oauth2

package module
v0.3.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 19, 2026 License: Apache-2.0 Imports: 40 Imported by: 0

README

OAuth 2.0 Framework

This library is the Authelia OAuth 2.0 Framework which is internally used to deliver OAuth 2.0 and OpenID Connect 1.0 Flows to its users.

Notable Implemented or Intended Differences

In an effort to assist users who wish to use this library we aim to maintain the following list of differences:

Thanks

This is a hard fork of ORY Fosite under the Apache 2.0 License for the purpose of performing self-maintenance of this critical Authelia dependency.

We however:

  • Acknowledge the amazing hard work of the ORY developers in making such an amazing framework that we can do this with.
  • Plan to continue to contribute back to te ORY fosite and related projects.
  • Have ensured the licensing is unchanged in this fork of the library.
  • Do not have a formal affiliation with ORY and individuals utilizing this library should not allow their usage to be a reflection on ORY as this library is not maintained by them.

Documentation

Index

Constants

View Source 
const (
	ResponseModeDefault     = ResponseModeType("")
	ResponseModeFormPost    = ResponseModeType(consts.ResponseModeFormPost)
	ResponseModeQuery       = ResponseModeType(consts.ResponseModeQuery)
	ResponseModeFragment    = ResponseModeType(consts.ResponseModeFragment)
	ResponseModeFormPostJWT = ResponseModeType(consts.ResponseModeFormPostJWT)
	ResponseModeQueryJWT    = ResponseModeType(consts.ResponseModeQueryJWT)
	ResponseModeFragmentJWT = ResponseModeType(consts.ResponseModeFragmentJWT)
	ResponseModeJWT         = ResponseModeType(consts.ResponseModeJWT)
)
View Source 
const (
	RequestContextKey                 = ContextKey("request")
	AccessRequestContextKey           = ContextKey("accessRequest")
	AccessResponseContextKey          = ContextKey("accessResponse")
	AuthorizeRequestContextKey        = ContextKey("authorizeRequest")
	AuthorizeResponseContextKey       = ContextKey("authorizeResponse")
	PushedAuthorizeResponseContextKey = ContextKey("pushedAuthorizeResponse")
	DPoPProofContextKey               = ContextKey("dpopProof")
)
View Source 
const (
	AccessToken             TokenType = consts.TokenTypeAccessToken
	RefreshToken            TokenType = consts.TokenTypeRefreshToken
	ClientRegistrationToken TokenType = consts.TokenTypeClientRegistrationToken
	DeviceCode              TokenType = consts.CodeDevice
	UserCode                TokenType = consts.CodeUser

	// PushedAuthorizeRequestContext represents the PAR context object
	PushedAuthorizeRequestContext TokenType = "par_context"

	AuthorizeCode TokenType = "authorize_code"
	IDToken       TokenType = "id_token"

	GrantTypeImplicit          GrantType = consts.GrantTypeImplicit
	GrantTypeRefreshToken      GrantType = consts.GrantTypeRefreshToken
	GrantTypeAuthorizationCode GrantType = consts.GrantTypeAuthorizationCode
	GrantTypePassword          GrantType = consts.GrantTypeResourceOwnerPasswordCredentials
	GrantTypeClientCredentials GrantType = consts.GrantTypeClientCredentials
	GrantTypeJWTBearer         GrantType = consts.GrantTypeOAuthJWTBearer
	GrantTypeDeviceCode        GrantType = consts.GrantTypeOAuthDeviceCode
	GrantTypeTokenExchange     GrantType = consts.GrantTypeOAuthTokenExchange

	// BearerAccessToken is the standard OAuth 2.0 Token type.
	BearerAccessToken string = "bearer"

	// DPoPAccessToken is the RFC 9449 token_type value for access tokens bound to a DPoP proof-of-possession key.
	DPoPAccessToken string = "DPoP"

	// RFC8693NAToken is the N/A token.
	RFC8693NAToken string = "N_A"
)
View Source 
const (
	ErrorPARNotSupported           = "The OAuth 2.0 provider does not support Pushed Authorization Requests"
	DebugPARStorageInvalid         = "The Pushed Authorization Request storage is not implemented"
	DebugPARConfigMissing          = "'PushedAuthorizeRequestConfigProvider' not implemented"
	DebugPARRequestsHandlerMissing = "'PushedAuthorizeRequestHandlersProvider' not implemented"
)
View Source 
const DPoPJWKThumbprintLength = 43

DPoPJWKThumbprintLength is the length of a well-formed 'dpop_jkt' value, being the number of characters a 32 byte SHA-256 digest occupies when base64url encoded without padding.

View Source 
const (
	// DebugRFC7591ConfigMissing is the debug message returned when no RFC 7591 client registration endpoint auth
	// strategy is configured, mirroring DebugPARConfigMissing's pattern for the pushed authorization request
	// endpoint (see pushed_authorize_request_handler.go).
	DebugRFC7591ConfigMissing = "'RFC7591ClientRegistrationConfigProvider' not implemented"
)
View Source 
const DefaultBCryptWorkFactor = 12
View Source 
const MaxFetchedBodyBytes = 1 << 20

MaxFetchedBodyBytes bounds the number of bytes read from a response to a fetch of a client-supplied URI, being a 'jwks_uri' or a 'request_uri'. RFC 9101 Section 10.4.1 names a "request_uri" returning "extremely large content" as a denial of service against the authorization server; the same reasoning covers a 'jwks_uri'.

See: https://www.rfc-editor.org/rfc/rfc9101#section-10.4.1

View Source 
const MinParameterEntropy = 8

Variables

View Source 
var (
	ErrClientSecretNotRegistered = errors.New("error occurred checking the client secret: the client is not registered with a secret")

	// ErrClientSecretExpired is returned when the client's secret has passed the expiry recorded at registration.
	ErrClientSecretExpired = errors.New("error occurred checking the client secret: the client secret has expired")
)
View Source 
var (
	// ErrInvalidatedAuthorizeCode is an error indicating that an authorization code has been
	// used previously.
	ErrInvalidatedAuthorizeCode = errors.New("Authorization code has ben invalidated")

	// ErrInvalidatedDeviceCode is an error indicating that a device code has been used previously.
	ErrInvalidatedDeviceCode = errors.New("Device code has been invalidated")

	// ErrInvalidatedUserCode is an error indicating that a user code has been used previously.
	ErrInvalidatedUserCode = errors.New("user code has been invalidated")

	// ErrSerializationFailure is an error indicating that the transactional capable storage could not guarantee
	// consistency of Update & Delete operations on the same rows between multiple sessions.
	ErrSerializationFailure = errors.New("The request could not be completed due to concurrent access")

