{"id":13740426,"url":"https://github.com/Tecsisa/foulkon","last_synced_at":"2025-05-08T20:31:13.861Z","repository":{"id":84764260,"uuid":"66350311","full_name":"Tecsisa/foulkon","owner":"Tecsisa","description":"Authorization server written in Go","archived":true,"fork":false,"pushed_at":"2018-04-09T07:27:33.000Z","size":10412,"stargazers_count":83,"open_issues_count":9,"forks_count":15,"subscribers_count":12,"default_branch":"master","last_synced_at":"2024-11-15T10:42:12.778Z","etag":null,"topics":["authorization","golang","oidc","proxy","rbac","server"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Tecsisa.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-08-23T08:51:30.000Z","updated_at":"2023-12-08T16:40:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"355ccf47-a0e1-48ac-9e35-05442fe8dd0d","html_url":"https://github.com/Tecsisa/foulkon","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Tecsisa%2Ffoulkon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Tecsisa%2Ffoulkon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Tecsisa%2Ffoulkon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Tecsisa%2Ffoulkon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Tecsisa","download_url":"https://codeload.github.com/Tecsisa/foulkon/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253144635,"owners_count":21861092,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","golang","oidc","proxy","rbac","server"],"created_at":"2024-08-03T04:00:47.685Z","updated_at":"2025-05-08T20:31:13.477Z","avatar_url":"https://github.com/Tecsisa.png","language":"Go","funding_links":[],"categories":["Authorization","Authorization Development"],"sub_categories":["\u003ca name=\"authZ-golang\"\u003e\u003c/a\u003eGolang"],"readme":"# Foulkon\n[![Build Status](https://travis-ci.org/Tecsisa/foulkon.svg?branch=master)](https://travis-ci.org/Tecsisa/foulkon)\n[![Join the chat at https://gitter.im/Tecsisa/foulkon](https://badges.gitter.im/Tecsisa/foulkon.svg)](https://gitter.im/Tecsisa/foulkon?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge\u0026utm_content=badge)\n[![Go Report Card](https://goreportcard.com/badge/github.com/tecsisa/foulkon)](https://goreportcard.com/report/github.com/tecsisa/foulkon)\n[![codecov](https://codecov.io/gh/Tecsisa/foulkon/branch/master/graph/badge.svg)](https://codecov.io/gh/Tecsisa/foulkon)\n[![Release](https://img.shields.io/badge/release-v0.4.0-blue.svg)](https://github.com/Tecsisa/foulkon/blob/master/CHANGELOG.md#v030-2017-01-25)\n\u003cimg align=\"right\" src=\"https://github.com/Tecsisa/foulkon/blob/master/dist/foulkon.png\" width=\"150\"\u003e\n\n__Foulkon__ is an authorization server that allows or denies access to web resources.\n\nThis system depends on an identity provider that authenticates users.\nIn this first version we will only implement the OIDC protocol validation.\nThis is a scheme flow:\n\n![Image of IAM](https://docs.google.com/drawings/d/1NctH8BB6ZB02ig3fR-Wu4tGx52Qpb4vG8Po8fUMoH5E/pub?w=610\u0026h=518)\n\n1. User opens a webapp (client) with a browser.\n2. Client sends a request to IDP to get a token for this user.\n3. Browser is redirected to IDP authentication endpoint where user uses its credentials to authenticate.\n4. IDP redirects user to client. Client uses the code generated by IDP to exchange a valid OIDC token.\n5. Client asks the resource provider for a specified resource using the token received by IDP.\n6. Resource provider asks to AuthZ sending resource name (urn), action and OIDC token received from client. To avoid this logic there is a proxy tool\nthat you can use to do the authorization.\n7. AuthZ verify the token signature using keys from IDP.\n8. AuthZ sends the resulting effect associated to resources + action + user (extracted from OIDC token).\n    - If a resource or some resources are allowed, the resource provider serves the resources to the client.