The simple and small OAuth2 | OpenId Connect server that secures applications without hassle.
STOPnik does not have any persistence layer and will only work in-memory with the clients and users defined in the
configuration file (YAML).
When restarted, all issued tokens will become invalid/forgotten by STOPnik.
This project was used to learn OAuth 2.0, OpenId Connect Core 1.0 and Go.
The logo mascot was mostly inspired by the nice work of gopherize.me and redrawn by hand as a vector graphic with additional body and a cool hat.
The awesome work of other servers is very appreciated, most of them were the inspiration for this small project!
They add features like persistence and access to user directories like LDAP.
| Specifications | Implementation |
|---|---|
| The OAuth 2.0 Authorization Framework | Yes |
| Proof Key for Code Exchange by OAuth Public Clients | Yes |
| OAuth 2.0 Token Introspection | Yes |
| OAuth 2.0 Token Revocation | Yes |
| JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants | Yes |
| JSON Web Token (JWT) | Dependency |
| OAuth 2.0 Authorization Server Metadata | Partially |
| OAuth 2.0 Device Authorization Grant | Planned |
| The OAuth 2.0 Authorization Framework: Bearer Token Usage | Planned |
| Resource Indicators for OAuth 2.0 | Planned |
| OAuth 2.0 Authorization Server Issuer Identification | Planned |
| OpenID Connect Core 1.0 | Partially |
| OpenID Connect Discovery 1.0 | Partially |
| OpenID Connect Session Management 1.0 | Planned |
| OpenID Connect Front-Channel Logout 1.0 | Planned |
More details about STOPnik can be found at https://stopnik.webish.dev/
Docker images for linux/amd64 and linux/arm64 are published to the GitHub Container Registry with every release.
The image expects the configuration file at /config.yml, e.g. to run with the minimal configuration
docker run --rm -p 8080:8080 -v "$(pwd)/minimal-config.yml:/config.yml:ro" ghcr.io/webishdev/stopnik:latestPrebuilt binaries for Linux, macOS and Windows can be downloaded from the releases.
Requires Git, Go >=1.27 and Make to be installed.
To build STOPnik the repository should be cloned and the build command executed.
git clone https://github.com/webishdev/stopnik.git
cd stopnik
go build ./cmd/stopnikAnd then start STOPnik with
./stopnikBy default the configuration is read from config.yml in the current folder, another file can be used with ./stopnik -file my-config.yml.
Release binaries for specific platforms are built with the Makefile into the bin folder, e.g.
make build-macos-arm # a single platform, see make help for all of them
make build-all VERSION=v1.0.0 # all supported platformsAll available targets are listed with make help.
Execute tests inside the repository root folder with
make testTo get access to the HTML coverage report execute
make coverageThe coverage report will be created in the .test_coverage folder.
The code is checked with golangci-lint, which is managed as a Go tool in go.mod, so no separate installation is needed.
make lintReleases are created by publishing a new release with a vX.Y.Z tag on GitHub.
The release workflow then runs the tests and linter, builds the binaries for all platforms,
pushes the Docker images and attaches the archives with their SHA256SUMS to the release.
The project is licensed under the Apache License, Version 2.0.