	ErrUnknownRequest = &RFC6749Error{
		ErrorField:       errUnknownErrorName,
		DescriptionField: "The handler is not responsible for this request.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidRequest = &RFC6749Error{
		ErrorField:       errInvalidRequestName,
		DescriptionField: "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.",
		HintField:        "Make sure that the various parameters are correct, be aware of case sensitivity and trim your parameters. Make sure that the client you are using has exactly whitelisted the redirect_uri you specified.",
		CodeField:        http.StatusBadRequest,
	}
	ErrUnauthorizedClient = &RFC6749Error{
		ErrorField:       errUnauthorizedClientName,
		DescriptionField: "The client is not authorized to request a token using this method.",
		HintField:        "Make sure that client id and secret are correctly specified and that the client exists.",
		CodeField:        http.StatusBadRequest,
	}
	ErrAccessDenied = &RFC6749Error{
		ErrorField:       errAccessDeniedName,
		DescriptionField: "The resource owner or authorization server denied the request.",
		HintField:        "Make sure that the request you are making is valid. Maybe the credential or request parameters you are using are limited in scope or otherwise restricted.",
		CodeField:        http.StatusForbidden,
	}
	ErrUnsupportedResponseType = &RFC6749Error{
		ErrorField:       errUnsupportedResponseTypeName,
		DescriptionField: "The authorization server does not support obtaining a token using this method.",
		CodeField:        http.StatusBadRequest,
	}
	ErrUnsupportedResponseMode = &RFC6749Error{
		ErrorField:       errUnsupportedResponseModeName,
		DescriptionField: "The authorization server does not support obtaining a response using this response mode.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidScope = &RFC6749Error{
		ErrorField:       errInvalidScopeName,
		DescriptionField: "The requested scope is invalid, unknown, or malformed.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInsufficientScope = &RFC6749Error{
		ErrorField:       errInsufficientScopeName,
		DescriptionField: "The request requires higher privileges than provided by the Access Token.",
		CodeField:        http.StatusForbidden,
	}
	ErrServerError = &RFC6749Error{
		ErrorField:       errServerErrorName,
		DescriptionField: errServerErrorDescription,
		CodeField:        http.StatusInternalServerError,
	}
	ErrTemporarilyUnavailable = &RFC6749Error{
		ErrorField:       errTemporarilyUnavailableName,
		DescriptionField: "The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.",
		CodeField:        http.StatusServiceUnavailable,
	}
	ErrUnsupportedGrantType = &RFC6749Error{
		ErrorField:       errUnsupportedGrantTypeName,
		DescriptionField: "The authorization grant type is not supported by the authorization server.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidGrant = &RFC6749Error{
		ErrorField:       errInvalidGrantName,
		DescriptionField: "The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidClient = &RFC6749Error{
		ErrorField:       errInvalidClientName,
		DescriptionField: "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).",
		CodeField:        http.StatusUnauthorized,
	}
	ErrInvalidState = &RFC6749Error{
		ErrorField:       errInvalidStateName,
		DescriptionField: "The state is missing or does not have enough characters and is therefore considered too weak.",
		CodeField:        http.StatusBadRequest,
	}
	ErrMisconfiguration = &RFC6749Error{
		ErrorField:       errMisconfigurationName,
		DescriptionField: "The request failed because of an internal error that is probably caused by misconfiguration.",
		CodeField:        http.StatusInternalServerError,
	}
	ErrInsufficientEntropy = &RFC6749Error{
		ErrorField:       errInsufficientEntropyName,
		DescriptionField: "The request used a security parameter (e.g., anti-replay, anti-csrf) with insufficient entropy.",
		CodeField:        http.StatusBadRequest,
	}
	ErrNotFound = &RFC6749Error{
		ErrorField:       errNotFoundName,
		DescriptionField: "Could not find the requested resource(s).",
		CodeField:        http.StatusNotFound,
	}
	ErrRequestUnauthorized = &RFC6749Error{
		ErrorField:       errRequestUnauthorizedName,
		DescriptionField: "The request could not be authorized.",
		HintField:        "Check that you provided valid credentials in the right format.",
		CodeField:        http.StatusUnauthorized,
	}
	ErrTokenSignatureMismatch = &RFC6749Error{
		ErrorField:       errTokenSignatureMismatchName,
		DescriptionField: "Token signature mismatch.",
		HintField:        "Check that you provided a valid token in the right format.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidTokenFormat = &RFC6749Error{
		ErrorField:       errInvalidTokenFormatName,
		DescriptionField: "The token provided is expired, revoked, malformed, or invalid for other reasons.",
		HintField:        "Check that you provided a valid token in the right format.",
		CodeField:        http.StatusBadRequest,
	}
	// ErrInvalidToken is a resource-server rejection per RFC 8705 Section 3: a protected-resource request bearing a
	// certificate-bound access token whose certificate does not match the binding must be rejected with HTTP 401 and
	// the 'invalid_token' error code. It deliberately reuses errInvalidTokenFormatName, the same error code as
	// ErrInvalidTokenFormat, but with HTTP 401 instead of 400; RFC6749Error.Is compares both ErrorField and CodeField,
	// so the two remain distinguishable by errors.Is.
	ErrInvalidToken = &RFC6749Error{
		ErrorField:       errInvalidTokenFormatName,
		DescriptionField: "The access token provided is expired, revoked, malformed, or invalid for other reasons.",
		HintField:        "The access token is invalid or was not presented in the manner it is bound to.",
		CodeField:        http.StatusUnauthorized,
	}
	ErrInvalidDPoPProof = &RFC6749Error{
		ErrorField:       errInvalidDPoPProofName,
		DescriptionField: "The DPoP proof is missing or invalid.",
		HintField:        "The request was made with an invalid, malformed, expired, or missing DPoP proof JWT.",
		CodeField:        http.StatusBadRequest,
	}
	ErrUseDPoPNonce = &RFC6749Error{
		ErrorField:       errUseDPoPNonceName,
		DescriptionField: "Authorization server requires nonce in DPoP proof.",
		HintField:        "Retry the request including a 'nonce' claim in the DPoP proof using the value from the most recent 'DPoP-Nonce' response header.",
		CodeField:        http.StatusBadRequest,
	}
	ErrTokenExpired = &RFC6749Error{
		ErrorField:       errTokenExpiredName,
		DescriptionField: "Token expired.",
		HintField:        "The token expired.",
		CodeField:        http.StatusUnauthorized,
	}
	ErrScopeNotGranted = &RFC6749Error{
		ErrorField:       errScopeNotGrantedName,
		DescriptionField: "The token was not granted the requested scope.",
		HintField:        "The resource owner did not grant the requested scope.",
		CodeField:        http.StatusForbidden,
	}
	ErrTokenClaim = &RFC6749Error{
		ErrorField:       errTokenClaimName,
		DescriptionField: "The token failed validation due to a claim mismatch.",
		HintField:        "One or more token claims failed validation.",
		CodeField:        http.StatusUnauthorized,
	}
	ErrInactiveToken = &RFC6749Error{
		ErrorField:       errTokenInactiveName,
		DescriptionField: "Token is inactive because it is malformed, expired or otherwise invalid.",
		HintField:        "Token validation failed.",
		CodeField:        http.StatusUnauthorized,
	}
	ErrLoginRequired = &RFC6749Error{
		ErrorField:       errLoginRequiredName,
		DescriptionField: "The Authorization Server requires End-User authentication.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInteractionRequired = &RFC6749Error{
		DescriptionField: "The Authorization Server requires End-User interaction of some form to proceed.",
		ErrorField:       errInteractionRequiredName,
		CodeField:        http.StatusBadRequest,
	}
	ErrConsentRequired = &RFC6749Error{
		ErrorField:       errConsentRequiredName,
		DescriptionField: "The Authorization Server requires End-User consent.",
		CodeField:        http.StatusBadRequest,
	}
	ErrRequestNotSupported = &RFC6749Error{
		ErrorField:       errRequestNotSupportedName,
		DescriptionField: "The authorization server does not support the use of the request parameter.",
		CodeField:        http.StatusBadRequest,
	}
	ErrRequestURINotSupported = &RFC6749Error{
		ErrorField:       errRequestURINotSupportedName,
		DescriptionField: "The authorization server does not support the use of the request_uri parameter.",
		CodeField:        http.StatusBadRequest,
	}
	ErrRegistrationNotSupported = &RFC6749Error{
		ErrorField:       errRegistrationNotSupportedName,
		DescriptionField: "The OP does not support use of the registration parameter.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidRequestURI = &RFC6749Error{
		ErrorField:       errInvalidRequestURIName,
		DescriptionField: "The request_uri in the authorization request returns an error or contains invalid data.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidRequestObject = &RFC6749Error{
		ErrorField:       errInvalidRequestObjectName,
		DescriptionField: "The request parameter contains an invalid Request Object.",
		CodeField:        http.StatusBadRequest,
	}
	ErrJTIKnown = &RFC6749Error{
		ErrorField:       errJTIKnownName,
		DescriptionField: "The jti was already used.",
		CodeField:        http.StatusBadRequest,
	}
	ErrAuthorizationPending = &RFC6749Error{
		ErrorField:       errAuthorizationPendingName,
		DescriptionField: "The authorization request is still pending as the end user hasn't yet completed the user-interaction steps.",
		CodeField:        http.StatusBadRequest,
	}
	ErrDeviceExpiredToken = &RFC6749Error{
		ErrorField:       errDeviceExpiredTokenName,
		DescriptionField: "The device_code has expired, and the device authorization session has concluded.",
		CodeField:        http.StatusBadRequest,
	}
	ErrSlowDown = &RFC6749Error{
		ErrorField:       errSlowDownName,
		DescriptionField: "Too many requests within a short time period.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidTarget = &RFC6749Error{
		ErrorField:       errInvalidTargetName,
		DescriptionField: "The requested resource is invalid, missing, unknown, or malformed.",
		HintField:        "Ensure the requested resource is an absolute URI without a fragment component that identifies a resource server known to the authorization server and that it is permitted for this client.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidClientMetadata = &RFC6749Error{
		ErrorField:       errInvalidClientMetadataName,
		DescriptionField: "The value of one of the client metadata fields is invalid and the server has rejected this request.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidRedirectURI = &RFC6749Error{
		ErrorField:       errInvalidRedirectURIName,
		DescriptionField: "The value of one or more redirection URIs is invalid.",
		CodeField:        http.StatusBadRequest,
	}
	ErrInvalidSoftwareStatement = &RFC6749Error{
		ErrorField:       errInvalidSoftwareStatementName,
		DescriptionField: "The software statement presented is invalid.",
		CodeField:        http.StatusBadRequest,
	}
	ErrUnapprovedSoftwareStatement = &RFC6749Error{
		ErrorField:       errUnapprovedSoftwareStatementName,
		DescriptionField: "The software statement presented is not approved for use by this authorization server.",
		CodeField:        http.StatusBadRequest,
	}
)
View Source 
var (
	// RegexSpecificationVSCHAR matches strings which only contain the ASCII visible printable
	// range %x20-7E per https://datatracker.ietf.org/doc/html/rfc6749#appendix-A i.e. VSCHAR. Presumably the Visible
	// with Spaces characters.
	RegexSpecificationVSCHAR = regexp.MustCompile(`^[\pL\pM\pN\pP\pS ]+$`)

	// RegexSpecificationNQCHAR matches strings which only contain the ASCII visible printable
	// ranges %x21 / %x23-5B / %x5D-7E per https://datatracker.ietf.org/doc/html/rfc6749#appendix-A i.e. NQCHAR.
	// Presumably the Non-Quoted character range.
	RegexSpecificationNQCHAR = regexp.MustCompile(`^[\pL\pM\pN\pS!#-@_\[\]{}]+$`)

	// RegexSpecificationNQSCHAR matches strings which only contain the ASCII visible printable
	// ranges %x20-21 / %x23-5B / %x5D-7E per https://datatracker.ietf.org/doc/html/rfc6749#appendix-A i.e. NQSCHAR.
	// Presumably the Non-Quoted with Spaces character range.
	RegexSpecificationNQSCHAR = regexp.MustCompile(`^[\pL\pM\pN\pS!#-@_\[\]{}]+$`)
)
View Source 
var DefaultFormPostTemplate = template.Must(template.New("form_post").Parse(`<html>
   <head>
      <title>Submit This Form</title>
   </head>
   <body onload="javascript:document.forms[0].submit()">
      <form method="post" action="{{ .RedirURL }}">
         {{ range $key,$value := .Parameters }}
            {{ range $parameter:= $value }}
		      <input type="hidden" name="{{ $key }}" value="{{ $parameter }}"/>
            {{ end }}
         {{ end }}
      </form>
   </body>
</html>`))

Functions

func AccessTokenFromRequest 

func AccessTokenFromRequest(r *http.Request) string

AccessTokenFromRequest extracts a bearer access token from an HTTP request. Per RFC 6750 the token may be supplied in the Authorization header (Bearer scheme) or as the 'access_token' form parameter. Returns the empty string if no token can be located.

func AddLocalizerToErr 

func AddLocalizerToErr(catalog i18n.MessageCatalog, err error, requester Requester) error

AddLocalizerToErr augments the error object with the localizer based on the language set in the requester object. This is primarily required for response writers like introspection that do not take in the requester in the Write* function that produces the translated message. See - WriteIntrospectionError, for example.

func AddLocalizerToErrWithLang 

func AddLocalizerToErrWithLang(catalog i18n.MessageCatalog, lang language.Tag, err error) error

AddLocalizerToErrWithLang augments the error object with the localizer based on the language passed in. This is primarily required for response writers like introspection that do not take in the requester in the Write* function that produces the translated message. See - WriteIntrospectionError, for example.

func ApplyConfirmation added in v0.3.0 

func ApplyConfirmation(ctx context.Context, config ConfirmationConfigProvider, claims map[string]any, session Session)

ApplyConfirmation rebuilds the RFC 7800 'cnf' claim in claims from the bindings recorded on session whose binding method is currently enabled, and is the only supported way to write that claim.

The claim is rebuilt rather than merged into, so it asserts exactly the bindings the server established and nothing else. That matters because the claims a token is minted from include the session's extra claims, which are free-form: were the existing value merged into, a 'cnf' placed there would travel into the token, and a resource server reads 'cnf' as evidence that a proof-of-possession check was performed. A 'cnf' that would be left empty is removed entirely, since an empty confirmation asserts nothing while still suggesting the token is bound.

A binding whose method is disabled is skipped for the same reason, and is skipped rather than erased: a session restored from storage still carries a binding recorded while the method was enabled, but the handler that would verify it no longer runs, so asserting it would claim a check that did not happen. Leaving the value on the session keeps the binding dormant rather than lost, so re-enabling the method resumes both enforcement and this claim.

func ApplyIDTokenConfirmation added in v0.3.1 

func ApplyIDTokenConfirmation(ctx context.Context, config IDTokenConfirmationConfigProvider, claims *jwt.IDTokenClaims, headers *jwt.Headers) (err error)

ApplyIDTokenConfirmation writes the OpenID Connect Key Binding 1.0 Section 4 confirmation into an ID Token's claims and protected header: the proof-of-possession public key as 'cnf.jwk', and a 'typ' of 'dpop+id_token'. It is the only supported way to write that claim, and rebuilds rather than merges for the reason ApplyConfirmation does.

The binding is resolved from the access request in ctx rather than from the requester the ID Token is generated from. The Authorization Code and Device Authorization flows generate theirs from the request persisted at the authorization endpoint, whose session necessarily predates the DPoP proof presented at the token endpoint, so that session can never carry the key. It also supplies the grant type and granted scopes, neither of which is on a session at all.

It fails closed: an ID Token generated outside a token endpoint request carries no confirmation, which is what keeps the Implicit and Hybrid flows unbound as Section 1.4 requires. Whenever it emits no confirmation it also removes the 'typ' header, see clearIDTokenConfirmationHeader.

func ClientCertificateChainVerified added in v0.3.0 

func ClientCertificateChainVerified(r *http.Request, header string) (verified bool)

ClientCertificateChainVerified reports whether the chain of the certificate ClientCertificateFromRequest returns was validated before the handler ran. RFC 8705 Section 2.1 requires a validated chain for the 'tls_client_auth' method; Section 2.2's 'self_signed_tls_client_auth' matches a registered key directly and does not.

A forwarded certificate is reported verified because the proxy that performed the handshake is what validated it, which Section 6.5 places out of scope. On a direct connection Go populates VerifiedChains only for a listener configured RequireAndVerifyClientCert or VerifyClientCertIfGiven; RequestClientCert and RequireAnyClientCert leave it empty while still populating PeerCertificates.

