{"id":13566641,"url":"https://github.com/please-openit/oidc-bash-client","last_synced_at":"2025-04-04T00:31:37.682Z","repository":{"id":45900745,"uuid":"266163782","full_name":"please-openit/oidc-bash-client","owner":"please-openit","description":"a bash openid connect client","archived":false,"fork":false,"pushed_at":"2024-04-09T19:10:27.000Z","size":232,"stargazers_count":103,"open_issues_count":2,"forks_count":19,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-04T21:37:02.711Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/please-openit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-22T17:00:09.000Z","updated_at":"2024-10-03T12:54:41.000Z","dependencies_parsed_at":"2024-04-09T20:28:10.495Z","dependency_job_id":"6d5f164f-ced5-41b8-8a25-4f968d294d0d","html_url":"https://github.com/please-openit/oidc-bash-client","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Foidc-bash-client","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Foidc-bash-client/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Foidc-bash-client/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Foidc-bash-client/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/please-openit","download_url":"https://codeload.github.com/please-openit/oidc-bash-client/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247103291,"owners_count":20884023,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T13:02:13.766Z","updated_at":"2025-04-04T00:31:37.309Z","avatar_url":"https://github.com/please-openit.png","language":"Shell","funding_links":[],"categories":["Shell","Tools"],"sub_categories":[],"readme":"# please-open.it bash oauth2/openid connect wrapper\n\n## Purpose\n[please-open.it](https://please-open.it) specializes in authentication and web security, and provides Keycloak as a service.\n\nThis bash script is an oauth2 wrapper. You can make any authentication request from command line with the right arguments.\n\nSupported operations are : \n\n- get oidc server infos\n- client credentials\n- implicit flow\n- authorization code flow\n- resource owner password\n- auth code exchange\n- token exchange\n- refresh token\n- end session\n- token introspection\n- user infos\n- device code\n- poll token\n\nUse it as a guide for oauth2/openid connect discovery or in any testing/integration process. Script is totally stateless, save the output of a command in variables to reuse tokens.\n\n## Install\n\nYou need curl, jq and netcat installed.\n\nNote : on Debian, install netcat-openbsd version\n\n```\napt-get install netcat-openbsd\n```\n\n## Quick tour Using Google\n\n### Discovery document\n\nGoogle is an OpenIdConnect provider, you can get the [discovery document](https://developers.google.com/identity/protocols/oauth2/openid-connect#discovery) at https://accounts.google.com/.well-known/openid-configuration\n\n```\n./oidc-client.sh --operation get_oidc_server_infos --openid-endpoint https://accounts.google.com/.well-known/openid-configuration\n```\n\n![img/google_1.png](img/google_1.png)\n\n### Get a new token\n\n*Using authorization_code_grant process, a standard for the web supported by all providers, you can get a new token from an authorization_code. To get a new authorization_code, \n\n```\n./oidc-client.sh --operation authorization_code_grant --client-id 947227895516-68tp60nti613r42u41bch5vesr5iqpbi.apps.googleusercontent.com --openid-endpoint https://accounts.google.com/.well-known/openid-configuration --redirect-uri http://127.0.0.1:8080 --scope email\n```\n\nThen the console shows : \n\n```\nOPEN THIS URI IN YOUR WEB BROWSER\nhttps://accounts.google.com/o/oauth2/v2/auth?client_id=947227895516-68tp60nti613r42u41bch5vesr5iqpbi.apps.googleusercontent.com\u0026scope=email\u0026response_type=code\u0026response_mode=fragment\u0026redirect_uri=http://127.0.0.1:8080\n-- LISTENING ON PORT 8080 FOR A REDIRECT\n```\n\n\u003e ✅ Add `--state` (default: \"foobar\") to the end of the command above to\n\u003e provide a state and/or `--nonce` (default: today's date in UNIX time) to add a\n\u003e nonce. You can also provide a custom state/nonce by adding a string after\n\u003e `--state` or `--nonce`.\n\nOpen your web browser and paste the URI shown in the console. You will have a login screen then a consent screen. Afterthat, redirect process will show a page from 127.0.0.1:8080 with all given data. Get your authorization code.\n\nSecond step is exchanging an authorization_code for a token. The operation \"auth_code\" is designed for : \n\n```\n./oidc-client.sh --operation auth_code --client-id 947227895516-68tp60nti613r42u41bch5vesr5iqpbi.apps.googleusercontent.com --client-secret ****************** --openid-endpoint https://accounts.google.com/.well-known/openid-configuration --redirect-uri http://127.0.0.1:8080 --authorization-code 4/0AH1T7cXxcNot62nDDUspvbINZ6vP3Qk9oEiy6xhJmuRbIIdJw65LdOc2QPWKO8qaHTQ67g1qg96mjS5R9dWVFs\n```\n\n\u003e ✅ If you provided `--state` and `--nonce` earlier, make sure to provide them\n\u003e to `auth_code`. Otherwise, the token exchange will fail.