danschultzer
OAuth 2.0 provider for Elixir and Phoenix
In short
Plug n’ play OAuth 2.0 provider library. Just set up a resource owner schema with Ecto (your user schema), install the dependency and run the install task. That’s it! 
ExOauth2Provider
PhoenixOauth2Provider
Background
This is my first full project in Elixir. The reason for building these hex libraries was that I needed a flexible plug n’ play OAuth 2.0 provider for a Phoenix project I’m working on. The other options I found didn’t cut it for me, and I was looking for something akin to Doorkeeper for Rails. Basically a no brainer library, that I can adjust after getting it up and running.
Use case
I wrote a blog post on how you can create a versioned API using OAuth 2.0 access tokens in minutes using this library: https://dreamconception.com/tech/phoenix-full-fledged-api-in-five-minutes/
I hope this can be useful for some of you. Please feel free to help improve the libraries with suggestions or PR’s!
Trending in Announcing
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Phoenix, LiveView, multimedia pipelines, distributed systems. 400 engineers, Elixir since 2017. Available for hire.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First 9 of 9 Posts
danschultzer
I’ve made a few updates since I wrote this post. Now there’s added support for UUID (or custom primary key type), and works with Phoenix 1.3. Blog post has been updated too. All feedback is welcome
collegeimprovements
Thanks a ton @danschultzer
danschultzer
Finally got around to rewriting these libraries. With Pow I got a much better idea how these libraries should work.
It will be much easier to contribute to them moving forward
It was a major rewrite so there are probably a lot of things that can be refactored, and I have overlooked. Any help would be much appreciated!
ExOauth2Provider v0.5.0 changes
Changelog
mix ex_oauth2_provider.gen.schemas). Now all configuration (e.g. binary id) are done on the individual schema modules. Previously there were issues if e.g. some app environment was not available during compilation, and configuration wasn’t particularly explicit.PhoenixOauth2Provider 0.5.0
Changelog
danschultzer
Just updated the tutorial and demo app too:
https://dreamconception.com/tech/phoenix-full-fledged-api-in-five-minutes/
https://github.com/danschultzer/phoenix_ex_oauth2_provider_demo
Happy coding!
cmush
Thanks @danschultzer for the awesome work on the Oauth2.0 Provider. It’s been very helpful.
I was just wondering if an update for phoenix_oauth2_provider is on the way since the library currently depends on
{:ex_oauth2_provider, "~> 0.5.1"}while the latest version of that library is{:ex_oauth2_provider, "~> 0.5.6"}which I imagine brings a bunch of improvements.SoldierCoder
the link provided seems to be a place where attackers may be lurking.
adamu
The TLS certificate used by
dreamconception.comexpired on 21 Jul 2022, so I think it’s safe to assume the site is unmaintained.iarekk
As is the project, I assume, last commit 4 years ago: GitHub - danschultzer/phoenix_oauth2_provider: Get an OAuth 2 provider running in your phoenix with controllers, views and models in just two minutes · GitHub
EDIT: I missed the fresh project from the OP: GitHub - danschultzer/ex_oauth2_provider: Making OAuth 2 provider and authentication with http bearer as simple as possible for Elixir and Phoenix apps · GitHub
spurgus
Hi, I have an app that uses Pow for authentication, and I have set up ExOauth2Provider - it works great!
I have a security concern, though. The OAuth tokens and refresh tokens are stored as plain text in the database. That seems risky; if the DB gets compromised, then the attacker gets the credentials.
Shouldn’t the tokens and refresh tokens be encrypted at rest? What’s your approach to this?
Maybe using cloak_ecto | Hex would help here, but we’d have to tweak ExOauth2Provider to get the tokens by hash?