OAuth 2.0 provider for Elixir and Phoenix

I’ve made a few updates since I wrote this post. Now there’s added support for UUID (or custom primary key type), and works with Phoenix 1.3. Blog post has been updated too. All feedback is welcome

Thanks a ton @danschultzer

Finally got around to rewriting these libraries. With Pow I got a much better idea how these libraries should work.

It will be much easier to contribute to them moving forward It was a major rewrite so there are probably a lot of things that can be refactored, and I have overlooked. Any help would be much appreciated!

ExOauth2Provider v0.5.0 changes

Changelog

• Schema modules are now generated (with mix ex_oauth2_provider.gen.schemas). Now all configuration (e.g. binary id) are done on the individual schema modules. Previously there were issues if e.g. some app environment was not available during compilation, and configuration wasn’t particularly explicit.
• Configuration are primarily passed through the method calls with fallback to app environment.
• Ecto 3.0 support.

PhoenixOauth2Provider 0.5.0

Changelog

• Templates are now built in so you can get started without generating any views/templates!
• Phoenix 1.4 support.

Just updated the tutorial and demo app too:

https://dreamconception.com/tech/phoenix-full-fledged-api-in-five-minutes/

https://github.com/danschultzer/phoenix_ex_oauth2_provider_demo

Happy coding!

Thanks @danschultzer for the awesome work on the Oauth2.0 Provider. It’s been very helpful.

I was just wondering if an update for phoenix_oauth2_provider is on the way since the library currently depends on {:ex_oauth2_provider, "~> 0.5.1"} while the latest version of that library is {:ex_oauth2_provider, "~> 0.5.6"} which I imagine brings a bunch of improvements.

the link provided seems to be a place where attackers may be lurking.

The TLS certificate used by dreamconception.com expired on 21 Jul 2022, so I think it’s safe to assume the site is unmaintained.

As is the project, I assume, last commit 4 years ago: GitHub - danschultzer/phoenix_oauth2_provider: Get an OAuth 2 provider running in your phoenix with controllers, views and models in just two minutes · GitHub

EDIT: I missed the fresh project from the OP: GitHub - danschultzer/ex_oauth2_provider: Making OAuth 2 provider and authentication with http bearer as simple as possible for Elixir and Phoenix apps · GitHub

Hi, I have an app that uses Pow for authentication, and I have set up ExOauth2Provider - it works great!

I have a security concern, though. The OAuth tokens and refresh tokens are stored as plain text in the database. That seems risky; if the DB gets compromised, then the attacker gets the credentials.

Shouldn’t the tokens and refresh tokens be encrypted at rest? What’s your approach to this?

Maybe using cloak_ecto | Hex would help here, but we’d have to tweak ExOauth2Provider to get the tokens by hash?