Central Authentication System (CAS)

A centralized authentication and authorization system that manages user access across multiple applications with role-based permissions.

Features

• User authentication (signup/login) across multiple applications
• Application-specific role-based access control (RBAC)
• JWT-based authentication
• Application management (register, update, delete applications)
• Flexible permission system per application
• Secure password hashing
• Input validation
• Cross-Origin Resource Sharing (CORS) support

Prerequisites

• Node.js (v14 or higher)
• MongoDB (v4.4 or higher)
• npm or yarn package manager

Setup

1. Clone the repository:

git clone <repository-url>
cd central-auth-system

2. Install dependencies:

npm install

3. Create a .env file in the root directory with the following variables:

PORT=5000
MONGODB_URI=mongodb://localhost:27017/central-auth
JWT_SECRET=your-super-secret-key-change-this-in-production
JWT_EXPIRES_IN=24h

4. Start the server:

# Development mode
npm run dev

# Production mode
npm start

API Endpoints

Authentication

• POST /api/auth/signup - Register a new user

  {
    "email": "[email protected]",
    "password": "password123",
    "firstName": "John",
    "lastName": "Doe",
    "appId": "application-id"
  }

• POST /api/auth/login - Login user

  {
    "email": "[email protected]",
    "password": "password123",
    "appId": "application-id"
  }

• GET /api/auth/verify - Verify JWT token

Applications

• POST /api/apps - Create new application (admin only)

  {
    "name": "My App",
    "description": "Application description",
    "allowedOrigins": ["http://localhost:3000"],
    "availableRoles": [
      {
        "name": "admin",
        "description": "Administrator",
        "permissions": ["create", "read", "update", "delete"]
      }
    ]
  }

• GET /api/apps - Get all applications (admin only)

• GET /api/apps/:id - Get single application (admin only)

• PUT /api/apps/:id - Update application (admin only)

• DELETE /api/apps/:id - Delete application (admin only)

Integration Guide

1. Register your application through the admin API to get clientId and clientSecret

2. Add authentication to your application:

// Example using axios
const login = async (email, password) => {
  const response = await axios.post('http://localhost:5000/api/auth/login', {
    email,
    password,
    appId: 'your-app-id'
  });
  
  const { token } = response.data;
  // Store token securely
  localStorage.setItem('token', token);
};

3. Use the token for authenticated requests:

axios.defaults.headers.common['Authorization'] = `Bearer ${token}`;

Security Considerations

1. Always use HTTPS in production
2. Store JWT tokens securely
3. Change the JWT secret in production
4. Implement rate limiting
5. Keep dependencies updated
6. Monitor for security vulnerabilities

Error Handling

The API returns appropriate HTTP status codes and error messages:

• 200: Success
• 201: Created
• 400: Bad Request
• 401: Unauthorized
• 403: Forbidden
• 404: Not Found
• 500: Internal Server Error

Contributing

1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Push to the branch
5. Create a Pull Request

License

MIT License