Client to access an authorization server for oauth2 token validation in a distributed environment.
In an oauth2 scenario it is quite likely that your authorization server is not the same as your resource server. In this case the resource server needs to be able to validate tokens against the authorization server. There are several ways to do this. One is to use public/private key encrypted long token that contains all the relevant information as part of the token. This requires sharing keys between authorization server and resource server. While fast this suffers 2 drawbacks: Long tokens and the necessity to work with very short lived tokens.
Another approach is to have the resource server contact the authorization server and ask the authorization server to validate a token. This is the path taken by this module, which implements the client side. An authorization server needs to implement an endpoint (for example /v1/token-infos/:token) that returns either a 404 (there is no valid token info for the token) or a 200 with the following format:
actor: actorId (string uniquely identifying the actor) ... additional actor information, optional scopes: ["scope1",...] (An array of scopes) expiresIn: 1234 (number of seconds this token is still valid)
Caching is not yet enabled.
npm install authorization-server-client
authorizationServerClient = require 'authorization-server-client' client = authorizationServerClient.client "https://yourauthorizationserver.com/v1/token-infos", maxTokenCache: 60 * 10 # Number of seconds a token is kept in a local cache. Keep this rather short. client.validate tokenToValidate, (err,result) => # err is set if something happened that was unexpected, including an unreachable client. # It is probably a good idea to return a 502 (bad gateway) if an err is present # If err is not set, then result contains the following: # isValid: true/false # if it is valid in addition # actor: # actorId # ... # expiresIn: 13324 # scopes: 
Follow us on Twitter at
and like us on Facebook please. Every mention is welcome and we follow back.
Copyright (c) 2012 ScottyApp, Inc. See LICENSE for further details.