CoolFace
Apppublic

looknicemm1/oauth2nsso

sourceHugging Faceapache-2.0updated 3mo agoView on Hugging Face
0likes
App README

oauth2nsso — OAuth2 + SSO server

Out-of-the-box OAuth2.0 / single-sign-on server (Go, based on go-oauth2). Upstream: <https://github.com/llaoj/oauth2nsso>

This Space

  • —auth_mode: db → multi-user, backed by an embedded SQLite store (pure-Go glebarez/sqlite, no CGO) with bcrypt-hashed passwords. Supports any number of users — not just admin. (ldap mode also wired to public ldap.forumsys.com, but that host is flaky / HF outbound :389 times out — not used here.)
  • —sessions = in-memory cookie store, tokens = in-memory (no Redis needed)
  • —listens on port 9096 (exposed via app_port)

Users

  • —Auto-register on first login (default): logging in with an unknown username creates the account on the spot (the password you type becomes the account password). Returning logins must match. Disable with the AUTO_REGISTER=0 Space variable. ⚠️ This is effectively open registration — anyone can claim any free username.
  • —Seeded on every boot (survive restart/rebuild): built-in admin/admin plus the SEED_USERS Space variable ("user1:pass1,user2:pass2"). Current seed: admin/admin, alice/alice123, bob/bob123.
  • —Explicit signup also available at /register.
⚠️ The SQLite file lives on the Space ephemeral disk (/app/data/users.db). Seeded users are re-created on boot, but users registered at runtime are lost on restart/rebuild. For durable accounts, point the store at an external Postgres/MySQL.

Endpoints

/authorize · /login · /logout · /token · /verify

Demo OAuth2 clients (from config.example.yaml)

client_idsecretdomain
test_client_1test_secret_1http://localhost:9093
test_client_2test_secret_2http://localhost:9094

Demo login

admin/admin, alice/alice123, bob/bob123 — or register your own at /register.

End-to-end test

demo_test.py drives the full authorization-code + SSO flow (authorize → login → issue code → exchange token → verify) against the live Space:

bash
python demo_test.py --base-url https://looknicemm1-oauth2nsso.hf.space

Browser demo client (see the page in action)

demo_client.py is a tiny third-party web app (acts as test_client_1) so you can walk the SSO login in a real browser. It must run on port 9093 — that is the registered redirect domain of test_client_1.

bash
python demo_client.py        # then open http://localhost:9093

Click "使用 OAuth2&SSO 登录" → you are sent to the SSO /login page → sign in with admin / admin → you are redirected back and the client shows the logged-in user, scope, and the JWT access token.

⚠️ Demo only — edit config.example.yaml (session secret, jwt key, clients, auth backend) before any real use.