An identity gateway that allows application to authenticate users using various identity sources.
4.2K
Exter is an identity gateway that allows application to authenticate users using various identity sources.
Supported identity sources:
GitHub repository: https://github.com/btnguyen2k/exter
Run Exter on localhost:8000 with Google identity source enabled:
% docker run -d --name exter -p 8000:8000 \
-e EXTER_HOME_URL="http://localhost:8000" \
-e GOOGLE_API_PROJECT_ID=<proj-id> \
-e GOOGLE_API_CLIENT_ID=<client-id> \
-e GOOGLE_API_CLIENT_SECRET=<client-secret> \
btnguyen2k/exter
Common Application Configurations
| Env variable | Description | Default value |
|---|---|---|
| TIMEZONE | Timezone for date/time-related operations | Asia/Ho_Chi_Minh |
| HTTP_LISTEN_ADDR | Listen address for REST API | 0.0.0.0 |
| HTTP_LISTEN_PORT | Listen port for REST API | 8000 |
| HTTP_HEADER_APP_ID (1) | Name of HTTP header that holds "application id" info passed from client | X-App-Id |
| HTTP_HEADER_ACCESS_TOKEN (1) | Name of HTTP header that holds "access token" info passed from client | X-Access-Token |
| API_MAX_REQUEST_SIZE (2) | Maximum size of a HTTP request that client can send to Exter backend | 64kB |
| API_REQUEST_TIMEOUT (3) | Exter backend only waits up to this amount of time to read and parse request from client | 10s |
| INIT_SYSTEM_OWNER_ID (4) | User id of system "exter" app's owner |
- (1) Changing these configurations will affect all clients, including Exter frontend. Do not change them unless you have a good reason to.
- (2) Value of this configuration follows the format in this document https://github.com/lightbend/config/blob/master/HOCON.md#size-in-bytes-format
- (3) Value of this configuration follows the format in this document https://github.com/lightbend/config/blob/master/HOCON.md#duration-format
- (4) This is the email address of the user who will be the owner of the system "exter" app.
Security-related Configuration
| Env variable | Description | Default value |
|---|---|---|
| HTTP_ALLOW_ORIGINS (1) | CORS: value for "Access-Control-Allow-Origin" response header | * |
| RSA_PRIVKEY_FILE (2) | Path to RSA private key (PEM format) | ./config/keys/exter_priv.pem |
| RSA_PRIVKEY_PASSPHRASE (2) | Pass-phrase for RSA private key | exters3cr3t |
- (1) This affects only the Exter frontend. On development env you can use the default value. On production env put your fronend domains here. Domain names are separated by spaces or commas or semi-colons. For example
exteross.gpvcloud.com,exteross.mydomain.com;exteross.mydomain.net.- (2) On production env, do not use the default private key. Generate and use your own key.
Database Backend Configurations
| Env variable | Description | Default value |
|---|---|---|
| DB_TYPE | Type of database backend | sqlite |
As of v0.6.0, Exter supports the following database backends:
DB_TYPE=sqlite)Use SQLite as database backend. Not recommended for production use!
No other configuration is needed. SQLite data is stored in the directory ./data/sqlite.
DB_TYPE=cosmosdb)Use Azure Cosmos DB as database backend. Configurations for Azure Cosmos DB:
| Env variable | Description | Default value |
|---|---|---|
| DB_COSMOSDB_URL | Connection string to CosmosDB service | |
| DB_COSMOSDB_MULTITENANT | (boolean) If set to true, use only one CosmosDB collection to store all types of BO. Otherwise, each BO is stored in its own collection | true |
An example of the connection string:
AccountEndpoint=https://localhost:8081/;AccountKey=<cosmosdb_account_key>;Db=<cosmosdb_dbname>
DB_TYPE=dynamodb)Use AWS DynamoDB as database backend. Configurations for AWS DynamoDB:
| Env variable | Description | Default value |
|---|---|---|
| DB_DYNAMODB_REGION | AWS Region to connect to | |
| DB_DYNAMODB_ENDPOINT | Endpoint of AWS DynamoDB service | "" |
| DB_DYNAMODB_MULTITENANT | (boolean) If set to true, use only one DyanmoDB table to store all types of BO. Otherwise, each BO is stored in its own table | true |
| AWS_ACCESS_KEY_ID | AWS access key, used for authentication | |
| AWS_SECRET_ACCESS_KEY | AWS secret key, used for authentication |
AWS SDK automatically determines the endpoint based on the region value. Hence,
DB_DYNAMODB_ENDPOINTis optional. On dev env,DB_DYNAMODB_ENDPOINTcan be set to point to the local instance of AWS DynamoDB, for examplehttp://localhost:8000.