See: https://www.rfc-editor.org/rfc/rfc8705#section-2.1

func ClientCertificateFromRequest added in v0.3.0 

func ClientCertificateFromRequest(r *http.Request, header string) (cert *x509.Certificate, err error)

ClientCertificateFromRequest returns the X.509 certificate the client authenticated with, or nil when it presented none. It is the single point at which RFC 8705 obtains a certificate.

The two sources are mutually exclusive, selected by whether header names one. Configuring a header name declares that clients reach this server through a TLS terminating reverse proxy which forwards their certificate in that header (see RFC 8705 Section 6.5); the peer certificate on such a connection belongs to the proxy, not to the client, so r.TLS is not consulted at all. Preferring r.TLS there would bind a token to the proxy's certificate, which every client behind that proxy would then satisfy. A request arriving without the header carries no client certificate, even when the connection has a peer certificate of its own.

With no header configured, which is the default, the certificate comes from r.TLS alone, where Go has already validated it against the listener's ClientCAs before the handler ran.

The header is fully spoofable by anyone able to reach the server without transiting that proxy, and a forged value authenticates the sender as any client registered with an mTLS authentication method. The caller must therefore opt in by configuring a name, and a deployment that does MUST ensure the proxy overwrites the header on every inbound request and that the server is unreachable except through it.

func CompareClientSecret 

func CompareClientSecret(ctx context.Context, client Client, rawSecret []byte) (err error)

CompareClientSecret compares a raw secret input from a client to the registered client secret. If the secret is valid it returns nil, otherwise it returns an error. The ErrClientSecretNotRegistered error indicates the ClientSecret is nil, all other errors are returned directly from the ClientSecret.Compare function.

func DefaultAudienceStrategy added in v0.2.34 

func DefaultAudienceStrategy(haystack, needle []string) (err error)

DefaultAudienceStrategy matches requested audiences against the client's allowed audience list.

func DefaultFormPostResponseWriter 

func DefaultFormPostResponseWriter(rw io.Writer, template *template.Template, redirectURL string, parameters url.Values)

DefaultFormPostResponseWriter renders the given template using the supplied redirect URL and parameters and writes the result to rw. It is the default FormPostResponseWriter used when none is configured on the provider, and produces an auto-submitting HTML form per the OAuth 2.0 Form Post Response Mode specification.

func DefaultResourceStrategy added in v0.2.34 

func DefaultResourceStrategy(haystack, needle []string) (err error)

DefaultResourceStrategy matches requested RFC 8707 resource indicators against the client's allowed audience list.

func DeviceAuthorizeStatusToString 

func DeviceAuthorizeStatusToString(status DeviceAuthorizeStatus) string

DeviceAuthorizeStatusToString returns a human-readable label for the RFC 8628 device authorization status, or "Invalid" for unknown values.

func EqualDistinguishedNames added in v0.3.0 

func EqualDistinguishedNames(a, b string) (equal bool)

EqualDistinguishedNames reports whether two RFC 4514 string representations of a distinguished name denote the same name.

RFC 8705 Section 2.1 notes that a predictable treatment of DN values, such as the distinguishedNameMatch rule from RFC 4517, is needed when comparing a certificate's subject DN to a client's registered one. Full RFC 4517 matching is not implemented; this normalises the two spellings that differ in practice without changing what a DN denotes. Insignificant whitespace around each relative distinguished name is ignored, attribute types are compared without regard to case, and the sequence is compared in both directions because Go's pkix.Name.String and OpenSSL emit relative distinguished names in opposite orders.

Attribute values are compared with case significance. Most attribute types in a subject DN use caseIgnoreMatch, so this is stricter than RFC 4517 requires; the registered value is ordinarily copied from the certificate, and for a value serving as an authentication credential a visible mismatch is preferable to a silent widening.

func ErrorToDebugRFC6749Error 

func ErrorToDebugRFC6749Error(err error) (rfc error)

ErrorToDebugRFC6749Error converts the provided error to a *DebugRFC6749Error provided it is not nil and can be cast as a *RFC6749Error.

func EscapeJSONString 

func EscapeJSONString(str string) string

EscapeJSONString does a poor man's JSON encoding. Useful when we do not want to use full JSON encoding because we just had an error doing the JSON encoding. The characters that MUST be escaped: quotation mark, reverse solidus, and the control characters (U+0000 through U+001F). See: https://datatracker.ietf.org/doc/html/rfc8259#section-7

func ExactAudienceStrategy added in v0.2.34 

func ExactAudienceStrategy(haystack, needle []string) (err error)

ExactAudienceStrategy does not assume that audiences are URIs, but compares strings as-is and does matching with exact string comparison. It requires that all strings in "needle" are present in "haystack". Use this strategy when your audience values are not URIs (e.g., you use client IDs for audience and they are UUIDs or random strings).

func ExactScopeStrategy 

func ExactScopeStrategy(haystack []string, needle string) bool

ExactScopeStrategy is a ScopeStrategy that requires a granted scope to match the requested scope exactly. No hierarchical or wildcard expansion is performed.

func GetDPoPConfirmationJWKThumbprint added in v0.3.0 

func GetDPoPConfirmationJWKThumbprint(claims map[string]any) (jkt string)

GetDPoPConfirmationJWKThumbprint returns the 'jkt' confirmation method of the RFC 7800 'cnf' claim in claims, or an empty string when the claim is absent, is not a JSON object, or carries no JWK thumbprint. It serves callers holding claims but no session, such as a resource server taking the bound thumbprint out of an introspection response to hand to the RFC 9449 ValidateResourceAccess.

func GetEffectiveLifespan 

func GetEffectiveLifespan(c Client, gt GrantType, tt TokenType, fallback time.Duration) (lifespan time.Duration)

GetEffectiveLifespan either maps GrantType x TokenType to the client's configured lifespan, or returns the fallback value.

func GetMTLSConfirmationX509SHA256Thumbprint added in v0.3.0 

func GetMTLSConfirmationX509SHA256Thumbprint(claims map[string]any) (x5t string)

GetMTLSConfirmationX509SHA256Thumbprint returns the 'x5t#S256' confirmation method of the RFC 7800 'cnf' claim in claims, or an empty string when the claim is absent, is not a JSON object, or carries no certificate thumbprint. It serves callers holding claims but no session, such as a resource server taking the bound thumbprint out of an introspection response to hand to ValidateClientCertificateBinding.

func GetOIDCKeyBindingConfirmationJWKThumbprint added in v0.3.1 

func GetOIDCKeyBindingConfirmationJWKThumbprint(claims map[string]any) (jkt string, err error)

GetOIDCKeyBindingConfirmationJWKThumbprint returns the RFC 7638 SHA-256 JWK Thumbprint of the public key carried by the 'jwk' confirmation method of the RFC 7800 'cnf' claim in claims, or an empty string when the claim is absent, is not a JSON object, or carries no key.

OpenID Connect Key Binding 1.0 Section 4 puts the key itself into 'cnf' rather than its thumbprint, so a caller comparing that confirmation against a DPoP proof must first reduce it to the thumbprint the proof is identified by. GetDPoPConfirmationJWKThumbprint serves the 'jkt' method RFC 9449 Section 6.1 defines, which needs no reduction.

It errors only when a key is present and cannot be read, which is a token asserting a confirmation that nothing can be checked against; that is distinct from, and must not be conflated with, a token asserting no confirmation at all.

func GetPostFormHTMLTemplate 

func GetPostFormHTMLTemplate(ctx context.Context, c FormPostHTMLTemplateProvider) *template.Template

GetPostFormHTMLTemplate returns the configured form_post HTML template from c, or DefaultFormPostTemplate when the provider returns nil.

func GetRequestedAudiences added in v0.2.32 

func GetRequestedAudiences(form url.Values) (audiences []string)

GetRequestedAudiences returns the values of the 'audience' form parameter. Multiple audiences can be expressed as repeated parameters or as a single space-delimited value.

func GetRequestedResources added in v0.2.31 

func GetRequestedResources(form url.Values) (resources []string)

GetRequestedResources returns the values of the RFC 8707 'resource' form parameter. Multiple resources can be expressed as repeated parameters or as a single space-delimited value.

func GetResourcesParameter added in v0.2.31 

func GetResourcesParameter(parameter string, form url.Values) (resources []string, ok bool)

GetResourcesParameter returns the resource identifiers from the given form parameter.

func HTTPClientWithoutRedirects added in v0.3.0 

func HTTPClientWithoutRedirects(client *retryablehttp.Client) (scoped *retryablehttp.Client)

HTTPClientWithoutRedirects returns a *retryablehttp.Client that behaves identically to client except that it refuses to follow HTTP redirects, returning the first redirect response as-is instead of dereferencing it. A fetch of a client-supplied URI uses it so that a location which passed validation cannot hand the fetch on to one that would not have.

This is a fresh value built from client's exported configuration fields rather than a mutation of client itself, which is typically the shared instance HTTPClientProvider.GetHTTPClient returns and whose other consumers must keep following redirects. client's unexported sync.Once guards are deliberately not copied, since copying a sync.Once that may have fired is unsafe; the returned client starts with its own unfired guards, which is safe because every field they guard is set explicitly here.

func HierarchicScopeStrategy 

func HierarchicScopeStrategy(haystack []string, needle string) bool

HierarchicScopeStrategy is a ScopeStrategy that treats scopes as dot-delimited hierarchies, where a granted scope implicitly includes all of its sub-scopes. For example, granting "foo" matches a request for "foo.bar", but granting "foo.bar" does not match a request for "foo".

func IsBearerCredentialError added in v0.3.0 

func IsBearerCredentialError(err error) (is bool)

IsBearerCredentialError reports whether err is a rejection of a bearer credential presented to authorize a call, and so warrants a RFC 6750 Section 3 'WWW-Authenticate' challenge naming the Bearer and DPoP schemes. It is the predicate both protected-resource error writers use to decide whether to emit one.

ErrRequestUnauthorized is deliberately excluded even though it is also an authorization failure. It is what a client authentication branch returns, and a caller that authenticated with client credentials was not using either of those schemes - RFC 6749 Section 5.2 calls for a challenge matching the scheme actually attempted, so answering a failed Basic authentication with 'WWW-Authenticate: Bearer' would advertise the wrong one.

ErrInvalidRequest is excluded for a related reason: it is mostly a malformed method or body, which says nothing about how the caller authenticated. That includes the RFC 9449 Section 7.2 multiple-Authorization-header case, where a challenge would add nothing the 400 does not already convey.

func IsLocalhost 

func IsLocalhost(uri *url.URL) bool

IsLocalhost reports whether the given URI's hostname is a localhost or loopback address. The check covers the literal hostname "localhost", any subdomain of ".localhost", and IPv4/IPv6 loopback IP literals.

func IsMatchingRedirectURI added in v0.1.4 

func IsMatchingRedirectURI(needle string, haystack []string, strategy URIComparisonStrategy) (uri string, ok bool)

IsMatchingRedirectURI matches a requested redirect URI against a pool of registered client URIs.

Test a given redirect URI against a pool of URIs provided by a registered client. If the OAuth 2.0 Client has loopback URIs registered either an IPv4 URI http://127.0.0.1 or an IPv6 URI http://[::1] a client is allowed to request a dynamic port and the server MUST accept it as a valid redirection uri.

https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 Native apps that are able to open a port on the loopback network interface without needing special permissions (typically, those on desktop operating systems) can use the loopback interface to receive the OAuth redirect.

