oauth#

A unikernel that completes an OAuth 2.0 flow.

Signing in with GitHub or Google ends in a back-channel call: the app sends the authorization code it was handed to the provider's token endpoint and gets an access token back. That is an outbound HTTPS call, which a guest makes with an HTTP client over its own net -- Mirage_eio_requests.client, resolving host names on the guest itself.

OAuth requires the endpoints to be HTTPS (RFC 6749) and reached by name (TLS has no valid peer name for a bare IP), and it refuses a client with certificate verification turned off. So the mock provider serves TLS under a name it also resolves, and the guest keeps verification on with an authenticator that trusts the demo provider's self-signed certificate -- the stand-in for a real, CA-signed one.

Running it#

dune exec unikernel-oauth-provider &
dune exec unikernel-oauth -- \
  --ipv4-gateway 10.0.0.1 --provider-url https://oauth.demo:9600 \
  --nameserver 127.0.0.1 --nameserver-port 5353

oauth: authorize at https://oauth.demo:9600/authorize
oauth: got an access token (25 chars)
oauth: expires_in 3600

provider/ is the host side: a DNS responder that maps oauth.demo to loopback, and the HTTPS token endpoint there. Point --provider-url at a real provider (github, google) with a real client id and secret, drop the demo authenticator, and the same guest completes a real sign-in.

Under a tender the provider is reached through the slirp gateway:

mrg build -t solo5 unikernels/bin/apps/oauth
mrg run --host-forward 9600:127.0.0.1:9600 unikernels/bin/apps/oauth \
  -- --ipv4-gateway 10.0.0.1 --provider-url https://oauth.demo:9600 \
  --nameserver 10.0.0.1 --nameserver-port 5353

Devices#

• Mirage_eio_requests.client "service" -- a pooled HTTP client over the net device, with name resolution.