enterprise_sso

Overview ¶

Enterprise SSO example for Chronos.

Shows how to run the ChronosOS control plane behind an OIDC identity provider (Okta, Auth0, Azure AD, Google Workspace, Keycloak, …). Chronos verifies bearer tokens via JWKS — no shared secrets, keys rotate on the IdP's schedule, and enforcement lives in one middleware.

The provider is chosen by env: any OIDC issuer with a discoverable JWKS URL works. The examples below have been tested with Okta and Auth0 shape tokens; Azure AD works identically with issuer set to the tenant URL.

# Okta
export OIDC_ISSUER=https://<tenant>.okta.com/oauth2/default
export OIDC_JWKS_URL=https://<tenant>.okta.com/oauth2/default/v1/keys
export OIDC_AUDIENCE=api://chronos

# Azure AD
export OIDC_ISSUER=https://login.microsoftonline.com/<tenant-id>/v2.0
export OIDC_JWKS_URL=https://login.microsoftonline.com/<tenant-id>/discovery/v2.0/keys
export OIDC_AUDIENCE=<application-id>

# Google Workspace
export OIDC_ISSUER=https://accounts.google.com
export OIDC_JWKS_URL=https://www.googleapis.com/oauth2/v3/certs
export OIDC_AUDIENCE=<oauth-client-id>

Run:

go run ./examples/enterprise_sso/main.go
curl -H "Authorization: Bearer <id-token>" http://localhost:8420/v1/sessions