Loopback redirect URIs use the "http" scheme and are constructed with the loopback IP literal and whatever port the client is listening on.

func IsMatchingResourceIndicator added in v0.2.32 

func IsMatchingResourceIndicator(haystackURL, needleURL *url.URL) bool

IsMatchingResourceIndicator returns true if needleURL is a subpath of haystackURL.

func IsRedirectURISecure 

func IsRedirectURISecure(ctx context.Context, uri *url.URL) bool

IsRedirectURISecure reports whether the given URI is acceptable for use as a redirect target. The check is permissive: non-HTTP schemes and HTTP URIs that resolve to localhost are considered secure. Use IsRedirectURISecureStrict for stricter handling that rejects custom-scheme URIs.

func IsRedirectURISecureStrict 

func IsRedirectURISecureStrict(uri *url.URL) bool

IsRedirectURISecureStrict is stricter than IsRedirectURISecure and it does not allow custom-scheme URLs because they can be hijacked for native apps. Use claimed HTTPS redirects instead. See discussion in https://github.com/ory/fosite/pull/489.

func IsRefreshTokenRotationDisabled added in v0.3.3 

func IsRefreshTokenRotationDisabled(ctx context.Context, config DisableRefreshTokenRotationProvider, client Client) (disable bool)

IsRefreshTokenRotationDisabled determines if the refresh token grant keeps the presented refresh token. Rotation is disabled when either the provider-wide option or the client's own policy is set.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1

func IsValidDPoPJWKThumbprint added in v0.2.39 

func IsValidDPoPJWKThumbprint(jkt string) bool

IsValidDPoPJWKThumbprint reports whether jkt is a well-formed RFC 9449 Section 10.1 'dpop_jkt' value, which that section defines as the RFC 7638 JWK Thumbprint of the proof-of-possession public key computed with SHA-256, the same value used for 'jkt' in the 'cnf' claim. Only the encoding can be checked, as the thumbprint of a key the client has not yet presented cannot be recomputed.

The client supplies this value directly, so it is validated before being recorded against a grant. An unchecked value is stored verbatim for the lifetime of the authorization code and can be of any length, and while a malformed one only ever fails to match a proof, there is no reason to carry it that far.

func IsValidRedirectURI 

func IsValidRedirectURI(uri *url.URL) bool

IsValidRedirectURI validates a redirect_uri as specified in:

* https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2

func JKWKSFetcherWithDefaultTTL 

func JKWKSFetcherWithDefaultTTL(ttl time.Duration) func(*DefaultJWKSFetcherStrategy)

JKWKSFetcherWithDefaultTTL sets the default TTL for the cache.

func JWKSFetcherWithCache 

func JWKSFetcherWithCache(cache *ristretto.Cache) func(*DefaultJWKSFetcherStrategy)

JWKSFetcherWithCache sets the cache to use.

func JWKSFetcherWithHTTPClient 

func JWKSFetcherWithHTTPClient(client *retryablehttp.Client) func(*DefaultJWKSFetcherStrategy)

JWKSFetcherWithHTTPClient sets the HTTP client to use.

func JWKSFetcherWithHTTPClientSource 

func JWKSFetcherWithHTTPClientSource(clientSourceFunc func(ctx context.Context) *retryablehttp.Client) func(*DefaultJWKSFetcherStrategy)

JWKSFetcherWithHTTPClientSource sets the HTTP client source function to use.

func MatchRedirectURIWithClientRedirectURIs 

func MatchRedirectURIWithClientRedirectURIs(raw string, client Client) (*url.URL, error)

MatchRedirectURIWithClientRedirectURIs if the given uri is a registered redirect uri. Does not perform uri validation.

Considered specifications

  • https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.3 If multiple redirection URIs have been registered, if only part of the redirection URI has been registered, or if no redirection URI has been registered, the client MUST include a redirection URI with the authorization request using the "redirect_uri" request parameter.

    When a redirection URI is included in an authorization request, the authorization server MUST compare and match the value received against at least one of the registered redirection URIs (or URI components) as defined in [RFC3986] Section 6, if any redirection URIs were registered. If the client registration included the full redirection URI, the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986] Section 6.2.1.

* https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.7

  • The authorization server may also enforce the usage and validation of pre-registered redirect URIs (see Section 5.2.3.5). This will allow for early recognition of authorization "code" disclosure to counterfeit clients.
  • The attacker will need to use another redirect URI for its authorization process rather than the target web site because it needs to intercept the flow. So, if the authorization server associates the authorization "code" with the redirect URI of a particular end-user authorization and validates this redirect URI with the redirect URI passed to the token's endpoint, such an attack is detected (see Section 5.2.4.5).

func NewContext 

func NewContext() context.Context

NewContext returns a fresh background context suitable for use as the root context of an OAuth 2.0 request flow.

func NewDefaultJWKSFetcherStrategy 

func NewDefaultJWKSFetcherStrategy(opts ...func(*DefaultJWKSFetcherStrategy)) jwt.JWKSFetcherStrategy

NewDefaultJWKSFetcherStrategy returns a new instance of the DefaultJWKSFetcherStrategy.

func ParseClientCertificateHeader added in v0.3.0 

func ParseClientCertificateHeader(value string) (cert *x509.Certificate, err error)

ParseClientCertificateHeader decodes a client certificate forwarded by a TLS terminating proxy.

No encoding is prescribed for this header, and the proxies that emit one disagree: Traefik v2 and nginx (ssl_client_escaped_cert) URL-escape a PEM document, Traefik v3 sends the bare base64 DER with the armour and line breaks stripped, and HAProxy sends base64 DER. The parser therefore accepts all of them rather than requiring a deployment to declare which one it has, since a mismatch would present as mutual TLS silently failing.

When a chain is present only the leaf is returned, as that is the certificate whose private key the client proved possession of. A chain arrives either comma separated or as concatenated PEM documents, and the leaf is first in both.

func PublishDPoPProof added in v0.3.1 

func PublishDPoPProof(ctx context.Context, proof *DPoPProof)

PublishDPoPProof records a fully validated proof for the binding handlers that run after the caller in the same request.

It does nothing when the context carries no holder, which is every dispatch outside the token endpoint's binding phase, because a handler cannot know which phase dispatched it and RFC 9449 handling must not depend on that.

func RemoveEmpty 

func RemoveEmpty(args []string) (ret []string)

RemoveEmpty returns a new slice containing the non-empty, whitespace-trimmed entries of args. It is commonly used to normalize space-delimited OAuth 2.0 parameters such as 'scope', 'audience', and 'prompt'.

func RequestURL added in v0.2.39 

func RequestURL(r *http.Request) string

RequestURL reconstructs the RFC 9449 target URI ('htu') from the request, discarding query and fragment. When the request did not arrive over TLS directly it falls back to the X-Forwarded-Proto header to determine the scheme; deployments MUST therefore ensure that header is set (and any client-supplied value stripped) by a trusted edge proxy, otherwise a client could influence the reconstructed htu scheme.

The path is taken in its escaped form. The decoded (*url.URL).Path would silently turn a percent-encoded delimiter in the request target into a real one, so a request to '/token%3Fx=1' would reconstruct as '/token?x=1' and compare equal to a proof bound to '/token' once the query is discarded.

func RestoreConfirmation added in v0.3.0 

func RestoreConfirmation(claims map[string]any, session Session)

RestoreConfirmation records on session the bindings asserted by the RFC 7800 'cnf' claim in claims. It is the inverse of ApplyConfirmation, for a stateless token whose own claims are the only record of what it is bound to.

The claims MUST already have been validated, because this trusts them: it is the token's signature that makes 'cnf' evidence of a binding the server established rather than an assertion by whoever presented the token.

func StringInSlice 

func StringInSlice(needle string, haystack []string) bool

StringInSlice returns true if needle exists in haystack

func StringInSliceFold 

func StringInSliceFold(needle string, haystack []string) bool

StringInSliceFold returns true if needle exists in haystack (case-insensitive).

func ValidateBearerAuthorization added in v0.3.0 

func ValidateBearerAuthorization(ctx context.Context, config BearerAuthorizationConfig, r *http.Request, requester Requester, token string, auth BearerAuthorization) (err error)

ValidateBearerAuthorization performs the checks common to every endpoint that accepts an Access Token as a bearer credential authorizing the call. requester is the resolved credential; token is the raw value as presented.

The order is proof-of-possession, then scope, then audience, and it is load-bearing rather than cosmetic. Two failures below report distinguishable errors - ErrInvalidDPoPProof and ErrInsufficientScope - while every other failure reports the deliberately non-discriminating ErrInvalidToken (RFC 6750 Section 3.1: "expired, revoked, malformed, or invalid for other reasons"). A distinguishable error implicitly reports that every check before it passed, so position bounds disclosure:

  • Proof-of-possession runs first, so ErrInvalidDPoPProof discloses only that the credential resolved and is bound - which its holder already knows. It also means the scope diagnostic is only ever delivered to a caller who has proven possession of the key, never to someone holding a stolen bound token. That property is what requires the enforcement rejection of an unbound credential to run here too rather than after scope: an enforcing deployment has no credential the scope diagnostic could safely be delivered to except a bound one.
  • Scope runs before audience, so ErrInsufficientScope discloses nothing about the audience. The audience failure reports ErrInvalidToken and so stays indistinguishable from expiry, revocation, and an unknown token.

Proof-of-possession cannot run any earlier: validating the proof requires the token's bound thumbprint, which requires the resolved session the caller has already fetched.

func ValidateClientCertificateBinding added in v0.3.0 

func ValidateClientCertificateBinding(r *http.Request, header, boundX5T string) (cert *x509.Certificate, err error)

ValidateClientCertificateBinding performs the RFC 8705 Section 3 resource server check for a certificate-bound access token, returning the certificate the connection was authenticated with.

boundX5T is the confirmed 'cnf' member 'x5t#S256' the caller obtained by introspecting the access token, for which GetMTLSConfirmationX509SHA256Thumbprint is provided; header names the trusted proxy header to fall back to when the connection carries no peer certificate, and is empty when there is none.

Every failure returns an error wrapping ErrInvalidToken, which Section 3 requires be reported with an HTTP 401 status and the 'invalid_token' error code. The function is intended only for tokens already known to be certificate bound; an empty boundX5T is treated as caller misuse rather than as a token bound to nothing.

This lives in the root package rather than in handler/rfc8705 because the root package needs it itself, to enforce the binding of an access token presented as a credential at the introspection endpoint, and a proof-of-possession check with two implementations is a check with one of them eventually wrong. It is the single entry point for the Section 3 check, for callers inside this module and resource servers outside it alike.

func ValidateResourceIndicatorURI added in v0.2.31 

func ValidateResourceIndicatorURI(resource string) (err error)

ValidateResourceIndicatorURI validates a single resource indicator URI.

func ValidateResourceIndicators added in v0.2.31 

func ValidateResourceIndicators(form url.Values) (err error)

ValidateResourceIndicators validates the 'resource' form parameter values as RFC 8707 resource indicators. Values from the 'audience' form parameter are not URI-validated here; they are checked against the client's allowed audience list by the audience strategy.

func WildcardScopeStrategy 

func WildcardScopeStrategy(matchers []string, needle string) bool

WildcardScopeStrategy is a ScopeStrategy that matches dot-delimited scopes where each granted segment may be the literal "*" wildcard, matching any non-empty value in the corresponding position of the requested scope. The number of segments in the matcher and the needle must be equal, except when the trailing matcher segment is "*", which also matches when the needle has additional segments.

func X509CertificateSHA256Thumbprint added in v0.3.0 

func X509CertificateSHA256Thumbprint(cert *x509.Certificate) (x5t string)

X509CertificateSHA256Thumbprint returns the RFC 8705 Section 3.1 'x5t#S256' confirmation value for cert, being the base64url encoding without padding of the SHA-256 digest over the DER encoding of the certificate. It returns an empty string when cert is nil, so callers can treat 'no certificate' and 'no binding' identically.

