Add OAuth2 provider configs for Ory, Okta, Discord, Twitch and Spotify

vertx-auth-oauth2/src/main/asciidoc/index.adoc

@@ -129,6 +129,9 @@ A couple of well known OpenID Connect Discovery providers are:
 * Microsoft: `https://login.windows.net/common`
 * IBM Cloud: `https://<region-id>.appid.cloud.ibm.com/oauth/v4/<tenant-id>`
 * Amazon Cognito: `"https://cognito-idp.<region>.amazonaws.com/<user-pool-id>"`
+* Okta: `https://<your-okta-domain>` (org authorization server) or `https://<your-okta-domain>/oauth2/<authorization-server-id>`
+* Ory (Ory Network / Ory Hydra): `https://<project-slug>.projects.oryapis.com`
+* Twitch: `https://id.twitch.tv/oauth2`
 
 This and the given `client id/client secret` is enough to configure your auth provider object.
 
@@ -165,6 +168,7 @@ Currently we provide:
 * Azure Active Directory {@link io.vertx.ext.auth.oauth2.providers.AzureADAuth}
 * Box.com {@link io.vertx.ext.auth.oauth2.providers.BoxAuth}
 * CloudFoundry {@link io.vertx.ext.auth.oauth2.providers.CloudFoundryAuth}
+* Discord {@link io.vertx.ext.auth.oauth2.providers.DiscordAuth}
 * Dropbox {@link io.vertx.ext.auth.oauth2.providers.DropboxAuth}
 * Facebook {@link io.vertx.ext.auth.oauth2.providers.FacebookAuth}
 * Foursquare {@link io.vertx.ext.auth.oauth2.providers.FoursquareAuth}
@@ -178,11 +182,15 @@ Currently we provide:
 * LinkedIn {@link io.vertx.ext.auth.oauth2.providers.LinkedInAuth}
 * Live.com {@link io.vertx.ext.auth.oauth2.providers.LiveAuth}
 * Mailchimp {@link io.vertx.ext.auth.oauth2.providers.MailchimpAuth}
+* Okta {@link io.vertx.ext.auth.oauth2.providers.OktaAuth}
 * OpenIDConnect {@link io.vertx.ext.auth.oauth2.providers.OpenIDConnectAuth}
+* Ory {@link io.vertx.ext.auth.oauth2.providers.OryAuth}
 * Salesforce {@link io.vertx.ext.auth.oauth2.providers.SalesforceAuth}
 * Shopify {@link io.vertx.ext.auth.oauth2.providers.ShopifyAuth}
 * Soundcloud {@link io.vertx.ext.auth.oauth2.providers.SoundcloudAuth}
+* Spotify {@link io.vertx.ext.auth.oauth2.providers.SpotifyAuth}
 * Stripe {@link io.vertx.ext.auth.oauth2.providers.StripeAuth}
+* Twitch {@link io.vertx.ext.auth.oauth2.providers.TwitchAuth}
 * Twitter {@link io.vertx.ext.auth.oauth2.providers.TwitterAuth}
 
 === JBoss Keycloak

vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/providers/DiscordAuth.java

