{"id":13565373,"url":"https://github.com/linked-solutions/fuseki-oidc","last_synced_at":"2026-01-12T09:11:59.304Z","repository":{"id":39549379,"uuid":"169534206","full_name":"linked-solutions/fuseki-oidc","owner":"linked-solutions","description":null,"archived":false,"fork":false,"pushed_at":"2023-01-07T04:59:51.000Z","size":23834,"stargazers_count":9,"open_issues_count":23,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-04T18:46:45.291Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/linked-solutions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-02-07T07:26:43.000Z","updated_at":"2024-01-13T23:59:28.000Z","dependencies_parsed_at":"2023-02-06T12:31:40.357Z","dependency_job_id":null,"html_url":"https://github.com/linked-solutions/fuseki-oidc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/linked-solutions%2Ffuseki-oidc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/linked-solutions%2Ffuseki-oidc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/linked-solutions%2Ffuseki-oidc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/linked-solutions%2Ffuseki-oidc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/linked-solutions","download_url":"https://codeload.github.com/linked-solutions/fuseki-oidc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247090117,"owners_count":20881919,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T13:01:45.670Z","updated_at":"2026-01-12T09:11:59.298Z","avatar_url":"https://github.com/linked-solutions.png","language":"Java","funding_links":[],"categories":["Java"],"sub_categories":[],"readme":"# Fuseki OIDC\n\nAn [Apache Fuseki](http://jena.apache.org/documentation/fuseki2/index.html) extension and Docker distribution that provides \nOIDC based access control to Fuseki SPARQL Endpoint. The project is work in progress and currently known to work with the [Keycloak](https://www.keycloak.org/)\nopen source Identity and Access Management solution.\n\n## Info\n\nThis Fuseki distribution allows to access the SPARQL Endpoints both using standard HTTP Basic-Auth and logging in as admin user\n(its default password is `pw`) as well as by authenticating with a keycloak server.\nThis project provides ability to have flexible graph based permissions control for TDB2 datasets.   \nAuthorization is based on access-control definitions contained in graph specified in the configuration, by default in the graph `urn:fuseki-oidc:security`. Each user can have assigned read/write permissions to a concrete graph or to all graphs whose names match a specified [ANT style pattern](http://ant.apache.org/manual/dirtasks.html#patterns).\nAlso each user have complete access to it's \"OWN\" graph, the prefix for this graph can be specified. By default the graph is name as follows: `urn:fuseki-oidc:user:{username}`.\nBy default the admin user has ability to login through basic auth and has full access to every graph in dataset.\n\n[![Secured installation on server screencast](https://img.youtube.com/vi/4jI5GM_AOFs/0.jpg)](https://www.youtube.com/watch?v=4jI5GM_AOFs)\n\n## To build application you will need:\n* Docker\n\n### Building\n\n    docker build -t linkedsolutions/fuseki-oidc .\n\nNote however that in most cases you won't need to build the docker image as this is provided via docker-hub.\n\n### Running\n\nIf you just want to try out things on your local machine we recommend you use the provided docker-compose file and skip forward to the [Launching with docker-compose](#launching-with-docker-compose) section.\n\nAs a prerequisite to run fuseki-oidc you'll need an instance of keycloak running and configured, see the section [Keycloak setup](#keycloak-setup) below for information on how to set up keycloak.\n\nAssuming your keycloak instance is running on `auth.example.org:8080` you can start fuseki-oidc with \n\n    docker run -e AUTH_SERVER_URL=http://auth.example.org:8080/auth -p 3030:3030 linkedsolutions/fuseki-oidc\n\n__IMPORTANT__: The specified AUTH_SERVER_URL must both be the URL the end user sees during as well as be accessible by the fuseki instance, `localhost`-urls do not work as this will resolve to the docker container to fuseki.\n\nTo test the fuseki-oidc instance you just launched you may want to use the provided [sample-client](sample-client-app).