{"id":19692537,"url":"https://github.com/thape-cn/oauth2id","last_synced_at":"2025-04-29T09:31:29.090Z","repository":{"id":37335510,"uuid":"172313627","full_name":"thape-cn/oauth2id","owner":"thape-cn","description":"Self-hosting SSO Portal, support Oauth2, Open ID Connect and SAML 2.0","archived":false,"fork":false,"pushed_at":"2025-04-25T14:25:51.000Z","size":6273,"stargazers_count":45,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-25T15:33:05.601Z","etag":null,"topics":["identity","oauth2","oauth2-provider","oauth2id","openid-connect","openid-connect-provider"],"latest_commit_sha":null,"homepage":"https://sso-id.com","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thape-cn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-02-24T08:26:33.000Z","updated_at":"2025-04-24T02:16:40.000Z","dependencies_parsed_at":"2024-01-04T04:29:49.577Z","dependency_job_id":"7aa03fbf-23c4-465c-b890-456dbf7e6bad","html_url":"https://github.com/thape-cn/oauth2id","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thape-cn%2Foauth2id","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thape-cn%2Foauth2id/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thape-cn%2Foauth2id/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thape-cn%2Foauth2id/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thape-cn","download_url":"https://codeload.github.com/thape-cn/oauth2id/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251473293,"owners_count":21595035,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["identity","oauth2","oauth2-provider","oauth2id","openid-connect","openid-connect-provider"],"created_at":"2024-11-11T19:13:42.308Z","updated_at":"2025-04-29T09:31:28.066Z","avatar_url":"https://github.com/thape-cn.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Circle CI](https://circleci.com/gh/thape-cn/oauth2id.svg?style=svg)](https://circleci.com/gh/thape-cn/oauth2id) [![Gitlab CI](https://git.thape.com.cn/Eric-Guo/oauth2id/badges/main/pipeline.svg)](https://git.thape.com.cn/Eric-Guo/oauth2id/-/commits/main)[![Docker Images](https://img.shields.io/badge/Docker%20Images-blue.svg)](https://hub.docker.com/r/ericguo/oauth2id/tags)\n\n# Oauth2id\n\nSSO Portal based on oauth2 id protocol\n\n# Self-Hosting\n\nBefore proceeding with Oauth2id installation, ensure you meet the following prerequisites:\n\n* A server with [Docker](https://www.docker.com/) installed: Oauth2id is designed to be self-hosted with Docker.\n* Rails master key, which is used to decrypt the credentials file. If you don't have one, ask for it from the project maintainer.\n\n## Docker Run\n\nTo set up Oauth2id using `docker run`, execute the following one command to start Oauth2id:\n\n1. Select a suitable directory as your application directory, and create a directory to store the Oauth2id database file:\n\n    ```\n    mkdir -p /opt/oauth2id/storage\n    ```\n\n    This step makes sure that storage directory is created and owned by the current user.\n\n2. Run the following command to start Oauth2id:\n\n    ```\n    cd /opt/oauth2id\n    docker run -p 3000:3000 -d --restart always --name oauth2id --env RAILS_MASTER_KEY=YourMasterKey -v ./storage:/rails/storage ericguo/oauth2id:main\n    ```\n    This command starts Oauth2id in the background, and exposes the Oauth2id web interface on port 3000. The `--env RAILS_MASTER_KEY=YourMasterKey` option is used to pass the Rails master key to the container. The `-v ./storage:/rails/storage` option is used to mount the storage directory on the host to the container. This is necessary to persist the Oauth2id database file.\n\n# Quickly Start\n\n```bash\ncp config/database.yml.sample config/database.yml\n# or ask for master.key\nrm config/credentials.yml.enc\nexport EDITOR=vim\n# paste credentials.yml.sample or skip\nbin/rails credentials:edit\nbin/rails test:all\n```\n\n# Build \u0026 Run in docker mode\n\n```bash\ndocker build --tag ericguo/oauth2id:main .\n# or `docker pull ericguo/oauth2id:main` to using existing images\ndocker run -p 3000:3000 -d --restart always --name oauth2id --env RAILS_MASTER_KEY=YourMasterKey -v ./storage:/rails/storage ericguo/oauth2id:main\n# If can not start in above, do the debug.\ndocker run --env RAILS_MASTER_KEY=YourMasterKey -v ./storage:/rails/storage -it ericguo/oauth2id:main bash\n# After success, push manually.