Overview

This is a sample implementation of an Open ID Connect Identity Provider which was developed to align with the security profile published by the Data Standards Body Australia (DSB). It is build with the Panva oidc-provider library (version 9). More details about this library can be found here

This is Typescript NodeJS implementation and takes into account the specific requirements stipulated by the DSB Technical Standard. In particular, it handles the CDR specific client registration, and CDR specific arrangement data requirements.

As a persistent data store, used by the oidc-provider lib, a MongoDB is used.

The intention of this repository is to provide a starting point, and a reference for some of specific CDR requirements when using the Panva oidc-provider library in a NodeJS/ ExpressJS / Typescript app

Requirements

• MongoDB must be running. Tested with version 7.0, but also works with v6
• a .pem file and a .key file used by this API fore SSL traffic

The configuration of the authorization server is achieved via an environment file eg .env.

| Parameter | Description | Optional/Required | Default (if Optional) | |---|---|---|---| | LOGIN_DATA_SERVER | The url where the login data required for the consent flow comes from. This has to return a LoginDataModel object | Required | | | AUTHSERVER_CLIENT_ID | This is the clientId of the auth server when it calls the resource API with Basic Auth, eg to get login information | Required | | | AUTHSERVER_CLIENT_SECRET | This is the client secret of the auth server when it calls the the resource API with Basic Auth, eg to get login information | Required | | | MONGO_URI | The MongoDB Host which is used by this auth server | Optional | mongodb://localhost:27017/oidc | | ISSUER_URL | The base url for this auth server | Optional | https://localhost:3001/oidc | | CERT_FILE | The certificate file (pem) for this server. Needed for SSL. This file needs to be in <App-Base_Dir>/security | Optional | /dist/security/xp-data-holder.key| | CERT_KEY_FILE | The certificate key file (key) for this server. Needed for SSL. This file needs to be in <App-Base_Dir>/security | Optional | /dist/security/xp-data-holder-intermediate-bundle.pem | | CORS_ALLOWED_ORIGINS | The allowed CORS origins for this API | Optional | | | HTTPS_PORT | The SSL listening for for this app | Optional | 3001 | | REGISTER_DISCOVERY_URL | The discovery url of the CDR register, defaults to the ACCC Sandbox| Optional | https://api.cdrsandbox.gov.au/idp/.well-known/openid-configuration | | REGISTER_GET_DR_URL | The specific URL of the Register API where ADR information can be obtained, defaults to the ACCC Sandbox | Optional | https://api.cdrsandbox.gov.au/cdr-register/v1/all/data-recipients| | SESSION_KEY | The private key this server uses to secure sessions | Optional | ABC123456 | | STATIC_CLIENT_FILE | A file of static client definitions, which are loaded into a ClientMetadata (from the oidc-provider lib) object on startup. | Optional | | | LOG_LEVEL | The log level used by the Pino logger employed (trace, debug, info, warn, error , fatal) | Optional | info |

How to use

This code can be run as a self-standing process, in which case the resource API utilising this app must be configured appropriately. Alternatively, this can be run as middleware in an existing NodeJS app.

The CDR ecosystem relies on the trinity of CDR Register, Data Holder (DH) taking on the role of OpenID Provider, and Accredited Data Recipient (ADR) assuming the role of OIDC Relying Party. The eco-system clearly defines the interactions between these entities.

To use this code appropriately an understanding of these interactions, requirements and restrictions is a required.

This implementation is registered in the (ACCC Sandbox)[https://www.cdr.gov.au/for-providers/participant-tooling/consumer-data-right-sandbox]. The certificates used in here were generated using that Sandbox. Therefore, the trusted CA of the ACCC Sandbox should be added on the machine where this is run.

As a standalone Identity Provider

Provide all the required settings in the env file, then

yarn install
yarn start

This will install the dependencies and the server will listen on 3001 (or other depending on env setting)

Integrated as middleware in an existing NodeJS app

In your host application add this package

yarn add @xpsolutions/xp-panva-oidc-provider

You need to create a CdrOidcConfig object and pass into the constructor of the OidcApplication Eg, incorporate this code

    import { CdrOidcConfig, OidcApplication } from "@xpsolutions/xp-panva-oidc-provider"

    // create the configuration object
    const config: CdrOidcConfig = ({
        mongoDbUri: `${process.env.MONGO_URI}`,
        issuerUri: `${process.env.ISSUER_URL}`,
        certificateFile: `${process.env.CERT_FILE}`,
        certificateKey: `${process.env.CERT_KEY_FILE}`,
        authServerClientId: `${process.env.AUTHSERVER_CLIENT_ID}`,
        authServerClientSecret: `${process.env.AUTHSERVER_CLIENT_SECRET}`,
        loginDataUrl: `${process.env.LOGIN_DATA_SERVER}`,
        registerDiscoveryUrl: `${process.env.REGISTER_DISCOVERY_URL}`,
        registerGetDataRecipientUrl: `${process.env.REGISTER_GET_DR_URL}`,
        httpsPort: parseInt(`${process.env.IDP_HTTPS_PORT}`),
        sessionKey: `${process.env.SESSION_KEY}`

    });

    const oidcApp = new OidcApplication(config);

    // add the provider in your middleware pipeline where appropriate
    app.use('/oidc', oidcApp.oidc.callback());

This assumes that the host application uses an .env file

Disclaimer

This software is provided "as is", without warranty of any kind. The authors are not responsible for any damages, data loss, or system failures resulting from its use.