Cell - OAuth2 Client Component

Sign users in with an OAuth 2.0 / OpenID Connect provider (GitHub, Google, Okta, Facebook or any other), and get access tokens for calling APIs with the client-credentials, password and refresh-token grants. It plugs into @celljs/security: a successful login is a normal security login.

npm install @celljs/oauth2-client @celljs/security

Login with a provider

Register the client in cell.yml (server-only, like all configuration):

oauth2:
  client:
    registrations:
      github:
        clientId: "${env.GITHUB_CLIENT_ID}"
        clientSecret: "${env.GITHUB_CLIENT_SECRET}"

• google, github, facebook and okta have templates (registrationTemplates, providerTemplates in this package's cell.yml) with their endpoints and scopes; Okta and other providers need their URLs under oauth2.client.providers.<id> (authorizationUri, tokenUri, userInfoEndpoint.uri, userInfoEndpoint.userNameAttributeName, jwkSetUri, issuerUri).
• A registration has clientId, clientSecret, scopes, authorizationGrantType, clientAuthenticationMethod, redirectUri, provider (default: its id) and clientName.
• Send the browser to /oauth2/authorization/github (oauth2.client.authorizationRequestBaseUri). The provider redirects back to /login/oauth2/code/github; the default redirect URI is built from server.endpoint, so set server.endpoint to the public URL of the application.
• With the openid scope the login is OpenID Connect: the ID token is verified with the provider's JWK set (@celljs/oauth2-jose).
• The user's attributes are mapped by security.userMapperRule.<provider> of @celljs/security.

Tokens for API calls

AuthorizedClientManager authorizes a registration with the grant it declares (client_credentials, password, refresh_token, authorization_code) and keeps the tokens, refreshing them oauth2.client.clockSkew (60 s) before they expire.