Types

type AccessRequest 

type AccessRequest struct {
	GrantTypes       Arguments `json:"grantTypes" gorethink:"grantTypes"`
	HandledGrantType Arguments `json:"handledGrantType" gorethink:"handledGrantType"`

	Request
}

func NewAccessRequest 

func NewAccessRequest(session Session) *AccessRequest

NewAccessRequest returns an empty AccessRequest seeded with the given session.

func (*AccessRequest) GetGrantTypes 

func (a *AccessRequest) GetGrantTypes() Arguments

func (*AccessRequest) SanitizeRestoreRefreshTokenOriginalRequester 

func (a *AccessRequest) SanitizeRestoreRefreshTokenOriginalRequester(requester Requester) Requester

SanitizeRestoreRefreshTokenOriginalRequester returns a sanitized Requester carrying the original refresh token session's requested and granted scopes alongside the supplied requester's ID. It is used by refresh token handlers to preserve the lineage between an issued refresh token and its preceding access request.

func (*AccessRequest) SetGrantedScopes 

func (a *AccessRequest) SetGrantedScopes(scopes Arguments)

type AccessRequester 

type AccessRequester interface {
	// GetGrantTypes returns the requests grant type.
	GetGrantTypes() (grantTypes Arguments)

	Requester
}

AccessRequester is a token endpoint's request context.

type AccessResponder 

type AccessResponder interface {
	// SetExtra sets a key value pair for the access response.
	SetExtra(key string, value any)

	// GetExtra returns a key's value.
	GetExtra(key string) (extra any)

	SetExpiresIn(time.Duration)

	SetScopes(scopes Arguments)

	// SetAccessToken sets the responses mandatory access token.
	SetAccessToken(token string)

	// SetTokenType set's the responses mandatory token type.
	SetTokenType(tokenType string)

	// GetAccessToken returns the responses access token.
	GetAccessToken() (token string)

	// GetTokenType returns the responses token type.
	GetTokenType() (token string)

	// ToMap converts the response to a map.
	ToMap() (values map[string]any)
}

AccessResponder is a token endpoint's response.

type AccessResponse 

type AccessResponse struct {
	Extra       map[string]any
	AccessToken string
	TokenType   string
}

func NewAccessResponse 

func NewAccessResponse() *AccessResponse

NewAccessResponse returns an empty AccessResponse with its extra parameters map initialized.

func (*AccessResponse) GetAccessToken 

func (a *AccessResponse) GetAccessToken() string

GetAccessToken returns the access token value that will be returned to the client.

func (*AccessResponse) GetExtra 

func (a *AccessResponse) GetExtra(key string) any

GetExtra returns the value previously stored under key, or nil if no such value has been set.

func (*AccessResponse) GetTokenType 

func (a *AccessResponse) GetTokenType() string

GetTokenType returns the token type that will be returned to the client.

func (*AccessResponse) SetAccessToken 

func (a *AccessResponse) SetAccessToken(token string)

SetAccessToken sets the 'access_token' value returned to the client.

func (*AccessResponse) SetExpiresIn 

func (a *AccessResponse) SetExpiresIn(expiresIn time.Duration)

SetExpiresIn records the access token lifetime in seconds as the 'expires_in' response parameter.

func (*AccessResponse) SetExtra 

func (a *AccessResponse) SetExtra(key string, value any)

SetExtra sets an arbitrary key/value pair in the response. Use this to add extension parameters such as 'id_token' or 'refresh_token' to the JSON response body.

func (*AccessResponse) SetScopes 

func (a *AccessResponse) SetScopes(scopes Arguments)

SetScopes records the granted scopes as a space-separated 'scope' parameter on the response.

func (*AccessResponse) SetTokenType 

func (a *AccessResponse) SetTokenType(name string)

SetTokenType sets the 'token_type' value returned to the client (commonly 'Bearer').

func (*AccessResponse) ToMap 

func (a *AccessResponse) ToMap() map[string]any

ToMap returns the complete response payload as a map, including the access token, token type and all extra parameters. It mutates the underlying Extra map to include the access_token and token_type entries.

type AccessTokenIssuerProvider 

type AccessTokenIssuerProvider interface {
	// GetAccessTokenIssuer returns the access token issuer.
	GetAccessTokenIssuer(ctx context.Context) (issuer string)
}

AccessTokenIssuerProvider returns the provider for configuring the JWT issuer.

type AccessTokenLifespanProvider 

type AccessTokenLifespanProvider interface {
	// GetAccessTokenLifespan returns the access token lifespan.
	GetAccessTokenLifespan(ctx context.Context) (lifespan time.Duration)
}

AccessTokenLifespanProvider returns the provider for configuring the access token lifespan.

type AllowedIntrospectionAudiencesProvider added in v0.3.0 

type AllowedIntrospectionAudiencesProvider interface {
	// GetAllowedIntrospectionAudiences returns the permitted audience list for introspection authentication. The
	// Access Token must carry at least one of them. An empty list does not disable the check: it means the URL the
	// request was made to is expected instead. See BearerAuthorization for the full fallback chain.
	GetAllowedIntrospectionAudiences(ctx context.Context) (audiences []string)
}

AllowedIntrospectionAudiencesProvider is a provider used in contexts where the permitted audiences for an Access Token used to authenticate a request to the introspection endpoint is required to validate a request.

type AllowedIntrospectionScopesProvider added in v0.3.0 

type AllowedIntrospectionScopesProvider interface {
	// GetAllowedIntrospectionScopes returns the scopes an Access Token may carry to authenticate a request to the
	// introspection endpoint. The token must carry at least one of them. Defaults to consts.ScopeIntrospection.
	GetAllowedIntrospectionScopes(ctx context.Context) (scopes []string)
}

AllowedIntrospectionScopesProvider is a provider used in contexts where the required scopes for an Access Token used to authenticate a request to the introspection endpoint is required to validate a request.

type AllowedJWTAssertionAudiencesProvider added in v0.1.17 

type AllowedJWTAssertionAudiencesProvider interface {
	// GetAllowedJWTAssertionAudiences returns the permitted audience list for JWT Assertions.
	GetAllowedJWTAssertionAudiences(ctx context.Context) (audiences []string)

	// GetEnforceClientAssertionIssuerAudience returns whether a JWT client authentication assertion must carry the
	// issuer identifier as the sole value of its 'aud' claim, per draft-ietf-oauth-rfc7523bis Section 4. The
	// authorization grant is unaffected: the draft preserves the looser rule for it.
	GetEnforceClientAssertionIssuerAudience(ctx context.Context) (enforce bool)
}

AllowedJWTAssertionAudiencesProvider is a provider used in contexts where the permitted audiences for a JWT assertion is required to validate a request.

type AllowedPromptsProvider 

type AllowedPromptsProvider interface {
	// GetAllowedPrompts returns the allowed prompts.
	GetAllowedPrompts(ctx context.Context) (prompts []string)
}

AllowedPromptsProvider returns the provider for configuring the allowed prompts.

type Arguments 

type Arguments []string

func JoinGrantedAudienceAndResource added in v0.2.32 

func JoinGrantedAudienceAndResource(audience, resource Arguments) Arguments

JoinGrantedAudienceAndResource returns the concatenation of the granted audience and resource indicator values, deduplicated, for use as the 'aud' claim in tokens and introspection responses.

func (Arguments) ExactOne 

func (r Arguments) ExactOne(name string) bool

ExactOne checks, by string case, that a single argument equals the provided string.

func (Arguments) Has 

func (r Arguments) Has(items ...string) bool

Has checks, in a case-sensitive manner, that all of the items provided exists in arguments.

func (Arguments) HasFold 

func (r Arguments) HasFold(items ...string) bool

HasFold checks, in a case-insensitive manner, that all of the items provided exists in arguments.

func (Arguments) HasOneOf 

func (r Arguments) HasOneOf(items ...string) bool

HasOneOf checks, in a case-sensitive manner, that one of the items provided exists in arguments.

func (Arguments) HasOneOfFold 

func (r Arguments) HasOneOfFold(items ...string) bool

HasOneOfFold checks, in a case-sensitive manner, that one of the items provided exists in arguments.

func (Arguments) Matches 

func (r Arguments) Matches(items ...string) bool

Matches performs an case-sensitive, out-of-order check that the items provided exist and equal all of the args in arguments.

func (Arguments) MatchesExact 

func (r Arguments) MatchesExact(items ...string) bool

MatchesExact checks, by order and string case, that the items provided equal those in arguments.

func (Arguments) MatchesFold 

func (r Arguments) MatchesFold(items ...string) bool

MatchesFold performs an case-insensitive, out-of-order check that the items provided exist and equal all of the args in arguments. Note:

  • Providing a list that includes duplicate string-case items will return not matched.

type AudienceStrategy added in v0.2.34 

type AudienceStrategy func(haystack, needle []string) (err error)

AudienceStrategy matches requested audience values against the client's allowed audience list. It returns nil when every needle is permitted and an error otherwise.

func GetAudienceStrategy added in v0.2.34 

func GetAudienceStrategy(ctx context.Context, config AudienceStrategyProvider, client Client) (strategy AudienceStrategy)

GetAudienceStrategy resolves the AudienceStrategy to use for a request. If the client implements AudienceStrategyProvider and returns a non-nil strategy, the client's strategy is preferred over the global configuration. Otherwise the strategy from the provided config is used, falling back to DefaultAudienceStrategy when neither source supplies one.

type AudienceStrategyProvider 

type AudienceStrategyProvider interface {
	// GetAudienceStrategy returns the audience strategy.
	GetAudienceStrategy(ctx context.Context) (strategy AudienceStrategy)
}

AudienceStrategyProvider returns the provider for configuring the audience strategy.

type AuthenticationMethodClient added in v0.1.11 

type AuthenticationMethodClient interface {
	// GetTokenEndpointAuthMethod is equivalent to the 'token_endpoint_auth_method' client metadata value which
	// determines the requested Client Authentication method for the Token Endpoint. The options are client_secret_post,
	// client_secret_basic, client_secret_jwt, private_key_jwt, and none.
	GetTokenEndpointAuthMethod() (method string)

	// GetTokenEndpointAuthSigningAlg is equivalent to the 'token_endpoint_auth_signing_alg' client metadata value which
	// determines the JWS [JWS] alg algorithm [JWA] that MUST be used for signing the JWT [JWT] used to authenticate the
	// Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods.
	GetTokenEndpointAuthSigningAlg() (alg string)

	// GetIntrospectionEndpointAuthMethod is equivalent to the 'introspection_endpoint_auth_method' client metadata
	// value which determines the Client Authentication method for the Introspection Endpoint. The options are
	// client_secret_post, client_secret_basic, client_secret_jwt, private_key_jwt.
	GetIntrospectionEndpointAuthMethod() (method string)

	// GetIntrospectionEndpointAuthSigningAlg is equivalent to the 'introspection_endpoint_auth_signing_alg' client
	// metadata value which determines the JWS [JWS] alg algorithm [JWA] that MUST be used for signing the JWT [JWT]
	// used to authenticate the Client at the Introspection Endpoint for the private_key_jwt and client_secret_jwt
	// authentication methods.
	GetIntrospectionEndpointAuthSigningAlg() (alg string)

	// GetRevocationEndpointAuthMethod is equivalent to the 'revocation_endpoint_auth_method' client metadata value
	// which determines the Client Authentication method for the Revocation Endpoint. The options are
	// client_secret_post, client_secret_basic, client_secret_jwt, private_key_jwt.
	GetRevocationEndpointAuthMethod() (method string)

	// GetRevocationEndpointAuthSigningAlg is equivalent to the 'revocation_endpoint_auth_signing_alg' client metadata
	// value which determines the JWS [JWS] alg algorithm [JWA] that MUST be used for signing the JWT [JWT] used to
	// authenticate the Client at the Revocation Endpoint for the private_key_jwt and client_secret_jwt authentication
	// methods.
	GetRevocationEndpointAuthSigningAlg() (alg string)

	JSONWebKeysClient
}

AuthenticationMethodClient represents a client which has specific authentication methods.

type AuthorizationServerIssuerIdentificationProvider 

type AuthorizationServerIssuerIdentificationProvider interface {
	GetAuthorizationServerIdentificationIssuer(ctx context.Context) (issuer string)
}

AuthorizationServerIssuerIdentificationProvider provides OAuth 2.0 Authorization Server Issuer Identification related methods.

type AuthorizeCodeLifespanProvider 

type AuthorizeCodeLifespanProvider interface {
	// GetAuthorizeCodeLifespan returns the authorization code lifespan.
	GetAuthorizeCodeLifespan(ctx context.Context) (lifespan time.Duration)
}

AuthorizeCodeLifespanProvider returns the provider for configuring the authorization code lifespan.

type AuthorizeEndpointBindingHandler added in v0.3.0 

type AuthorizeEndpointBindingHandler interface {
	// BindAuthorizeRequest records any binding the request asserts. It returns nil both when it records one and
	// when there is nothing to record; any error rejects the request.
	BindAuthorizeRequest(ctx context.Context, request AuthorizeRequester) (err error)
}

AuthorizeEndpointBindingHandler records a proof-of-possession binding onto the session of an authorize request before any handler persists that session.