DB_TYPE=mongodb)Use MongoDB as database backend. Configurations for MongoDB:
| Env variable | Description | Default value |
|---|---|---|
| DB_MONGODB_DB | Name of MongoDB database to use | |
| DB_MONGODB_URL | Connection string to MongoDB server |
An example of the connection string to connect to standalone MongoDB server:
mongodb://test:test@localhost:37017/?authSource=admin.An example of the connection string to connect to MongoDB replica cluster:
mongodb://root:test@localhost:27017/admin?replicaSet=rsName&w=majority.
DB_TYPE=pgsql)Use PostgreSQL as database backend. Configurations for PostgreSQL:
| Env variable | Description | Default value |
|---|---|---|
| DB_PGSQL_URL | Connection string to PostgreSQL |
An example of the connection string:
postgres://test:test@localhost:5432/test?sslmode=disable&client_encoding=UTF-8&application_name=exter.
Identity Source Configurations
| Env variable | Description | Default value |
|---|---|---|
| LOGIN_CHANNELS (1) | List of enabled login channels, comma separated | facebook,github,google,linkedin |
| EXTER_HOME_URL (2) | Exter home url, used as "redirect_uri" for OAuth2 | |
| GOOGLE_API_PROJECT_ID (3) | Google API's project-id | |
| GOOGLE_API_CLIENT_ID (3) | Google API's client-id | |
| GOOGLE_API_CLIENT_SECRET (3) | Google API's client-secret | |
| GOOGLE_API_CLIENT_SECRET_JSON (4) | Full content of client secret file | |
| GITHUB_OAUTHAPP_CLIENT_ID (5) | GitHub OAuth App's Client ID | |
| GITHUB_OAUTHAPP_CLIENT_SECRET (5) | GitHub OAuth App's Client Secret | |
| FACEBOOK_APP_ID (6) | Facebook App ID | |
| FACEBOOK_APP_SECRET (6) | Facebook App Secret | |
| LINKEDIN_CLIENT_ID (7) | LinkedIn OAuth App's Client ID | |
| LINKEDIN_CLIENT_SECRET (7) | LinkedIn OAuth App's Client Secret | |
| LINKEDIN_REDIRECT_URI (8) | Redirect uri for LinkedIn OAuth flow |
- (1) As of version
0.5.0, supported identity sources aregithub,- (2) Used as
redirect_urifor OAuth2 (sincev0.3.0).- (3)(4) Create your Google API project at https://console.developers.google.com/apis/ and generate client secret info on page https://console.developers.google.com/apis/credentials. Either supply full content of the download client secret file in
GOOGLE_API_CLIENT_SECRET_JSONenvironment variable; or supply project-id, client-id, client-secret and authorized domains info:
GOOGLE_API_PROJECT_ID: your Google API's project idGOOGLE_API_CLIENT_ID: your Google API's client idGOOGLE_API_CLIENT_SECRET: your Google API's client secret- (5) Create your GitHub OAuth app at https://github.com/settings/developers
- Set app's
Authorization callback URLto<exter-url>/app/xlogin?cba=ghGITHUB_OAUTHAPP_CLIENT_ID: your GitHub OAuth app'sClient IDvalueGITHUB_OAUTHAPP_CLIENT_SECRET: your GitHub OAuth app'sClient Secretvalue- (6) Create your Facebook app at https://developers.facebook.com/apps/
FACEBOOK_APP_ID: your Facebook app'sApp IDvalueFACEBOOK_APP_SECRET: your Facebook app'sApp Secretvalue- (7)(8) Create your LinkedIn app with
Sign In with LinkedInproduct at https://www.linkedin.com/developers/
- Set app's
Authorized redirect URLto<exter-url>/app/xlogin?cba=lnLINKEDIN_CLIENT_ID: your LinkedIn OAuth app'sClient IDvalueLINKEDIN_CLIENT_SECRET: your LinkedIn OAuth app'sClient SecretvalueLINKEDIN_REDIRECT_URI: same as theAuthorized redirect URLabove
See on GitHub repository: https://github.com/btnguyen2k/exter
Content type
Image
Digest
sha256:ce6bb7001…
Size
45.1 MB
Last updated
almost 4 years ago
docker pull btnguyen2k/exter