Skip to main content

(WIP) boruta server documentation

Status

boruta is currently in an open beta phase. If you are interested by the project and the tools it provides, you are encouraged to test the software within your context. Production readiness will depend on your feedback, helping to fix possible bugs and improve the solution's usability. While mostly stable and security-assessed in some areas, boruta is a work in progress. Please read the General Terms and Conditions.

What is boruta?​

boruta is an authorization server that aims to implement OAuth 2.0 and satelite specifications. On top of authorization, it provides identity management, an experimental gateway and administration interfaces. Those provide an identity and access management solution taht helps to solve identity related problems, up to decentralized identity.

components

Open core / Application layer architecture​

boruta is splited into an open core and an application layer giving from one side the authorization business logic and the other the exposition and authentication topics to provide a standalone server. This core is open source and avalilable as an Elixir package on hex.pm.

Why another authorization server?​

boruta has been designed to be both end-user and developer friendly. With a high level of customization, it helps to have an immersive experience for your users giving them custom interfaces. The administration interface gives an exhaustive set of configuration parameters that are also accessible through REST API calls for automation.

As an open-source product, it takes the advantage of being backed by a community of developers making it a secure and extensible solution. All suggestions, feature requests, or any kind of contribution will be very welcome.

Have a look at the GitHub repository

With an implementation of OpenID 4 Verifiable Credentials Issuance (OID4VCI) and OpenID 4 Verifiable presentations (OID4VP), boruta provides means to be compliant with the eIDAS 2.0 regulation. On top of those protocols, it brings ways to get identities from a data source still being secure and with low integration costs, being part of your infrastructure by addition, not replacement. Indeed, boruta can leverage identity federation to restrict access to verifiable credentials making it a secure and privacy preserving solution.

Tripartite authorization

About an identity provider​

boruta comes up with an integrated idenity provider, it can both store the users' credentials internaly and provide an experimental LDAP adapter. It helps more than enable password authentication abilities, to enhance users with features like having custom attributes, enforce email confirmation, or consent to the client's requested scopes.

About a gateway​

boruta is coupled to an experimental gateway that acts as a reverse-proxy sitting between your frontends and backends in order to apply security rules in a fast and non-intrusive way. To perform those access restrictions, the gateway is based on boruta-provided access tokens or HTTP Basic. With scope management, it helps mitigating the incoming traffic and allow to get access to profile attributes in a secure way.

Gateway authorization flow

Implemented specifications and certification​

As it, boruta server aim to follow the RFCs from IETF:

And the specifications from the OpenID Foundation:

This server has been certified for the Basic, Implicit, and Hybrid OpenID Provider profiles by the OpenID Foundation on October 18th, 2022 for the tagged versions 0.1.0 and October 17th, 2024 for 0.5.0

This server has been certified for the Config and Dynamic OpenID Provider profiles by the OpenID Foundation on May, 16th 2023 for the tagged version 0.2.0

OpenID certified

This server has also been certified against the European Blockchain Service Infrastructure (EBSI) issuance test suite for the tagged version 0.4.0 and for verifiable credential verification for the tagged version 0.5.0.

EBSI certified - issue EBSI certified - verify

  1. Getting up and running - Quickstart
  2. Understand how to configure the server - provider configuration