\ndocker push ericguo/oauth2id:main\n```\n\n# Dev env setup\n\nSetup the puma-dev to support https in local.\n\n```\nbrew install puma/puma/puma-dev\nsudo puma-dev -setup\npuma-dev -install\ncd ~/.puma-dev\nln -s /Users/\u003cusername\u003e/git/oauth2id oauth2id\n```\n\nThen visit the `https://oauth2id.test` and accept the invalid https certificate, for higher version MacOS, need opening Keychain Access and moving the Puma-dev CA certificate into the System column under keychains then restarting the browser, [it's a known issue](https://github.com/puma/puma-dev/issues/84#issuecomment-252339375)\n\nIn order to make sure Faraday running in local also works well in https, we also need to add Puma-dev CA in OpenSSL library trust list as well, the OpenSSL CA is by default at `/usr/local/etc/openssl/cert.pem`, since we already have valid MacOS Pumda-dev CA in system, we can use [openssl-osx-ca](https://github.com/raggi/openssl-osx-ca) to regenerate the `cert.pem` file so just installs and regenerate `cert.pem` file.\n\nIn order to make [httpclient](https://github.com/nahi/httpclient/issues/335) also works well in https, need copy generated cert.pem to httpclient folder. There is two `pem` files in httpclient currently, but Puma-dev CA is 1024, so safe to overwrite.\n\n```bash\n# or /usr/local/etc/openssl@1.1/cert.pem depend on versions\ncp /usr/local/etc/openssl/cert.pem /usr/local/lib/ruby/gems/3.0.0/gems/httpclient-2.8.3/lib/httpclient/cacert.pem\n```\n\nFor Monterey running Apple Silicon on Ruby 3.2\n\n```bash\ncp /opt/homebrew/etc/openssl\\@1.1/cert.pem /opt/homebrew/lib/ruby/gems/3.2.0/gems/httpclient-2.8.3/lib/httpclient/cacert.pem\ncp /opt/homebrew/etc/openssl\\@1.1/cert.pem /opt/homebrew/etc/ca-certificates/cert.pem\n```\n\n## About UI\n\nOauth2id using [vali-admin](https://github.com/pratikborsadiya/vali-admin) UI v2.4.1 which based on the Bootstrap 4 and support *IE 11*.\n\nPlease visit UI document via:\n\n```\ncd node_modules/vali-admin/docs/\nthin -A file -c . -p 3001 start\nopen http://localhost:3001/index.html\n```\n\n# Generate signing key\n\n## Open ID Connect\n\nJust following [doorkeeper-openid_connect gem readme](https://github.com/doorkeeper-gem/doorkeeper-openid_connect#configuration):\n\n```bash\nopenssl genpkey -algorithm RSA -out oauth2id_oidc_private_key.pem -pkeyopt rsa_keygen_bits:2048\nopenssl rsa -pubout -in oauth2id_oidc_private_key.pem -out oauth2id_oidc_public_key.pem\n```\n\nNotice replace oauth2id with your new site name, notice you can get public key from [/oauth/discovery/keys](https://oauth2id.dev/oauth/discovery/keys) as well.\n\nAlso make sure the scope setting at least contain `openid` as it's the spec requirement. (Oauth2 can leave scope blank.)\n\n\n## SAML 2.0\n\n```bash\nopenssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout oauth2id_saml_key.key -out oauth2id_saml_cert.crt\n# Show SHA1 Fingerprint\nopenssl x509 -in oauth2id_saml_cert.crt -noout -sha256 -fingerprint\n```\n\n## Generate RS256 for asymmetric JWT\n\n```bash\nopenssl genpkey -algorithm RSA -out oauth2id_jwt_private_key.pem -pkeyopt rsa_keygen_bits:2048\nopenssl rsa -pubout -in oauth2id_jwt_private_key.pem -out oauth2id_jwt_public_key.pem\n```\n\n## Generate initial data\n\n\n```bash\nbin/setup\n```\n\n\n## To migrate MySQL to Postgresql\n\nGet db_converter.py from below:\n\nhttps://github.com/bhmj/mysql-postgresql-converter\n\n```bash\nmysqldump --set-gtid-purged=OFF --no-tablespaces --compatible=postgresql --default-character-set=utf8 -r databasename.mysql -u thape_sso_prod thape_sso_prod -p\npython ./mysql-postgresql-converter/db_converter.py databasename.mysql databasename.psql\nzip -9 databasename.zip databasename.psql\n```\n\nCopy the databasename.psql and import via below.\n\n```bat\npsql -d postgres\n```\n\n```psql\nDROP DATABASE thape_sso_dev;\nCREATE DATABASE thape_sso_dev WITH ENCODING='UTF8' OWNER='guochunzhong';\n\\q\n```\n\n```bat\npsql -d thape_sso_dev -f databasename.psql\n```\n\nMay replace ' datetime(6) ' with ' timestamp(6) without time zone '.\n\n## Notes to using thape production data\n\nNeed running below to make production sign-in success.\n\n```ruby\nu=User.find 4431 # it's me\nu.confirm\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthape-cn%2Foauth2id","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthape-cn%2Foauth2id","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthape-cn%2Foauth2id/lists"}