A binding handler augments a flow another handler owns; it never satisfies a request by itself. Handlers in a binding list write disjoint session fields, so their order within the list is not significant.

type AuthorizeEndpointBindingHandlers added in v0.3.0 

type AuthorizeEndpointBindingHandlers []AuthorizeEndpointBindingHandler

AuthorizeEndpointBindingHandlers is a list of AuthorizeEndpointBindingHandler

func (*AuthorizeEndpointBindingHandlers) Append added in v0.3.0 

func (a *AuthorizeEndpointBindingHandlers) Append(h AuthorizeEndpointBindingHandler)

Append adds an AuthorizeEndpointBindingHandler to this list. Ignores duplicates based on reflect.TypeOf.

type AuthorizeEndpointBindingHandlersProvider added in v0.3.0 

type AuthorizeEndpointBindingHandlersProvider interface {
	// GetAuthorizeEndpointBindingHandlers returns the authorize endpoint binding handlers.
	GetAuthorizeEndpointBindingHandlers(ctx context.Context) (handlers AuthorizeEndpointBindingHandlers)
}

AuthorizeEndpointBindingHandlersProvider returns the provider for configuring the authorize endpoint binding handlers.

type AuthorizeEndpointHandler 

type AuthorizeEndpointHandler interface {
	// HandleAuthorizeEndpointRequest handles an authorize endpoint request. To extend the handler's capabilities, the http request
	// is passed along, if further information retrieval is required. If the handler feels that he is not responsible for
	// the authorize request, he must return nil and NOT modify session nor responder neither requester.
	//
	// The following spec is a good example of what HandleAuthorizeRequest should do.
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.1
	//   response_type REQUIRED.
	//   The value MUST be one of "code" for requesting an
	//   authorization code as described by Section 4.1.1, "token" for
	//   requesting an access token (implicit grant) as described by
	//   Section 4.2.1, or a registered extension value as described by Section 8.4.
	HandleAuthorizeEndpointRequest(ctx context.Context, request AuthorizeRequester, response AuthorizeResponder) (err error)
}

type AuthorizeEndpointHandlers 

type AuthorizeEndpointHandlers []AuthorizeEndpointHandler

AuthorizeEndpointHandlers is a list of AuthorizeEndpointHandler

func (*AuthorizeEndpointHandlers) Append 

func (a *AuthorizeEndpointHandlers) Append(h AuthorizeEndpointHandler)

Append adds an AuthorizeEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type AuthorizeEndpointHandlersProvider 

type AuthorizeEndpointHandlersProvider interface {
	// GetAuthorizeEndpointHandlers returns the authorize endpoint handlers.
	GetAuthorizeEndpointHandlers(ctx context.Context) (handlers AuthorizeEndpointHandlers)
}

AuthorizeEndpointHandlersProvider returns the provider for configuring the authorize endpoint handlers.

type AuthorizeErrorFieldResponseStrategy added in v0.2.11 

type AuthorizeErrorFieldResponseStrategy interface {
	WriteErrorFieldResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, rfc *RFC6749Error)
}

type AuthorizeErrorFieldResponseStrategyProvider added in v0.2.11 

type AuthorizeErrorFieldResponseStrategyProvider interface {
	// GetAuthorizeErrorFieldResponseStrategy returns the AuthorizeErrorFieldResponseStrategy used to write authorization
	// endpoint errors directly to the response writer when no response_mode handler matches, such as when the user
	// cannot be safely redirected back to the client.
	GetAuthorizeErrorFieldResponseStrategy(ctx context.Context) (strategy AuthorizeErrorFieldResponseStrategy)
}

AuthorizeErrorFieldResponseStrategyProvider returns the provider for the strategy used to write authorization endpoint errors that cannot be delivered via a response_mode handler.

type AuthorizeRequest 

type AuthorizeRequest struct {
	ResponseTypes        Arguments        `json:"responseTypes" gorethink:"responseTypes"`
	RedirectURI          *url.URL         `json:"redirectUri" gorethink:"redirectUri"`
	State                string           `json:"state" gorethink:"state"`
	HandledResponseTypes Arguments        `json:"handledResponseTypes" gorethink:"handledResponseTypes"`
	ResponseMode         ResponseModeType `json:"ResponseModes" gorethink:"ResponseModes"`
	DefaultResponseMode  ResponseModeType `json:"DefaultResponseMode" gorethink:"DefaultResponseMode"`

	Request
}

AuthorizeRequest is an implementation of AuthorizeRequester

func NewAuthorizeRequest 

func NewAuthorizeRequest() *AuthorizeRequest

NewAuthorizeRequest returns an empty AuthorizeRequest with its response type slices initialized and the response mode set to ResponseModeDefault. The RedirectURI is intentionally left nil so callers can detect whether a redirect URI has actually been parsed from the request.

func (*AuthorizeRequest) DidHandleAllResponseTypes 

func (d *AuthorizeRequest) DidHandleAllResponseTypes() bool

DidHandleAllResponseTypes reports whether every requested response_type has been marked handled via SetResponseTypeHandled. It returns false when no response types were requested.

func (*AuthorizeRequest) GetDefaultResponseMode 

func (d *AuthorizeRequest) GetDefaultResponseMode() ResponseModeType

GetDefaultResponseMode returns the default response_mode derived from the response_type, used as a fallback when the client did not include an explicit response_mode parameter.

func (*AuthorizeRequest) GetRedirectURI 

func (d *AuthorizeRequest) GetRedirectURI() *url.URL

GetRedirectURI returns the parsed redirect URI for the request, or nil when the request did not include one or it has not yet been parsed.

func (*AuthorizeRequest) GetResponseMode 

func (d *AuthorizeRequest) GetResponseMode() ResponseModeType

GetResponseMode returns the response_mode requested by the client, or ResponseModeDefault when none was specified.

func (*AuthorizeRequest) GetResponseTypes 

func (d *AuthorizeRequest) GetResponseTypes() Arguments

GetResponseTypes returns the response_type values requested by the client.

func (*AuthorizeRequest) GetState 

func (d *AuthorizeRequest) GetState() string

GetState returns the 'state' parameter supplied by the client, used to prevent CSRF and round-trip per-client data.

func (*AuthorizeRequest) IsRedirectURIValid 

func (d *AuthorizeRequest) IsRedirectURIValid() bool

IsRedirectURIValid reports whether the request's redirect_uri matches one of the registered redirect URIs of the associated client and conforms to the redirect URI rules in RFC 6749 section 3.1.2. Returns false when either the redirect URI or client is unset.

func (*AuthorizeRequest) SetDefaultResponseMode 

func (d *AuthorizeRequest) SetDefaultResponseMode(defaultResponseMode ResponseModeType)

SetDefaultResponseMode records the default response mode for the given response_type. If the client did not request an explicit response_mode, the request's effective ResponseMode is also updated to the default.

func (*AuthorizeRequest) SetResponseTypeHandled 

func (d *AuthorizeRequest) SetResponseTypeHandled(name string)

SetResponseTypeHandled marks the given response type as handled by an authorize endpoint handler. Handlers must call this for every response_type value they fulfill so DidHandleAllResponseTypes can correctly detect a complete response.

type AuthorizeRequester 

type AuthorizeRequester interface {
	// GetResponseTypes returns the requested response types
	GetResponseTypes() (responseTypes Arguments)

	// SetResponseTypeHandled marks a response_type (e.g. token or code) as handled indicating that the response type
	// is supported.
	SetResponseTypeHandled(responseType string)

	// DidHandleAllResponseTypes returns if all requested response types have been handled correctly
	DidHandleAllResponseTypes() (didHandle bool)

	// GetRedirectURI returns the requested redirect URI.
	GetRedirectURI() (uri *url.URL)

	// IsRedirectURIValid returns false if the redirect is not rfc-conform (i.e. missing client, not on white list,
	// or malformed)
	IsRedirectURIValid() (isValid bool)

	// GetState returns the request's state.
	GetState() (state string)

	// GetResponseMode returns response_mode of the authorization request.
	GetResponseMode() (responseMode ResponseModeType)

	// SetDefaultResponseMode sets default response mode for a response type in a flow.
	SetDefaultResponseMode(responseMode ResponseModeType)

	// GetDefaultResponseMode gets default response mode for a response type in a flow.
	GetDefaultResponseMode() (responseMode ResponseModeType)

	Requester
}

AuthorizeRequester is an authorize endpoint's request context.

type AuthorizeResponder 

type AuthorizeResponder interface {
	// GetCode returns the response's authorize code if set.
	GetCode() (code string)

	// GetHeader returns the response's header.
	GetHeader() (header http.Header)

	// AddHeader adds a header key value pair to the response.
	AddHeader(key, value string)

	// GetParameters returns the response's parameters.
	GetParameters() (query url.Values)

	// AddParameter adds key value pair to the response.
	AddParameter(key, value string)
}

AuthorizeResponder is an authorization endpoint's response.

type AuthorizeResponse 

type AuthorizeResponse struct {
	Header     http.Header
	Parameters url.Values
	// contains filtered or unexported fields
}

AuthorizeResponse is an implementation of AuthorizeResponder

func NewAuthorizeResponse 

func NewAuthorizeResponse() *AuthorizeResponse

NewAuthorizeResponse returns an empty AuthorizeResponse with its Header and Parameters maps initialized.

func (*AuthorizeResponse) AddHeader 

func (a *AuthorizeResponse) AddHeader(key, value string)

AddHeader appends the value to the named response header.

func (*AuthorizeResponse) AddParameter 

func (a *AuthorizeResponse) AddParameter(key, value string)

AddParameter appends a key/value pair to the response parameters. The authorization 'code' parameter is captured separately so it can be accessed via GetCode for handler chaining.

func (*AuthorizeResponse) GetCode 

func (a *AuthorizeResponse) GetCode() string

GetCode returns the authorization code stored on the response, or the empty string if none has been added via AddParameter using the 'code' parameter name.

func (*AuthorizeResponse) GetHeader 

func (a *AuthorizeResponse) GetHeader() http.Header

GetHeader returns the response HTTP headers that will be written to the client.

func (*AuthorizeResponse) GetParameters 

func (a *AuthorizeResponse) GetParameters() url.Values

GetParameters returns the response parameters that will be encoded in the redirect URI, fragment, or form_post body depending on the negotiated response_mode.

type BCryptClientSecret 

type BCryptClientSecret struct {
	// contains filtered or unexported fields
}

func NewBCryptClientSecret 

func NewBCryptClientSecret(hash string) *BCryptClientSecret

NewBCryptClientSecret returns a new BCryptClientSecret given a hash.

func NewBCryptClientSecretPlain 

func NewBCryptClientSecretPlain(rawSecret string, cost int) (secret *BCryptClientSecret, err error)

NewBCryptClientSecretPlain returns a new BCryptClientSecret given a plaintext secret.

func (*BCryptClientSecret) Compare 

func (s *BCryptClientSecret) Compare(ctx context.Context, secret []byte) (err error)

func (*BCryptClientSecret) GetPlainTextValue 

func (s *BCryptClientSecret) GetPlainTextValue() (secret []byte, err error)

func (*BCryptClientSecret) IsPlainText 

func (s *BCryptClientSecret) IsPlainText() (is bool)

func (*BCryptClientSecret) Valid added in v0.1.10 

func (s *BCryptClientSecret) Valid() (valid bool)

type BackChannelLogoutClient added in v0.3.0 

type BackChannelLogoutClient interface {
	Client

	// GetBackChannelLogoutURI returns the client's registered back-channel logout URI. A client with none
	// registered does not participate in back-channel logout.
	GetBackChannelLogoutURI() (uri string)

	// GetBackChannelLogoutSessionRequired returns true when the client requires the 'sid' claim in the Logout
	// Token. When it does and no session identifier is available the client is not notified.
	GetBackChannelLogoutSessionRequired() (required bool)
}

BackChannelLogoutClient is a Client which has registered a back-channel logout URI for OpenID Connect Back-Channel Logout.

