Then it authorize client and returns an access token to make further requests to resource server.
Note: To enable a strategy add it to config and to disable a strategy remove from the config.
### Authentication Helpers
Authable has 2 main authentication patterns,
1) Basic Authentication header resolver and
2) Token Authentication, including `Bearer` token and `Session` token.
All authentication patterns return on success a `Authable.Models.User` struct and on all other conditions it returns nil.
## Test
To run tests, jump into authable directory and run the command:
mix test
## Contributing
### Issues, Bugs, Documentation, Enhancements
1) Fork the project
2) Make your improvements and write your tests.
3) Make a pull request.
### To add new strategy:
Authable is an extensible module, you can create your strategy and share as hex package(Which can be listed on Wiki pages).
## Todo
- Documentation
- HMAC Auth will be added as a new external strategy
## References
https://tools.ietf.org/html/rfc6749