@@ -0,0 +1,72 @@
+/*
+ * Copyright 2015 Red Hat, Inc.
+ *
+ *  All rights reserved. This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License v1.0
+ *  and Apache License v2.0 which accompanies this distribution.
+ *
+ *  The Eclipse Public License is available at
+ *  http://www.eclipse.org/legal/epl-v10.html
+ *
+ *  The Apache License v2.0 is available at
+ *  http://www.opensource.org/licenses/apache2.0.php
+ *
+ *  You may elect to redistribute this code under either of these licenses.
+ */
+package io.vertx.ext.auth.oauth2.providers;
+
+import io.vertx.codegen.annotations.VertxGen;
+import io.vertx.core.Vertx;
+import io.vertx.core.http.HttpClientOptions;
+import io.vertx.ext.auth.oauth2.OAuth2Auth;
+import io.vertx.ext.auth.oauth2.OAuth2Options;
+
+/**
+ * Simplified factory to create an {@link OAuth2Auth} for Discord.
+ * <p>
+ * The OAuth2 endpoints are documented at
+ * <a href="https://docs.discord.com/developers/topics/oauth2">https://docs.discord.com/developers/topics/oauth2</a>.
+ * <p>
+ * The user info endpoint is {@code GET /users/@me}
+ * (<a href="https://docs.discord.com/developers/resources/user#get-current-user">https://docs.discord.com/developers/resources/user#get-current-user</a>)
+ * and requires the {@code identify} scope. It returns a user object with, among others, {@code id},
+ * {@code username}, {@code discriminator}, {@code global_name}, {@code avatar}, {@code banner},
+ * {@code accent_color}, {@code locale}, {@code mfa_enabled}, {@code flags}, {@code public_flags}, and
+ * {@code email}, {@code verified} when the {@code email} scope is also granted.
+ */
+@VertxGen
+public interface DiscordAuth {
+
+  /**
+   * Create a OAuth2Auth provider for Discord
+   *
+   * @param clientId     the client id given to you by Discord
+   * @param clientSecret the client secret given to you by Discord
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret) {
+    return create(vertx, clientId, clientSecret, new HttpClientOptions());
+  }
+
+  /**
+   * Create a OAuth2Auth provider for Discord
+   *
+   * @param clientId          the client id given to you by Discord
+   * @param clientSecret      the client secret given to you by Discord
+   * @param httpClientOptions custom http client options
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret, HttpClientOptions httpClientOptions) {
+    return
+      OAuth2Auth.create(vertx, new OAuth2Options()
+        .setHttpClientOptions(httpClientOptions)
+        .setClientId(clientId)
+        .setClientSecret(clientSecret)
+        .setSite("https://discord.com/api")
+        // https://docs.discord.com/developers/topics/oauth2#shared-resources-oauth2-urls
+        .setAuthorizationPath("https://discord.com/oauth2/authorize")
+        .setTokenPath("/oauth2/token")
+        .setRevocationPath("/oauth2/token/revoke")
+        // https://docs.discord.com/developers/resources/user#get-current-user
+        .setUserInfoPath("/users/@me")
+        .setScopeSeparator(" "));
+  }
+}

vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/providers/OktaAuth.java

@@ -0,0 +1,155 @@
+/*
+ * Copyright 2015 Red Hat, Inc.
+ *
+ *  All rights reserved. This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License v1.0
+ *  and Apache License v2.0 which accompanies this distribution.
+ *
+ *  The Eclipse Public License is available at
+ *  http://www.eclipse.org/legal/epl-v10.html
+ *
+ *  The Apache License v2.0 is available at
+ *  http://www.opensource.org/licenses/apache2.0.php
+ *
+ *  You may elect to redistribute this code under either of these licenses.
+ */
+package io.vertx.ext.auth.oauth2.providers;
+
+import io.vertx.codegen.annotations.VertxGen;
+import io.vertx.core.Future;
+import io.vertx.core.Vertx;
+import io.vertx.core.http.HttpClientOptions;
+import io.vertx.ext.auth.oauth2.OAuth2Auth;
+import io.vertx.ext.auth.oauth2.OAuth2Options;
+
+/**
+ * Simplified factory to create an {@link OAuth2Auth} for Okta.
+ * <p>
+ * Okta exposes two kinds of OpenID Connect authorization servers
+ * (<a href="https://developer.okta.com/docs/concepts/auth-servers/">https://developer.okta.com/docs/concepts/auth-servers/</a>):
+ * <ul>
+ *   <li>the <b>org authorization server</b>: {@code https://{yourOktaDomain}/oauth2/v1/...} with issuer
+ *   {@code https://{yourOktaDomain}}, used when no authorization server id is given;</li>
+ *   <li>a <b>custom authorization server</b>: {@code https://{yourOktaDomain}/oauth2/{authorizationServerId}/v1/...}
+ *   with issuer {@code https://{yourOktaDomain}/oauth2/{authorizationServerId}} (the pre-configured one is named
+ *   {@code default}).</li>
+ * </ul>
+ * The endpoint paths are documented in the Okta OpenID Connect &amp; OAuth 2.0 API reference:
+ * <a href="https://developer.okta.com/docs/reference/api/oidc/">https://developer.okta.com/docs/reference/api/oidc/</a>.
+ * <p>
+ * The {@code /userinfo} endpoint returns the OpenID Connect claims for the granted scopes: {@code sub} always;
+ * {@code name}, {@code nickname}, {@code preferred_username}, {@code given_name}, {@code middle_name},
+ * {@code family_name}, {@code picture}, {@code website}, {@code gender}, {@code birthdate}, {@code zoneinfo},
+ * {@code locale}, {@code updated_at} for {@code profile}; {@code email}, {@code email_verified} for {@code email};
+ * {@code address} for {@code address}; {@code phone_number} for {@code phone}.
+ * <p>
+ * Client credentials are sent using HTTP Basic authentication ({@code client_secret_basic}), Okta's default
+ * token endpoint authentication method
+ * (<a href="https://developer.okta.com/docs/api/openapi/okta-oauth/guides/client-auth/">https://developer.okta.com/docs/api/openapi/okta-oauth/guides/client-auth/</a>).
+ */
+@VertxGen
+public interface OktaAuth extends OpenIDConnectAuth {
+
+  /**
+   * Create a OAuth2Auth provider for Okta using the org authorization server.
+   *
+   * @param clientId     the client id given to you by Okta
+   * @param clientSecret the client secret given to you by Okta
+   * @param domain       your Okta domain, eg. {@code dev-123456.okta.com}
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret, String domain) {
+    return create(vertx, clientId, clientSecret, domain, new HttpClientOptions());
+  }
+
+  /**
+   * Create a OAuth2Auth provider for Okta using the org authorization server.
+   *
+   * @param clientId          the client id given to you by Okta
+   * @param clientSecret      the client secret given to you by Okta
+   * @param domain            your Okta domain, eg. {@code dev-123456.okta.com}
+   * @param httpClientOptions custom http client options
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret, String domain, HttpClientOptions httpClientOptions) {
+    return
+      OAuth2Auth.create(vertx, new OAuth2Options()