As with post_logout_redirect_uris, this library does not validate the registered backchannel_logout_uri's scheme, host, or exposure to SSRF; validating it at registration time is the integrator's responsibility.

See: https://openid.net/specs/openid-connect-backchannel-1_0.html

type BackChannelLogoutConcurrencyProvider added in v0.3.0 

type BackChannelLogoutConcurrencyProvider interface {
	// GetBackChannelLogoutConcurrency returns the maximum number of Back-Channel Logout requests delivered
	// concurrently. Defaults to 10.
	GetBackChannelLogoutConcurrency(ctx context.Context) (n int)
}

BackChannelLogoutConcurrencyProvider returns the provider for configuring how many Back-Channel Logout requests are delivered concurrently.

type BackChannelLogoutLifespanProvider added in v0.3.0 

type BackChannelLogoutLifespanProvider interface {
	// GetBackChannelLogoutLifespan returns the Logout Token lifespan. Defaults to 5 minutes.
	GetBackChannelLogoutLifespan(ctx context.Context) (lifespan time.Duration)
}

BackChannelLogoutLifespanProvider returns the provider for configuring the Logout Token lifespan.

type BackChannelLogoutRequest added in v0.3.0 

type BackChannelLogoutRequest struct {
	Subject   string
	SessionID string
	Clients   []Client
	Extra     map[string]any
}

BackChannelLogoutRequest is an implementation of BackChannelLogoutRequester.

func NewBackChannelLogoutRequest added in v0.3.0 

func NewBackChannelLogoutRequest(subject, sid string, clients []Client) (request *BackChannelLogoutRequest)

NewBackChannelLogoutRequest returns a BackChannelLogoutRequest with its map fields initialized.

A Logout Token must carry either a subject or a session identifier; supplying neither is an error at send time.

func (*BackChannelLogoutRequest) GetClients added in v0.3.0 

func (r *BackChannelLogoutRequest) GetClients() (clients []Client)

func (*BackChannelLogoutRequest) GetExtra added in v0.3.0 

func (r *BackChannelLogoutRequest) GetExtra() (extra map[string]any)

func (*BackChannelLogoutRequest) GetSessionID added in v0.3.0 

func (r *BackChannelLogoutRequest) GetSessionID() (sid string)

func (*BackChannelLogoutRequest) GetSubject added in v0.3.0 

func (r *BackChannelLogoutRequest) GetSubject() (subject string)

type BackChannelLogoutRequester added in v0.3.0 

type BackChannelLogoutRequester interface {
	// GetSubject returns the 'sub' claim for the Logout Token, empty if absent.
	GetSubject() (subject string)

	// GetSessionID returns the 'sid' claim for the Logout Token, empty if absent.
	GetSessionID() (sid string)

	// GetClients returns the clients to notify.
	GetClients() (clients []Client)

	// GetExtra returns additional claims to include in every Logout Token.
	GetExtra() (extra map[string]any)
}

BackChannelLogoutRequester is a request to deliver Logout Tokens to the Relying Parties participating in a session.

The caller supplies the clients: this library does not track which clients participated in a session.

See: https://openid.net/specs/openid-connect-backchannel-1_0.html

type BackChannelLogoutResult added in v0.3.0 

type BackChannelLogoutResult struct {
	// ClientID is the identifier of the client this result concerns.
	ClientID string

	// Skipped is true when the client was ineligible and no request was attempted.
	Skipped bool

	// Reason explains why the client was skipped. Empty when Skipped is false.
	Reason string

	// Status is the HTTP status code the Relying Party returned, zero when no response was received.
	Status int

	// Err is the signing or delivery failure for this client, nil on success.
	Err error
}

BackChannelLogoutResult is the outcome of delivering a Logout Token to a single Relying Party.

A result is reported for every client supplied, in the order supplied, including clients that were skipped.

func (BackChannelLogoutResult) Success added in v0.3.0 

func (r BackChannelLogoutResult) Success() (ok bool)

Success returns true when the Relying Party acknowledged the Logout Token.

type BackChannelLogoutTokenStrategy added in v0.3.0 

type BackChannelLogoutTokenStrategy interface {
	// GenerateBackChannelLogoutToken returns a signed Logout Token for the given client. The audience should
	// name exactly the client the token is delivered to, so that each Relying Party receives a token with its
	// own 'jti'.
	GenerateBackChannelLogoutToken(ctx context.Context, client Client, lifespan time.Duration, subject, sid string, audience []string, extra map[string]any) (token string, err error)
}

BackChannelLogoutTokenStrategy generates the Logout Tokens delivered to Relying Parties for OpenID Connect Back-Channel Logout 1.0.

See: https://openid.net/specs/openid-connect-backchannel-1_0.html

type BackChannelLogoutTokenStrategyProvider added in v0.3.0 

type BackChannelLogoutTokenStrategyProvider interface {
	// GetBackChannelLogoutTokenStrategy returns the Back-Channel Logout token strategy. Has no default and may
	// be nil.
	GetBackChannelLogoutTokenStrategy(ctx context.Context) (strategy BackChannelLogoutTokenStrategy)
}

BackChannelLogoutTokenStrategyProvider returns the provider for configuring the Back-Channel Logout token strategy, which generates the Logout Tokens delivered to Relying Parties.

type BearerAuthorization added in v0.3.0 

type BearerAuthorization struct {
	// Audiences are the permitted audiences. The credential must carry at least one. When empty the check falls back
	// to Endpoint, and then to RequestURL.
	Audiences []string

	// Endpoint is the configured absolute endpoint URL, used as the permitted audience when Audiences is empty.
	//
	// It exists so a deployment that has configured its endpoint URL does not depend on RequestURL, which is
	// reconstructed from the client-controlled Host header and X-Forwarded-Proto. Without it, a caller holding a
	// token audienced at some other origin could send a matching Host header and satisfy the check.
	//
	// Only the client registration endpoint has such a URL to supply. The introspection endpoint has none -
	// GetIntrospectionIssuer is the 'iss' claim of a JWT introspection response, not this endpoint's own URL - so it
	// leaves this empty and falls through from its configured list straight to RequestURL.
	Endpoint string

	// Scopes are the required scopes. The credential must carry at least one. Empty means no scope check; neither
	// shipped endpoint can reach that state, since both configuration accessors substitute a non-empty default. The
	// empty case exists for a deployment supplying its own Configurator that deliberately returns none.
	Scopes []string
}

BearerAuthorization is the per-endpoint policy a caller resolves from its own configuration and hands to ValidateBearerAuthorization. The values differ per endpoint, which is why they are parameters rather than another configuration interface: the shared code owns the checking, not the sourcing.

type BearerAuthorizationConfig added in v0.3.0 

type BearerAuthorizationConfig interface {
	DPoPConfigProvider
	MTLSConfigProvider
}

BearerAuthorizationConfig is the configuration ValidateBearerAuthorization depends on.

It names no ScopeStrategyProvider or AudienceStrategyProvider deliberately. An endpoint authorises a bearer credential by exact containment of a required scope and audience in the grant it already carries, never through a configured or client-supplied strategy - see validateBearerScope for why.

The whole of DPoPConfigProvider and MTLSConfigProvider is named rather than the individual accessors, because both the verification of a binding the credential carries and the enforcement of one it must carry are drawn from here: GetDPoPEnabled and GetMTLSEnabled decide whether a method participates at all, GetDPoPEnforce and GetMTLSEnforce decide whether an unbound credential is admitted, and the remainder configure the check itself.

type BestPracticeURIComparisonStrategy added in v0.2.18 

type BestPracticeURIComparisonStrategy struct{}

BestPracticeURIComparisonStrategy is used to compare URIs. This comparison strategy only matches based on exact simple string comparison.

func (BestPracticeURIComparisonStrategy) Compare added in v0.2.18 

func (BestPracticeURIComparisonStrategy) Compare(pair *uriPair) bool

func (BestPracticeURIComparisonStrategy) UseSimpleStringComparison added in v0.2.18 

func (BestPracticeURIComparisonStrategy) UseSimpleStringComparison() bool

type Client 

type Client interface {
	// GetID returns the client ID.
	GetID() (id string)

	// GetClientSecret returns the ClientSecret.
	GetClientSecret() (secret ClientSecret)

	// GetClientSecretPlainText returns the ClientSecret as plaintext if available. The semantics of this function
	// return values are important.
	// If the client is not configured with a secret the return should be:
	//   - secret with value nil, ok with value false, and err with value of nil
	// If the client is configured with a secret but is hashed or otherwise not a plaintext value:
	//   - secret with value nil, ok with value true, and err with value of nil
	// If an error occurs retrieving the secret other than this:
	//   - secret with value nil, ok with value true, and err with value of the error
	// If the plaintext secret is successful:
	//   - secret with value of the bytes of the plaintext secret, ok with value true, and err with value of nil
	GetClientSecretPlainText() (secret []byte, ok bool, err error)

	// GetRedirectURIs returns the client's allowed redirect URIs.
	GetRedirectURIs() []string

	// GetGrantTypes returns the client's allowed grant types.
	GetGrantTypes() (types Arguments)

	// GetResponseTypes returns the client's allowed response types.
	// All allowed combinations of response types have to be listed, each combination having
	// response types of the combination separated by a space.
	GetResponseTypes() (types Arguments)

	// GetScopes returns the scopes this client is allowed to request.
	GetScopes() (scopes Arguments)

	// IsPublic returns true, if this client is marked as public.
	IsPublic() (public bool)

	// GetAudience returns the allowed audience(s) for this client.
	GetAudience() (audience Arguments)
}

Client represents a client or an app.

type ClientAssertion added in v0.1.3 

type ClientAssertion struct {
	Assertion, Type       string
	Parsed                bool
	ID, Method, Algorithm string
	Client                Client
}

ClientAssertion represents a client assertion.

func NewClientAssertion added in v0.1.3 

func NewClientAssertion(ctx context.Context, strategyJWT jwt.Strategy, store ClientManager, assertion, assertionType string, strategy EndpointClientAuthStrategy) (a *ClientAssertion, err error)

NewClientAssertion converts a raw assertion string into a *ClientAssertion.

