Next.js

IDRA_ISSUER=https://<your-org>.idra.team/api/auth
IDRA_CLIENT_ID=<Client ID>
IDRA_CLIENT_SECRET=<client secret>
APP_URL=http://localhost:3000
SESSION_SECRET=<output of: openssl rand -hex 32>

npx create-next-app@latest idra-next --ts --app --no-src-dir --no-tailwind --import-alias '@/*'
cd idra-next
npm install openid-client iron-session

import { getIronSession } from 'iron-session';
import { cookies } from 'next/headers';
import * as oidc from 'openid-client';

export const appUrl = process.env.APP_URL!;
export const redirectUri = `${appUrl}/callback`;

type Session = {
  flow?: { verifier: string; state: string; nonce: string };
  user?: oidc.UserInfoResponse;
  idToken?: string;
};

export const getSession = async () =>
  getIronSession<Session>(await cookies(), {
    cookieName: 'app_session',
    password: process.env.SESSION_SECRET!,
    cookieOptions: { httpOnly: true, sameSite: 'lax', secure: appUrl.startsWith('https://') },
  });

let config: Promise<oidc.Configuration> | undefined;

export function getConfig() {
  const issuer = new URL(process.env.IDRA_ISSUER!);
  const secret = process.env.IDRA_CLIENT_SECRET;
  // With a secret: client_secret_basic. Without one: a public client.
  config ??= oidc.discovery(
    issuer,
    process.env.IDRA_CLIENT_ID!,
    undefined,
    secret ? oidc.ClientSecretBasic(secret) : oidc.None(),
    // Only for an IdRa you run locally on http. Never needed for an https issuer.
    issuer.protocol === 'http:' ? { execute: [oidc.allowInsecureRequests] } : undefined,
  );
  return config;
}

import { redirect } from 'next/navigation';
import * as oidc from 'openid-client';
import { getConfig, getSession, redirectUri } from '@/lib/idra';

export async function GET() {
  const session = await getSession();
  const verifier = oidc.randomPKCECodeVerifier();
  const flow = { verifier, state: oidc.randomState(), nonce: oidc.randomNonce() };
  session.flow = flow;
  await session.save();
  const url = oidc.buildAuthorizationUrl(await getConfig(), {
    redirect_uri: redirectUri,
    scope: 'openid profile email groups',
    code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
    code_challenge_method: 'S256',
    state: flow.state,
    nonce: flow.nonce,
  });
  redirect(url.href);
}

import { redirect } from 'next/navigation';
import type { NextRequest } from 'next/server';
import * as oidc from 'openid-client';
import { appUrl, getConfig, getSession } from '@/lib/idra';

export async function GET(req: NextRequest) {
  const session = await getSession();
  const { flow } = session;
  if (!flow) redirect('/login');
  session.flow = undefined;
  try {
    const config = await getConfig();
    const tokens = await oidc.authorizationCodeGrant(
      config,
      new URL(`${req.nextUrl.pathname}${req.nextUrl.search}`, appUrl),
      { pkceCodeVerifier: flow.verifier, expectedState: flow.state, expectedNonce: flow.nonce },
    );
    // The ID token has no email or name: they come from UserInfo.
    session.user = await oidc.fetchUserInfo(config, tokens.access_token, tokens.claims()!.sub);
    session.idToken = tokens.id_token;
    await session.save();
  } catch (e) {
    console.error(e);
    return new Response(`Sign-in failed: ${(e as Error).message}`, { status: 400 });
  }
  redirect('/');
}

import { redirect } from 'next/navigation';
import * as oidc from 'openid-client';
import { appUrl, getConfig, getSession } from '@/lib/idra';

export async function GET() {
  const session = await getSession();
  const idTokenHint = session.idToken;
  session.destroy();
  if (!idTokenHint) redirect('/');
  const url = oidc.buildEndSessionUrl(await getConfig(), {
    id_token_hint: idTokenHint,
    post_logout_redirect_uri: `${appUrl}/`,
  });
  redirect(url.href);
}

import { getSession } from '@/lib/idra';

export default async function Home() {
  const { user } = await getSession();
  if (!user)
    return (
      <main>
        <h1>Signed out</h1>
        {/* A plain link, not next/link: these routes redirect to another site. */}
        <a href="/login">Sign in with IdRa</a>
      </main>
    );
  return (
    <main>
      <h1>Signed in</h1>
      <pre>{JSON.stringify(user, null, 2)}</pre>
      <a href="/logout">Sign out</a>
    </main>
  );
}

npm run dev