\n\n![img/google_token.png](img/google_token.png)\n\n### User infos\n\nusing the access_token we got previously : \n\n![img/google_user_infos.png](img/google_user_infos.png)\n\n## Build for Keycloak ?\n\nOf course ! Keycloak has its own discovery document (for a realm) with the \"OpenID Endpoint Configuration\" link. Keycloak supports all operations of this bash script, please refer to the documentation links for each operation below.\n\nFeel free to test it with a realm you can get at [https://realms.please-open.it](https://realms.please-open.it).\n\n## Filter\n\nEach operation output some formatted JSON code. By using --field argument, you can filter the output with JQ [grammar](https://jqplay.org/).\n\n## Operations\n\n### get_oidc_server_infos\n\n[https://openid.net/specs/openid-connect-discovery-1_0.html](https://openid.net/specs/openid-connect-discovery-1_0.html)\n\nGet oauth2 and openid connect endpoint locations using the discovery document.\n\n--openid-endpoint\n\n### client_credentials\n\n[https://www.mathieupassenaud.fr/oauth-backend/](https://www.mathieupassenaud.fr/oauth-backend/)\n\nPerform client_credentials authentication request.\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret\n\n### resource_owner_password_grant\n\n[https://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html](https://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html)\n\nMake an authentication request with client credentials and user credentials.\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret (optionnal in case of public client)\n\n--username\n\n--password\n\n--scope\n\n### end_session\n\nJust log out the user by revoking tokens\n\n--openid-endpoint OR --end-session-endpoint\n\n--access-token\n\n--refresh-token\n\n--client-id\n\n--client-secret (optionnal if client is public)\n\n### refresh_token\n\nRenew an access_token using a refresh_token\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret (optionnal if client is public)\n\n--refresh-token\n\n### token_exchange\n\n[https://www.mathieupassenaud.fr/token-exchange-keycloak/](https://www.mathieupassenaud.fr/token-exchange-keycloak/)\n\nPerform a token_exchange operation\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret\n\n--access_token\n\n--issuer\n\n### implicit_grant\n\n[https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow)\n\nFOR LEGACY APPLICATIONS ONLY\n\nInitiate a connection by showing an URL you have to open using your local web browser.\n\nThen, a local web server (using netcat) will respond with a single page showing tokens returned by the authentication server in the redirect_uri.\n\nBy default, redirect URI has to be http://127.0.0.1:8080, you can have your own web server for this usage.\n\n--openid-endpoint OR --authorization-endpoint\n\n--client-id\n\n--redirect-uri\n\n--scope\n\n### authorization_code_grant\n\n[https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow)\n\nInitiate a connection by showing an URL you have to open using your local web browser.\n\nThen, a local web server (using netcat) will respond with a single page showing the authorization_code returned by the authentification server in the redirect_uri.\n\nBy default, redirect URI has to be http://127.0.0.1:8080, you can have your own web server for this usage.\n\n--openid-endpoint OR --authorization-endpoint\n\n--client-id\n\n--redirect-uri\n\n--scope\n\n--state [STATE] (default: \"foobar\")\n\n--nonce [NONCE] (default: `date +%s`)\n\n### auth_code\n\nChange an authorization_code to a token\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret (optionnal for public clients)\n\n--redirect-uri\n\n--state [STATE] (default: \"foobar\")\n\n--nonce [NONCE] (default: `date +%s`)\n\n### token_introspect\n\n[https://www.oauth.com/oauth2-servers/token-introspection-endpoint/](https://www.oauth.com/oauth2-servers/token-introspection-endpoint/)\n\nGet details about a token\n\n--openid-endpoint OR --token-introspection-endpoint\n\n--client-id\n\n--client-secret\n\n--access-token\n\n### user_info\n\nGet all user informations\n\n--openid-endpoint OR --userinfo-endpoint\n\n--access-token\n\n### device_code\n\nInitiate a device_code flow\n\n--openid-endpoint OR --device-authorization-endpoint\n\n--client-id\n\n--client-secret\n\n### poll_token\n\nGet a token (poll operation, renew if necessary), IE for a device_code flow\n\n--openid-endpoint OR --token-endpoint\n\n--client-id\n\n--client-secret\n\n--device-code\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplease-openit%2Foidc-bash-client","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplease-openit%2Foidc-bash-client","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplease-openit%2Foidc-bash-client/lists"}