Ueberauth.Strategy.Authify.OAuth (Ueberauth Authify v0.1.0)

View Source

An OAuth2 client for Authify, scoped to an organization.

All configuration is read from the application environment:

config :ueberauth, Ueberauth.Strategy.Authify.OAuth,
  site: "https://authify.example.com",
  client_id: "YOUR_CLIENT_ID",
  client_secret: "YOUR_CLIENT_SECRET"

Each value also accepts the {:system, "ENV_VAR"} tuple form so credentials can be provided at runtime.

The organization slug itself is a strategy option (organization), and is passed into this module by Ueberauth.Strategy.Authify. Every endpoint is scoped to the organization:

https://authify.example.com/my-org/oauth/authorize
https://authify.example.com/my-org/oauth/token
https://authify.example.com/my-org/oauth/userinfo
https://authify.example.com/my-org/.well-known/jwks

Summary

Functions

authorize_url!(params \\ [], opts \\ [])

Builds the authorize URL for the request phase of Ueberauth. No need to call this usually.

base_url(otp_app \\ nil, organization)

The organization-scoped base URL (site + organization), with any trailing slashes on the site normalized away.

client(opts \\ [])

Builds the organization-scoped %OAuth2.Client{}.

client_id(otp_app \\ nil)

The configured OAuth client ID.

config(otp_app \\ nil)

Resolves the OAuth configuration for otp_app (defaults to :ueberauth), expanding {:system, "VAR"} tuples.

get_token(params \\ [], opts \\ [])

Exchanges an authorization code (and PKCE verifier, when present) for an access token.

get_userinfo(token, opts \\ [])

Fetches the OIDC userinfo claims for token from the organization's userinfo endpoint.

site(otp_app \\ nil)

The configured Authify server base URL (without an organization slug).

Functions

authorize_url!(params \\ [], opts \\ [])

@spec authorize_url!(keyword(), keyword()) :: binary()

Builds the authorize URL for the request phase of Ueberauth. No need to call this usually.

base_url(otp_app \\ nil, organization)

@spec base_url(atom() | nil, binary()) :: binary()

The organization-scoped base URL (site + organization), with any trailing slashes on the site normalized away.

client(opts \\ [])

@spec client(keyword()) :: OAuth2.Client.t()

Builds the organization-scoped %OAuth2.Client{}.

Options:

  • :organization - the Authify organization slug (required)
  • :otp_app - read config from this app instead of :ueberauth
  • :token - an existing %OAuth2.AccessToken{} for authenticated requests

client_id(otp_app \\ nil)

@spec client_id(atom() | nil) :: binary() | nil

The configured OAuth client ID.

config(otp_app \\ nil)

@spec config(atom() | nil) :: keyword()

Resolves the OAuth configuration for otp_app (defaults to :ueberauth), expanding {:system, "VAR"} tuples.

get_token(params \\ [], opts \\ [])

@spec get_token(keyword(), keyword()) ::
  {:ok, OAuth2.Client.t()}
  | {:error, OAuth2.Response.t()}
  | {:error, OAuth2.Error.t()}

Exchanges an authorization code (and PKCE verifier, when present) for an access token.

get_userinfo(token, opts \\ [])

@spec get_userinfo(
  OAuth2.AccessToken.t(),
  keyword()
) ::
  {:ok, OAuth2.Response.t()}
  | {:error, OAuth2.Response.t()}
  | {:error, OAuth2.Error.t()}

Fetches the OIDC userinfo claims for token from the organization's userinfo endpoint.

site(otp_app \\ nil)

@spec site(atom() | nil) :: binary() | nil

The configured Authify server base URL (without an organization slug).