Skip to content

v0.3.0 — Microsoft/Entra + Discord + any-OIDC social, richer SCIM

Choose a tag to compare

View all tags
@alex-savin alex-savin released this 01 Jul 04:47
v0.3.0
4885f3a

go-auth-x v0.3.0

More social providers and a more conformant SCIM server. Additive at the public API — no removals or renames.

✨ Highlights

Social login: Microsoft/Entra, Discord, and any OIDC provider

  • Microsoft / Entra ID (Azure AD) — work, school, and personal accounts; tenant-scoped or common. Entra tokens often omit email_verified, so the tenant-owned token email is trusted by default (MICROSOFT_STRICT_EMAIL_VERIFIED forces strict).
  • Discord — OAuth2 + REST (/users/@me), verified email required.
  • Any OIDC provider — Config.SocialOIDC registers GitLab, Okta, Auth0, Keycloak, or any compliant IdP as a social login at /auth/social/<name>/{login,callback}, reusing Google's PKCE + nonce + azp + email_verified path (per-provider AssumeVerified opt-in).
  • GET /auth/config now reports every enabled provider in a socialProviders array so the SPA can render the right buttons. The route gate and config report now also cover Facebook and Apple.
  • New env: MICROSOFT_CLIENT_ID/MICROSOFT_CLIENT_SECRET/MICROSOFT_TENANT, DISCORD_CLIENT_ID/DISCORD_CLIENT_SECRET.

SCIM 2.0 — more conformant

  • Pagination — startIndex / count on the Users and Groups list endpoints (RFC 7644 §3.4.2.4), with accurate totalResults / startIndex / itemsPerPage (count=0 is a valid count-only query).
  • Resource timestamps — meta.created / meta.lastModified on Users and Groups (surfaced from the store; omitted when unavailable).
  • Full schema documents — GET /Schemas returns a ListResponse of complete User + Group schema definitions (attributes, types, mutability, uniqueness), plus GET /Schemas/{id} (RFC 7643 §7 / RFC 7644 §4).

🔎 Verified

New tests cover SCIM pagination/meta/schemas and the social routing/registry guards, plus an end-to-end mock-IdP integration test (real OIDC discovery + JWKS + RS256 verify) that confirms the generic-OIDC path rejects unverified emails, nonce mismatches, azp mismatches, and foreign signatures.

Upgrade

go get github.com/alex-savin/go-auth-x@v0.3.0

Source-compatible with v0.2.x. AuthUser gains CreatedAt/UpdatedAt and Group gains UpdatedAt (additive fields for SCIM meta); Config gains the Microsoft/Discord/SocialOIDC fields.

Full changelog: https://github.com/alex-savin/go-auth-x/blob/main/CHANGELOG.md

Assets 2
Loading