OAuth 2.0 Framework

This library is the OAuth 2.0 and OpenID Connect 1.0 authorization server framework used by Authelia. It provides the request parsing, validation, client authentication, token issuance, and response writing for the authorization, token, introspection, revocation, and related endpoints, and leaves storage, user authentication, and consent to the implementer through a set of interfaces.

It started as a hard fork of ORY Fosite and has since diverged significantly; see Thanks for details.

Go Version Support Policy

This library officially supports only the latest minor version of go, which is currently go 1.27. Older versions of go are not supported and are not tested. This rule applies at the time of a published release.

This library is intended to be used with Go Toolchains as indicated by the toolchain directive in the go.mod.

This library handles a critical element of security in dependent projects, so we prefer security over backwards compatibility wherever the two conflict. Go's own compatibility guarantees usually make upgrading the toolchain painless.

Feature Support

Legend: ✅ supported, 🟡 partially supported, ❌ not supported.

OAuth 2.0

Specification	Status	Notes
RFC 6749: The OAuth 2.0 Authorization Framework	✅	Authorization Code, Implicit, Client Credentials, Resource Owner Password Credentials, and Refresh Token grants
RFC 6750: Bearer Token Usage	✅
RFC 7009: Token Revocation	✅	Optional policy to revoke the refresh token alongside an access token
RFC 7523: JWT Profile for Client Authentication and Authorization Grants	✅	client_secret_jwt, private_key_jwt, and the JWT bearer grant
RFC 7591: Dynamic Client Registration Protocol	✅
RFC 7592: Dynamic Client Registration Management Protocol	✅
RFC 7636: Proof Key for Code Exchange (PKCE)	✅	Per-client enforcement policy
RFC 7662: Token Introspection	✅	Client authentication for the introspection endpoint
RFC 8628: Device Authorization Grant	✅
RFC 8693: Token Exchange	✅
RFC 8705: Mutual-TLS Client Authentication and Certificate-Bound Access Tokens	✅	tls_client_auth and self_signed_tls_client_auth
RFC 8707: Resource Indicators	✅
RFC 9068: JWT Profile for Access Tokens	✅	Enabled globally or per client
RFC 9101: JWT-Secured Authorization Request (JAR)	✅
RFC 9126: Pushed Authorization Requests (PAR)	✅	Per-client enforcement policy
RFC 9207: Authorization Server Issuer Identification	✅
RFC 9396: Rich Authorization Requests	❌
RFC 9449: Demonstrating Proof of Possession (DPoP)	✅
RFC 9701: JWT Response for Token Introspection	✅
JWT Secured Authorization Response Mode (JARM)	✅
Multiple Response Type Encoding Practices	✅	Including the none response type
Form Post Response Mode	✅	Custom response writer support

OpenID Connect 1.0

Specification	Status	Notes
OpenID Connect Core 1.0	🟡	Authorization Code, Implicit, and Hybrid flows; no UserInfo endpoint or claims request parameter
OpenID Connect Dynamic Client Registration 1.0	✅
OpenID Connect RP-Initiated Logout 1.0	✅
OpenID Connect Back-Channel Logout 1.0	✅
OpenID Connect Front-Channel Logout 1.0	❌
OpenID Connect Session Management 1.0	❌
OpenID Connect Key Binding 1.0	✅
OpenID Connect Advanced Syntax for Claims (ASC) 1.0	❌

Planned work and notable differences from ORY Fosite are tracked in TODO.md.

Thanks

This is a hard fork of ORY Fosite under the Apache 2.0 License for the purpose of performing self-maintenance of this critical Authelia dependency.

We however:

• Acknowledge the amazing hard work of the ORY developers in making such an amazing framework that we can do this with.
• Plan to continue to contribute back to te ORY fosite and related projects.
• Have ensured the licensing is unchanged in this fork of the library.
• Do not have a formal affiliation with ORY and individuals utilizing this library should not allow their usage to be a reflection on ORY as this library is not maintained by them.

The mascot is based on the Go gopher, designed by Renée French and licensed under CC BY 4.0.