\n    - If there isn't any resource allowed, AuthZ response will be 403 forbidden.\n\n## Installation / usage\n\nThis project generates 2 apps:\n\n- Worker: This is the authorization server itself.\n- Proxy: This transfers the requests to the authorization server (worker).\n\nInstallation/deployment docs using Go binaries or Docker:\u003cbr /\u003e\n- [Worker](doc/deploy/worker.md)\n- [Proxy](doc/deploy/proxy.md)\n\n## Documentation\n\nSpecification docs:\n- [Specification](doc/spec/README.md)\n- [Use case](doc/spec/usecase.md)\n- [Internal IAM Actions](doc/spec/action.md)\n\nAPI docs:\n- [User](doc/api/user.md)\n- [Group](doc/api/group.md)\n- [Policy](doc/api/policy.md)\n- [Proxy Resource](doc/api/proxy_resource.md)\n- [OIDC Provider](doc/api/oidc_provider.md)\n- [Authorization](doc/api/resource.md)\n\nYou can also import this [Postman collection](schema/postman.json) file with all API methods.\n\n## Limitations\n\nSince validation is different in each identity provider, Foulkon needs __ID Token__ instead of __Access Token__ in order to check user permissions\nin Authorization header with type bearer.\nE.g.:\n\n```\nGET /example/resource HTTP/1.1\n  Host: server.example.com\n  Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjFlOWdkazcifQ.ewogImlzcyI6ICJodHRwOi8vc2VydmVyLmV4YW1wbGUuY29tIiwKICJzdWIiOiAiMjQ4Mjg5NzYxMDAx\n  IiwKICJhdWQiOiAiczZCaGRSa3F0MyIsCiAibm9uY2UiOiAibi0wUzZfV3pBMk1qIiwKICJleHAiOiAxMzExMjgxOTcwLAogImlhdCI6IDEzMTEyODA5NzAKfQ.ggW8hZ1EuVLuxNuuIJKX_V8\n  a_OMXzR0EHR9R6jgdqrOOF4daGU96Sr_P6qJp6IcmD3HP99Obi1PRs-cwh3LO-p146waJ8IhehcwL7F09JdijmBqkvPeB2T9CJNqeGpe-gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgj\n  xqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK5hoDalrcvRYLSrQAZZKflyuVCyixEoV9GfNQC3_osjzw2PAithfubEEBLuVVk4XUVrWO\n  LrLl0nx7RkKU8NXNHq-rvKMzqg\n```\n\n## Development\n\nFor local development, first make sure Go is properly installed according to [Go install doc](https://golang.org/doc/install) (Also, include $GOBIN environment var in your $PATH). Then run next command in project root path:\n\n```\n$ make bootstrap\n```\n\nAfterwards type make test. This will run the tests. If this exits with exit status 0, then everything is working!\n\n```\n$ make test\n```\n\nTo compile a development version of Foulkon, run make dev. This will put the Foulkon binaries in the $GOPATH/bin folder:\n\n```\n$ make dev\n...\n$ $GOPATH/bin/worker\n$ $GOPATH/bin/proxy\n...\n```\n\n## Contribution policy\n\nContributions via GitHub pull requests are gladly accepted from their original author. Along with any pull requests, please state that the contribution is your original work and that you license the work to the project under the project's open source license. Whether or not you state this explicitly, by submitting any copyrighted material via pull request, email, or other means you agree to license the material under the project's open source license and warrant that you have the legal authority to do so.\n\nPlease make sure to follow these conventions:\n- For each contribution there must be a ticket (GitHub issue) with a short descriptive name, e.g. \"run go imports in Makefile\"\n- Work should happen in a branch named \"ISSUE-DESCRIPTION\", e.g. \"32-go-imports-in-Makefile\"\n- Before a PR can be merged, all commits must be squashed into one with its message made up from the ticket name and the ticket id, e.g. \"better go files formatting: run go imports in Makefile (closes #32)\"\n\n#### Questions\n\nIf you have a question, preferably use Gitter chat. As an alternative, prepend your issue with `[question]`.\n\n## License\n\nThis code is open source software licensed under the [Apache 2.0 License](http://www.apache.org/licenses/LICENSE-2.0.html).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTecsisa%2Ffoulkon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FTecsisa%2Ffoulkon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTecsisa%2Ffoulkon/lists"}