\n\n#### Launching with docker-compose\n\nThe provided `docker-compose.yml` serves as reference for launching Fuseki OIDC with [docker-compose](https://docs.docker.com/compose/) as well as to launch all required conatiners locally (for testing purposes).\n\nAs mentioned the above the authenticating server must be accessible under the same hostname both by the user as well as by fuseki and `localhost` doesn't work for this purpose. Because of this to use the docker-compose file as it is you'll need to add a host entry to your `/etc/hosts` file (`C:\\Windows\\System32\\Drivers\\etc\\hosts` on windows).\n\nAdd the following line to have the hostname `keycloak` point to the local machine.\n\n    127.0.0.1 keycloak\n\nAfter adding this entry you can start fuseki oidc, keycloak and the sample client simply by executing\n\n    docker-compose up\n\nFirst you'll want to access http://keycloak:8080/auth/admin/ to configure Keycloak as described inthe section [Keycloak setup](#keycloak-setup) below. Once keycloak is configured you may access the sample at http://localhost:8081/ and use https://keycloak:8080/auth/realms/master as authority and http://localhost:5030/ds/query / http://localhost:5030/ds/update as SPARQL endpoints. Do not use the admin user to test SPARQL (not sure why this currently doesn't work).\n\n### Configuration\n\nIn productive settings you'll typically want to configure at least the admin password for fuseki, which is done with the `shiro.ini` file. Often wou'll also want to make changes to the fuseki configuration (that's the `config.ttl` file). Also you'll want to make changes to the security graph (changes made to this graph at runtime are currently not persistent).\n\nThe 3 mentioned files are located at the folowing locations within the fuseki-oidc container:\n\n - /usr/local/fuseki/shiro.ini\n - /usr/local/fuseki/config.ttl\n - /sec-data.ttl\n\nWhen starting docker on unix/linux you may use `-v` parameter to replace a default configuration file, e.g:\n\n    docker run -v `pwd`/conf/admin_security_data.ttl:/sec-data.ttl -e AUTH_SERVER_URL=http://auth.example.org:8080/auth -p 3030:3030 linkedsolutions/fuseki-oidc\n\nThe above doesn't work on windows where it is not possible to mount individual files. \n\nWith docker-compose you can use the `volumes` directive to replace such a file, e.g.:\n\n    volumes:\n      - ./conf-fuseki-oidc/shiro.ini:/usr/local/fuseki/shiro.ini\n\nThe docker-compose versions works both with unix systems as well as on windows.\n\n## Security configuration\nThere is one predefined security graph, the name can be configured and defaults to `\u003curn:fuseki-oidc:security\u003e` \nIt will contain information about user access rights to the other graphs. \nThis graph contains instances of `acl:Authorization` that grant a user or a class of users\naccess to a graph or all graph with a name matching a specified pattern.\n\nFuseki-OIDC uses the acl Ontology defined at http://www.w3.org/ns/auth/acl# offering partial support with extensions defined in https://linked.solutions/fuseki-oidc/ontology# described in [ontology.ttl](./ontology.ttl).\n\n      \n## Keycloak setup\n* Get the last docker image jboss/keycloak\n* Run with `docker run -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -p 8080:8080 jboss/keycloak`   \n  username and password can be changed of course \n* Go to http://localhost:8080/auth/admin/, login as admin with credentials\n* Open \"Realm Settings\" -\u003e \"Tokens\" and setup default signature to RS-256\n* Enable `User registration` in \"Realm Settings\" -\u003e \"Login\"\n  or just add any identity provider in \"Identity Providers\" page   \n  _IMPORTANT_ you need to include `email` into \"Default Scopes\" of an identity provider\n* setup new client for frontend, set name and url. \n  After it created add an email mapper in \"Mappers\" tab using \"Add Builtin\" button\n  * Enable Implicit Flow for this client in its keycloak settings\n* Library for frontend interaction with Keycloak can be found [here](https://www.npmjs.com/package/keycloak-js)\n\nAdditional information about [keycloak](https://www.keycloak.org/).  \n\n## Thanks\nThanks to [SmartSwissParticipation](smartswissparticipation.com) for developing an initial version\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flinked-solutions%2Ffuseki-oidc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flinked-solutions%2Ffuseki-oidc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flinked-solutions%2Ffuseki-oidc/lists"}