rustauth-oauth-provider 0.3.0

OAuth 2.1 and OpenID Connect provider support for RustAuth.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

# rustauth-oauth-provider

OAuth 2.1 and OpenID Connect provider plugin for RustAuth.

## What It Is

Use this crate when your RustAuth server should become the authorization server:
register clients, authorize users, issue tokens, expose metadata, and serve
userinfo.

This is the provider-side crate. For consuming external IdPs, use
`rustauth-oidc` through `rustauth-sso`.

## What It Provides

- Authorization, token, introspection, metadata, logout, userinfo, client, and
  consent endpoints.
- OAuth client, consent, access-token, and refresh-token schema contributions.
- Authorization code, refresh token, and client credentials grant support.
- Configurable login and consent page redirects.
- Optional JWT/JWKS integration through `rustauth-plugins::jwt`.
- Hooks for client privileges, token claims, client references, token hashing,
  refresh-token formatting, and custom token/userinfo fields.

## Quick Start

Enable the `oauth-provider` feature on the umbrella `rustauth` crate (or depend
on `rustauth-oauth-provider` directly):

```toml
[dependencies]
rustauth = { version = "0.2.0", features = ["oauth-provider", "plugins"] }
```

```rust
use rustauth::RustAuth;
use rustauth::oauth_provider::{oauth_provider, OAuthProviderOptions};

let auth = RustAuth::builder()
    .secret("secret-a-at-least-32-chars-long!!")
    .base_url("https://auth.example.com/api/auth")
    .plugin(oauth_provider(OAuthProviderOptions {
        login_page: "/login".to_owned(),
        consent_page: "/oauth/consent".to_owned(),
        scopes: vec!["openid".into(), "profile".into(), "email".into()],
        ..OAuthProviderOptions::default()
    })?)
    .build()?;
# let _ = auth;
# Ok::<(), Box<dyn std::error::Error>>(())
```

Run your adapter migration flow after enabling the plugin so the OAuth client,
consent, access-token, and refresh-token tables exist.

## MCP (Model Context Protocol)

MCP is exposed as a profile of the OAuth provider rather than a separate
authorization server. Enable protected-resource metadata with `McpOptions`:

```rust
use rustauth::oauth_provider::{oauth_provider, McpOptions, OAuthProviderOptions};

let _plugin = oauth_provider(OAuthProviderOptions {
    login_page: "/login".to_owned(),
    consent_page: "/oauth/consent".to_owned(),
    mcp: Some(McpOptions {
        resource: Some("https://api.example.com/mcp".to_owned()),
        ..McpOptions::default()
    }),
    ..OAuthProviderOptions::default()
})?;
# Ok::<(), Box<dyn std::error::Error>>(())
```

MCP clients discover authorization metadata via
`/.well-known/oauth-authorization-server` and protected-resource metadata via
`/.well-known/oauth-protected-resource`. Authorization, token, registration,
userinfo, introspection, and revocation traffic uses the standard `/oauth2/*`
routes.

Framework-neutral resource-server helpers are available behind the
`mcp-client` feature.

## How It Fits

- `rustauth-oauth-provider`: provider-side OAuth/OIDC server behavior.
- `rustauth-oauth`: low-level OAuth client primitives and token helpers.
- `rustauth-oidc`: relying-party helpers for external IdPs.
- `rustauth-sso`: enterprise login plugin that consumes external OIDC/SAML IdPs.

## Status

Experimental beta. The provider is implemented server-side and has focused
coverage, but endpoint behavior, token storage, grant support, and option
validation can still evolve before stable release.

## Better Auth compatibility

Server-side OAuth provider behavior is aligned with Better Auth 1.6.9 where it
matters; RustAuth is not a line-by-line port. For route-level parity, test
counts, differences, and gaps, see [UPSTREAM.md](./UPSTREAM.md).

## Links

- [Root README](../../README.md)
- [Repository](https://github.com/salasebas/rustauth)