+        .setHttpClientOptions(httpClientOptions)
+        .setClientId(clientId)
+        .setClientSecret(clientSecret)
+        .setTenant(domain)
+        // https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server
+        .setSite("https://{tenant}")
+        // https://developer.okta.com/docs/reference/api/oidc/#endpoints
+        .setAuthorizationPath("/oauth2/v1/authorize")
+        .setTokenPath("/oauth2/v1/token")
+        .setUserInfoPath("/oauth2/v1/userinfo")
+        // RFC 7009
+        .setRevocationPath("/oauth2/v1/revoke")
+        // RFC 7662
+        .setIntrospectionPath("/oauth2/v1/introspect")
+        // RFC 7517
+        .setJwkPath("/oauth2/v1/keys")
+        .setLogoutPath("/oauth2/v1/logout")
+        .setScopeSeparator(" "));
+  }
+
+  /**
+   * Create a OAuth2Auth provider for Okta using a custom authorization server.
+   *
+   * @param clientId              the client id given to you by Okta
+   * @param clientSecret          the client secret given to you by Okta
+   * @param domain                your Okta domain, eg. {@code dev-123456.okta.com}
+   * @param authorizationServerId the custom authorization server id, eg. {@code default}
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret, String domain, String authorizationServerId) {
+    return create(vertx, clientId, clientSecret, domain, authorizationServerId, new HttpClientOptions());
+  }
+
+  /**
+   * Create a OAuth2Auth provider for Okta using a custom authorization server.
+   *
+   * @param clientId              the client id given to you by Okta
+   * @param clientSecret          the client secret given to you by Okta
+   * @param domain                your Okta domain, eg. {@code dev-123456.okta.com}
+   * @param authorizationServerId the custom authorization server id, eg. {@code default}
+   * @param httpClientOptions     custom http client options
+   */
+  static OAuth2Auth create(Vertx vertx, String clientId, String clientSecret, String domain, String authorizationServerId, HttpClientOptions httpClientOptions) {
+    return
+      OAuth2Auth.create(vertx, new OAuth2Options()
+        .setHttpClientOptions(httpClientOptions)
+        .setClientId(clientId)
+        .setClientSecret(clientSecret)
+        .setTenant(domain)
+        // https://developer.okta.com/docs/concepts/auth-servers/#custom-authorization-server
+        .setSite("https://{tenant}/oauth2/" + authorizationServerId)
+        // https://developer.okta.com/docs/reference/api/oidc/#endpoints
+        .setAuthorizationPath("/v1/authorize")
+        .setTokenPath("/v1/token")
+        .setUserInfoPath("/v1/userinfo")
+        // RFC 7009
+        .setRevocationPath("/v1/revoke")
+        // RFC 7662
+        .setIntrospectionPath("/v1/introspect")
+        // RFC 7517
+        .setJwkPath("/v1/keys")
+        .setLogoutPath("/v1/logout")
+        .setScopeSeparator(" "));
+  }
+
+  /**
+   * Create a OAuth2Auth provider for OpenID Connect Discovery. The discovery will use the site in the
+   * configuration options and attempt to load the well known descriptor. The site is the issuer of the
+   * authorization server, either {@code https://{yourOktaDomain}} (org authorization server) or
+   * {@code https://{yourOktaDomain}/oauth2/{authorizationServerId}} (custom authorization server).
+   * <p>
+   * If the discovered config includes a json web key url, it will be also fetched and the JWKs will be loaded
+   * into the OAuth provider so tokens can be decoded.
+   *
+   * @param vertx  the vertx instance
+   * @param config the initial config
+   * @return future with instantiated Oauth2 provider instance handler
+   */
+  static Future<OAuth2Auth> discover(final Vertx vertx, final OAuth2Options config) {
+    return OpenIDConnectAuth.discover(vertx, config);
+  }
+}

vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/providers/OryAuth.java

@@ -0,0 +1,108 @@
+/*
+ * Copyright 2015 Red Hat, Inc.
+ *
+ *  All rights reserved. This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License v1.0
+ *  and Apache License v2.0 which accompanies this distribution.
+ *
+ *  The Eclipse Public License is available at
+ *  http://www.eclipse.org/legal/epl-v10.html
+ *
+ *  The Apache License v2.0 is available at
+ *  http://www.opensource.org/licenses/apache2.0.php
+ *
+ *  You may elect to redistribute this code under either of these licenses.
+ */
+package io.vertx.ext.auth.oauth2.providers;
+
+import io.vertx.codegen.annotations.VertxGen;
+import io.vertx.core.Future;
+import io.vertx.core.Vertx;
+import io.vertx.core.http.HttpClientOptions;
+import io.vertx.ext.auth.oauth2.OAuth2Auth;
+import io.vertx.ext.auth.oauth2.OAuth2Options;
+
+/**
+ * Simplified factory to create an {@link OAuth2Auth} for Ory (Ory Network or a self hosted Ory Hydra).
+ * <p>
+ * Ory Hydra is a certified OpenID Connect provider. The endpoints below are taken from the Ory Hydra public API
+ * reference (<a href="https://www.ory.com/docs/hydra/reference/api">https://www.ory.com/docs/hydra/reference/api</a>)
+ * and the Ory OAuth2 authorization code flow guide
+ * (<a href="https://www.ory.com/docs/oauth2-oidc/authorization-code-flow">https://www.ory.com/docs/oauth2-oidc/authorization-code-flow</a>).
+ * <p>
+ * The {@code site} is the base URL of the public API of your deployment:
+ * <ul>
+ *   <li>Ory Network: {@code https://{project-slug}.projects.oryapis.com}</li>
+ *   <li>Self hosted Ory Hydra: the public port of Hydra, e.g.: {@code http://localhost:4444}</li>
+ * </ul>
+ * <p>
+ * The {@code /userinfo} endpoint returns the standard OpenID Connect claims for the granted scopes
+ * ({@code sub} always, plus e.g. {@code email}, {@code email_verified}, {@code name}, {@code preferred_username}
+ * as populated by your consent app).
+ * <p>
+ * Notes:
+ * <ul>
+ *   <li>Token introspection lives on the Ory Hydra <b>admin</b> API ({@code /admin/oauth2/introspect}) which is
+ *   not reachable with client credentials, so no introspection path is configured.</li>
+ *   <li>Client credentials are sent using HTTP Basic authentication ({@code client_secret_basic}), which is the
+ *   default {@code token_endpoint_auth_method} for Ory OAuth2 clients.</li>
+ * </ul>
+ */
+@VertxGen
+public interface OryAuth extends OpenIDConnectAuth {
+
+  /**
+   * Create a OAuth2Auth provider for Ory
+   *
+   * @param site         root URL for the provider without trailing slashes, eg. https://{project-slug}.projects.oryapis.com
+   * @param clientId     the client id given to you by Ory
+   * @param clientSecret the client secret given to you by Ory
+   */
+  static OAuth2Auth create(Vertx vertx, String site, String clientId, String clientSecret) {
+    return create(vertx, site, clientId, clientSecret, new HttpClientOptions());
+  }
+
+  /**
+   * Create a OAuth2Auth provider for Ory
+   *
+   * @param site              root URL for the provider without trailing slashes, eg. https://{project-slug}.projects.oryapis.com
+   * @param clientId          the client id given to you by Ory
+   * @param clientSecret      the client secret given to you by Ory
+   * @param httpClientOptions custom http client options
+   */
+  static OAuth2Auth create(Vertx vertx, String site, String clientId, String clientSecret, HttpClientOptions httpClientOptions) {
+    return
+      OAuth2Auth.create(vertx, new OAuth2Options()
+        .setHttpClientOptions(httpClientOptions)
+        .setClientId(clientId)
+        .setClientSecret(clientSecret)
+        .setSite(site)
+        // https://www.ory.com/docs/hydra/reference/api (public endpoints)
+        .setAuthorizationPath("/oauth2/auth")
+        .setTokenPath("/oauth2/token")
+        .setUserInfoPath("/userinfo")
+        // RFC 7009
+        .setRevocationPath("/oauth2/revoke")
+        // OpenID Connect RP-Initiated Logout
+        .setLogoutPath("/oauth2/sessions/logout")
+        // RFC 7517
+        .setJwkPath("/.well-known/jwks.json")
+        .setScopeSeparator(" "));
+  }
+
+  /**
+   * Create a OAuth2Auth provider for OpenID Connect Discovery. The discovery will use the given site in the
+   * configuration options and attempt to load the well known descriptor
+   * ({@code {site}/.well-known/openid-configuration}).
+   * <p>
+   * If the discovered config includes a json web key url, it will be also fetched and the JWKs will be loaded
+   * into the OAuth provider so tokens can be decoded.
+   *
+   * @param vertx  the vertx instance
+   * @param config the initial config, the site must be set to the Ory public API base URL
+   * @return future with instantiated Oauth2 provider instance handler
+   */
+  static Future<OAuth2Auth> discover(final Vertx vertx, final OAuth2Options config) {
+    return OpenIDConnectAuth.discover(vertx, config);
+  }
+}