Identity Federation — Federated Identity Patterns Across Systems

// Federation router
class FederationRouter {
  constructor() {
    this.providers = new Map();
  }

  registerProvider(name, config) {
    this.providers.set(name, {
      authorizeEndpoint: config.authorizeEndpoint,
      tokenEndpoint: config.tokenEndpoint,
      userInfoEndpoint: config.userInfoEndpoint,
      clientId: config.clientId,
      clientSecret: config.clientSecret,
      scopes: config.scopes,
      claimsMapping: config.claimsMapping
    });
  }

  getAuthorizationUrl(providerName, redirectUri, state) {
    const provider = this.providers.get(providerName);
    const params = new URLSearchParams({
      response_type: 'code',
      client_id: provider.clientId,
      redirect_uri: redirectUri,
      scope: provider.scopes.join(' '),
      state
    });
    return `${provider.authorizeEndpoint}?${params}`;
  }

  async handleCallback(providerName, code, redirectUri) {
    const provider = this.providers.get(providerName);
    const tokenResponse = await axios.post(provider.tokenEndpoint, {
      grant_type: 'authorization_code',
      code,
      client_id: provider.clientId,
      client_secret: provider.clientSecret,
      redirect_uri: redirectUri
    });

    const userInfo = await axios.get(provider.userInfoEndpoint, {
      headers: { Authorization: `Bearer ${tokenResponse.data.access_token}` }
    });

    // Map external claims to internal user model
    const mappedUser = {};
    for (const [internal, external] of Object.entries(provider.claimsMapping)) {
      mappedUser[internal] = userInfo.data[external];
    }

    return mappedUser;
  }
}