# yum install redis
# systemctl start redis
# systemctl enable redis

# git clone https://github.com/shanghai-edu/oauth-server-lite.git
# cd oauth-server-lite
# chmod +x control
# ./control build
# ./control pack

{
	"log_level": "info", # info/warn/debug 三种
	"db": {
		"sqlite":"sqlite.db", # 只要不为空，则使用 sqlite 模式，存储到字段中的 sqlite 文件中
		"mysql": "root:password@tcp(127.0.0.1:3306)/oauth?charset=utf8&parseTime=True&loc=Local", # 使用 mysql 模式时的数据库连接参数
		"db_debug": false # true 时会输出详细的 sql debug
	},
	"redis": {
		"dsn": "127.0.0.1:6379",
		"max_idle": 5,
		"conn_timeout": 5, # 单位都是秒
		"read_timeout": 5,
		"write_timeout": 5,
		"password": ""
	},
	"redis_namespace":{ # redis key 的命名空间，保持默认即可
		"oauth":"oauth:",
		"cache":"cache:",
		"lock":"lock:",
		"fail":"fail:"
	},
    "ldap": {
        "addr": "ldap.example.org:389",
        "baseDn": "dc=example,dc=org",
        "bindDn": "cn=manager,dc=example,dc=org",
        "bindPass": "password",
        "authFilter": "(&(uid=%s))",
        "attributes": ["uid", "cn", "mail"], # ldap 返回的属性。这部分会映射为 userinfo 的接口。如果留空则返回全部属性
        "tls":        false,
        "startTLS":   false
    },
	"http": {
		"listen": "0.0.0.0:18080",
		"manage_ip": ["127.0.0.1"], # 管理接口的授信 ip
		"x-api-key": "shanghai-edu", # 管理接口的 api key
		"session_options":{ # session 参数
			"path":"/",
			"domain":"idp.example.org", # 必须与实际域名匹配
			"max_age":7200,
			"secure":false,
			"http_only":false
		},
		"max_multipart_memory":100
	},
	"max_failed":5, # 最大密码错误次数
	"failed_intervel":300, # 密码错误统计的间隔时间
	"lock_time":600, # 锁定时间
	"access_token_expired":7200, # oauth access token 有效期，单位是秒
	"old_access_token_expired":300, # 新的 oauth access token 生成时，老 token 的保留时间
	"refresh_token_expired_day":365, # refresh token 的有效期，单位是天
	"code_expired":300 # authorization_code 的有效期，单位是秒
}

./control start

./oauth-server-lite -i

./control start

        ProxyPreserveHost On
        RequestHeader set X-Forwarded-Proto https
        RemoteIPHeader X-Forwarded-For

        ProxyPass "/resource/" "http://localhost:18080/resource/"
        ProxyPass "/oauth/" "http://localhost:18080/oauth/"
        ProxyPass "/user/" "http://localhost:18080/user/"

      location /oauth/ {
          proxy_pass      http://localhost:18080/oauth/;
              client_max_body_size    100m;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header Host            $http_host;
              proxy_set_header X-Forwarded-Proto $scheme;
        }
      location /user/ {
          proxy_pass      http://localhost:18080/user/;
              client_max_body_size    100m;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header Host            $http_host;
              proxy_set_header X-Forwarded-Proto $scheme;
        }
      location /resource/ {
          proxy_pass      http://localhost:18080/resource/;
              client_max_body_size    100m;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header Host            $http_host;
              proxy_set_header X-Forwarded-Proto $scheme;
        }

# curl -H "X-API-KEY: shanghai-edu" -H "Content-Type: application/json" -d "{\"grant_type\":\"authorization_code\",\"domain\":\"www.example.org\"}" http://127.0.0.1:18080/manage/v1/client

{"client_id":"4ee85cea19800426","client_secret":"cb5b61017393877d71d9119c585bdca3","grant_type":"authorization_code","domain":"www.example.org","white_ip":"","scope":"Basic","description":""}

# curl -H "X-API-KEY: shanghai-edu" http://127.0.0.1:18080/manage/v1/client/4ee85cea19800426
{"client_id":"4ee85cea19800426","client_secret":"cb5b61017393877d71d9119c585bdca3","grant_type":"authorization_code","domain":"www.example.org","white_ip":"","scope":"Basic","description":""}

# curl -H "X-API-KEY: shanghai-edu" http://127.0.0.1:18080/manage/v1/clients
[{"client_id":"4ee85cea19800426","client_secret":"cb5b61017393877d71d9119c585bdca3","grant_type":"authorization_code","domain":"www.example.org","white_ip":"","scope":"Basic","description":""}]

# curl -X DELETE -H "X-API-KEY: shanghai-edu" http://127.0.0.1:18080/manage/v1/client/4ee85cea19800426
{"client_id":"4ee85cea19800426","client_secret":"cb5b61017393877d71d9119c585bdca3","grant_type":"authorization_code","domain":"www.example.org","white_ip":"","scope":"Basic","description":""}

HTTP/1.1 302 Found
Location: https://oauth.example.org/oauth/v1/authorize?state=158802&redirect_uri=https%3A%2F%2Fdevelopers.google.com%2Foauthplayground&response_type=code&client_id=a3e9fdb53ffc9cb9&scope=Basic+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive.file&access_type=offline

GET /oauthplayground/?code=c834d0a96744f375&state=158802 HTTP/1.1
Host: developers.google.com

POST /oauth/v1/token HTTP/1.1
Host: oauth.example.org
Content-length: 199
content-type: application/x-www-form-urlencoded
user-agent: google-oauth-playground
code=c834d0a96744f375&redirect_uri=https%3A%2F%2Fdevelopers.google.com%2Foauthplayground&client_id=a3e9fdb53ffc9cb9&client_secret=5dd6bcf253daae962430b0935207a471&scope=&grant_type=authorization_code

HTTP/1.1 200 OK
{
  "access_token": "8c609be9897ca14c524bb8427ab41dfb", 
  "token_type": "Bearer", 
  "expires_in": 7200, 
  "refresh_token": "1d6396466ee848ee860e9f540bcc2665e816355937005a5b95208094ca81c523", 
  "scope": "Basic"
}

GET /oauth/v1/userinfo HTTP/1.1
Host: oauth.example.org
Content-length: 0
Authorization: Bearer 8c609be9897ca14c524bb8427ab41dfb

POST /oauth/v1/userinfo HTTP/1.1
Host: oauth.example.org
Content-length: 0
Content-type: application/json
Authorization: Bearer 8c609be9897ca14c524bb8427ab41dfb

HTTP/1.1 200 OK
{
  "cn": "小冯冯", 
  "uid": "11116666", 
  "memberOf": "教职工", 
  "mail": "qfeng@exampe.org", 
  "sub": "11116666"
}