gologin is a well-tested Go library that turns OAuth1 and OAuth2 authorization flows into chainable net/http handlers. In production it lets a web app register LoginHandler and CallbackHandler for providers (GitHub, Google, Facebook, Bitbucket, Twitter, Tumblr) and then read the authenticated user or access token from the request context in the success handler. It also provides a Twitter TokenHandler for native mobile token login. The architecture is a set of primitive handlers (state, login, callback) that communicate via context, with provider packages composing those primitives and adding a user-fetching step; session management stays orthogonal to authentication. The oauth2 subpackage implements RFC 6749 state-parameter CSRF protection with short-lived secure cookies, while the oauth1 subpackage splits request-token acquisition, auth redirect, temporary-secret persistence, and access-token callback so providers with different secret requirements reuse the same pieces. Provider packages are intentionally thin wrappers around the generic handlers and call provider APIs (go-github, go-twitter, sling, google.golang.org/api) to fetch User objects. The code is thoroughly unit-tested with httptest mocks and includes runnable examples for GitHub, Google, and Twitter. Maintenance is active and the dependency manifests are current, though a few provider endpoints lag behind platform APIs (Facebook still targets Graph API v2.9 and Twitter targets v1.1 verify_credentials), so those specific integrations may need updates. The generic OAuth1/OAuth2 machinery remains solid and portable.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
This repository provides a set of Keycloak identity provider plugins for Russian social networks: Yandex, VK (legacy API), VK ID (new OAuth 2.0 with PKCE), Mail.Ru, and Odnoklassniki. It extends Keycloak's OAuth2 identity provider framework with custom endpoints, token exchange logic, user profile mapping, and admin UI themes. The architecture follows Keycloak's SPI pattern: each provider has a factory, config, identity provider class, and optional custom callback endpoint. Notable engineering includes PKCE support for VK ID, signature-based API authentication for Odnoklassniki, Basic Auth token exchange for Mail.Ru, and Infinispan-based state caching for VK ID's custom OAuth flow. The code is well-structured, uses modern Java 17 and Jakarta EE, and includes CI/CD pipelines for building and publishing to Maven Central. However, the repository lacks unit tests, which is a significant gap for a production-grade library.
This is a client-side JavaScript library that standardizes OAuth2 and OAuth1 authentication and API access to over 20 social networks and cloud services (Facebook, Google, Twitter, GitHub, Dropbox, etc.). It provides a unified API with methods like hello.init(), hello.login(), hello.logout(), hello.api(), and an event system for session lifecycle events. The library handles popup/redirect OAuth flows, token storage (localStorage with cookie fallback), and normalizes API responses into a consistent format. It supports multiple transport mechanisms (XHR, JSONP, iframe POST) and includes platform shims for Chrome Apps and PhoneGap. The architecture is modular: each provider is defined in a separate module with OAuth config, endpoint mappings, and response wrappers. The codebase includes extensive unit and e2e tests with stubbed API responses, demos for each provider, and a build system using Grunt and semantic-release. While actively maintained, it carries some technical debt from legacy browser support, vendored dependencies (Knockout.js, expect.js), and reliance on a third-party OAuth proxy for OAuth1 flows.