type ClientAssertionJWTValidationOptionsClient added in v0.2.18 

type ClientAssertionJWTValidationOptionsClient interface {
	GetClientAssertionJWTValidationHeaderAllowEmptyType() (allow bool)
	GetClientAssertionJWTValidationHeaderAllowTypes() (algs []string)

	Client
}

ClientAssertionJWTValidationOptionsClient allows extending the client assertion validation and strengthening the security posture of client assertion through strict typing.

type ClientAuthenticationPolicyClient 

type ClientAuthenticationPolicyClient interface {
	// GetAllowMultipleAuthenticationMethods should return true if the client policy allows multiple authentication
	// methods due to the client implementation breaching RFC6749 Section 2.3.
	//
	// See: https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.
	GetAllowMultipleAuthenticationMethods() (allow bool)

	Client
}

ClientAuthenticationPolicyClient is a Client implementation which also provides client authentication policy values.

type ClientAuthenticationStrategy 

type ClientAuthenticationStrategy interface {
	AuthenticateClient(ctx context.Context, r *http.Request, form url.Values, strategy EndpointClientAuthStrategy) (client Client, method string, err error)
}

ClientAuthenticationStrategy describes a client authentication strategy implementation.

type ClientAuthenticationStrategyProvider 

type ClientAuthenticationStrategyProvider interface {
	// GetClientAuthenticationStrategy returns the client authentication strategy.
	GetClientAuthenticationStrategy(ctx context.Context) (strategy ClientAuthenticationStrategy)
}

ClientAuthenticationStrategyProvider returns the provider for configuring the client authentication strategy.

type ClientConfigurationRequest added in v0.3.0 

type ClientConfigurationRequest struct {
	// Method is the HTTP method of the request, used to dispatch between read, update, and delete.
	Method string

	// ClientID is the client identifier taken from the request path.
	ClientID string

	// Metadata is the client metadata submitted by the client. It is nil for GET and DELETE requests.
	Metadata *ClientRegistrationMetadata

	// Authenticated is the requester authenticated by the endpoint's configured
	// ClientRegistrationEndpointAuthStrategy.
	Authenticated Requester

	// Signature is the signature of the registration access token presented at the endpoint, taken from the
	// authenticated requester's ID.
	Signature string

	*Request
}

ClientConfigurationRequest is an implementation of ClientConfigurationRequester.

func NewClientConfigurationRequest added in v0.3.0 

func NewClientConfigurationRequest() *ClientConfigurationRequest

NewClientConfigurationRequest returns an empty ClientConfigurationRequest with its embedded Request initialized.

func (*ClientConfigurationRequest) GetAuthenticatedRequester added in v0.3.0 

func (r *ClientConfigurationRequest) GetAuthenticatedRequester() (requester Requester)

GetAuthenticatedRequester returns the requester authenticated by the endpoint's configured ClientRegistrationEndpointAuthStrategy.

func (*ClientConfigurationRequest) GetClientID added in v0.3.0 

func (r *ClientConfigurationRequest) GetClientID() (id string)

GetClientID returns the client identifier taken from the request path.

func (*ClientConfigurationRequest) GetMetadata added in v0.3.0 

func (r *ClientConfigurationRequest) GetMetadata() (metadata *ClientRegistrationMetadata)

GetMetadata returns the client metadata submitted by the client. It is nil for GET and DELETE requests.

func (*ClientConfigurationRequest) GetMethod added in v0.3.0 

func (r *ClientConfigurationRequest) GetMethod() (method string)

GetMethod returns the HTTP method of the request, used to dispatch between read, update, and delete.

func (*ClientConfigurationRequest) GetSignature added in v0.3.0 

func (r *ClientConfigurationRequest) GetSignature() (signature string)

GetSignature returns the signature of the registration access token presented at the endpoint, taken from the authenticated requester's ID.

type ClientConfigurationRequester added in v0.3.0 

type ClientConfigurationRequester interface {
	// GetMethod returns the HTTP method of the request, used to dispatch between read, update, and delete.
	GetMethod() (method string)

	// GetClientID returns the client identifier taken from the request path.
	GetClientID() (id string)

	// GetMetadata returns the client metadata submitted by the client. It is nil for GET and DELETE requests.
	GetMetadata() (metadata *ClientRegistrationMetadata)

	// GetAuthenticatedRequester returns the requester authenticated by the endpoint's configured
	// ClientRegistrationEndpointAuthStrategy.
	GetAuthenticatedRequester() (requester Requester)

	// GetSignature returns the signature of the registration access token presented at the endpoint, taken from the
	// authenticated requester's ID.
	GetSignature() (signature string)

	Requester
}

ClientConfigurationRequester is the interface for a client configuration endpoint request, extended by the RFC 7592 client configuration endpoint.

See: https://datatracker.ietf.org/doc/html/rfc7592#section-2

type ClientConfigurationResponder added in v0.3.0 

type ClientConfigurationResponder = ClientRegistrationResponder

ClientConfigurationResponder is the response object for the RFC 7592 client configuration endpoint. It is the same shape as ClientRegistrationResponder because both endpoints return the same wire format.

type ClientCredentialsFlowRequestedScopeImplicitClient 

type ClientCredentialsFlowRequestedScopeImplicitClient interface {
	// GetClientCredentialsFlowRequestedScopeImplicit is indicative of if a client will implicitly request all scopes it
	// is allowed to request in the absence of requested scopes during the Client Credentials Flow.
	GetClientCredentialsFlowRequestedScopeImplicit() (implicit bool)

	Client
}

ClientCredentialsFlowRequestedScopeImplicitClient is a client which can allow implicit scopes in the client credentials flow.

type ClientCredentialsImplicitProvider 

type ClientCredentialsImplicitProvider interface {
	// GetClientCredentialsFlowImplicitGrantRequested returns true if the PopulateTokenEndpointResponse portion of the
	// oauth2.ClientCredentialsGrantHandler should implicitly grant all requested and validated scopes and audiences.
	GetClientCredentialsFlowImplicitGrantRequested(ctx context.Context) (implicit bool)
}

ClientCredentialsImplicitProvider describes the provider of the Client Credentials Flow Implicit actions.

type ClientIDIssuedAtClient added in v0.3.0 

type ClientIDIssuedAtClient interface {
	GetClientIDIssuedAt() (issued time.Time)

	Client
}

ClientIDIssuedAtClient extends Client interface by a method providing the time the client identifier was issued, being the RFC 7591 Section 3.2.1 'client_id_issued_at' value.

type ClientLifespanConfig 

type ClientLifespanConfig struct {
	AuthorizationCodeGrantAccessTokenLifespan  *time.Duration `json:"authorization_code_grant_access_token_lifespan"`
	AuthorizationCodeGrantIDTokenLifespan      *time.Duration `json:"authorization_code_grant_id_token_lifespan"`
	AuthorizationCodeGrantRefreshTokenLifespan *time.Duration `json:"authorization_code_grant_refresh_token_lifespan"`
	DeviceCodeGrantAccessTokenLifespan         *time.Duration `json:"device_code_grant_access_token_lifespan"`
	DeviceCodeGrantIDTokenLifespan             *time.Duration `json:"device_code_grant_id_token_lifespan"`
	DeviceCodeGrantRefreshTokenLifespan        *time.Duration `json:"device_code_grant_refresh_token_lifespan"`
	ClientCredentialsGrantAccessTokenLifespan  *time.Duration `json:"client_credentials_grant_access_token_lifespan"`
	ImplicitGrantAccessTokenLifespan           *time.Duration `json:"implicit_grant_access_token_lifespan"`
	ImplicitGrantIDTokenLifespan               *time.Duration `json:"implicit_grant_id_token_lifespan"`
	JwtBearerGrantAccessTokenLifespan          *time.Duration `json:"jwt_bearer_grant_access_token_lifespan"`
	PasswordGrantAccessTokenLifespan           *time.Duration `json:"password_grant_access_token_lifespan"`
	PasswordGrantRefreshTokenLifespan          *time.Duration `json:"password_grant_refresh_token_lifespan"`
	RefreshTokenGrantIDTokenLifespan           *time.Duration `json:"refresh_token_grant_id_token_lifespan"`
	RefreshTokenGrantAccessTokenLifespan       *time.Duration `json:"refresh_token_grant_access_token_lifespan"`
	RefreshTokenGrantRefreshTokenLifespan      *time.Duration `json:"refresh_token_grant_refresh_token_lifespan"`
}

ClientLifespanConfig holds default lifespan configuration for the different token types that may be issued for the client. This configuration takes precedence over instance-wide default lifespan, but it may be overridden by a session's expires_at claim.

The OIDC Hybrid grant type inherits token lifespan configuration from the implicit grant.

type ClientManager 

type ClientManager interface {
	// GetClient loads the client by its ID or returns an error
	// if the client does not exist or another error occurred.
	GetClient(ctx context.Context, id string) (client Client, err error)

	// ClientAssertionJWTValid returns an error if the JTI is
	// known or the DB check failed and nil if the JTI is not known.
	ClientAssertionJWTValid(ctx context.Context, jti string) (err error)

	// SetClientAssertionJWT marks a JTI as known for the given
	// expiry time. Before inserting the new JTI, it will clean
	// up any existing JTIs that have expired as those tokens can
	// not be replayed due to the expiry.
	SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) (err error)

	ClientRegistrationManager
}

ClientManager defines the (persistent) manager interface for clients.

type ClientRegistrationEndpointAuthStrategy added in v0.3.0 

type ClientRegistrationEndpointAuthStrategy interface {
	// AuthenticateClientRegistrationRequest authenticates the request and returns the Requester it authenticates as.
	// id is empty for client registration requests (RFC 7591), and carries the target client id for client
	// configuration requests (RFC 7592), letting the strategy verify the credential is authorized for that specific
	// client.
	//
	// An implementation may return a nil requester together with a nil error, which reports that the endpoint is open
	// and the request carries no authenticated identity - RFC 7591 Section 3.1 makes the initial access token optional,
	// "if authorization is required". Consumers must therefore treat a nil error as permission to proceed, not as a
	// promise of a requester, and check the requester before dereferencing it; the scope and audience ceilings derived
	// from it simply do not apply when there is none. Returning a non-nil error is what refuses a request.
	//
	// That open-endpoint return is valid ONLY for the client registration endpoint, i.e. when id is empty. RFC 7592
	// Section 2 requires that "The client MUST use its registration access token in all calls to this endpoint as an
	// OAuth 2.0 Bearer Token", so an implementation must never report the client configuration endpoint as open: the
	// client acted upon there is named by the request path, and its identifier is not a secret, so an unauthenticated
	// request would be able to read, replace, or delete any registered client. An implementation that wants open
	// registration must therefore branch on id and return an error when it is non-empty. NewRFC7592ClientConfiguration
	// Request rejects a nil requester regardless, so a strategy which does not branch fails closed rather than open.
	AuthenticateClientRegistrationRequest(ctx context.Context, r *http.Request, id string) (requester Requester, err error)
}

ClientRegistrationEndpointAuthStrategy authenticates requests made to the client registration and client configuration endpoints.

type ClientRegistrationManager added in v0.3.0 

type ClientRegistrationManager interface {
	// CreateClient persists a newly registered client. It must return an error if a client with the same ID
	// already exists.
	CreateClient(ctx context.Context, client Client) (err error)

	// UpdateClient persists changes to the client registered with the given ID. The ID is provided separately so
	// the store need not trust the client to expose an unchanged identifier. It must return an error if no client
	// with the given ID exists.
	UpdateClient(ctx context.Context, id string, client Client) (err error)

	// DeleteClient removes the client registered with the given ID. It must return an error if no client with the
	// given ID exists.
	DeleteClient(ctx context.Context, id string) (err error)
}

ClientRegistrationManager defines the (persistent) manager interface for dynamically registered clients. It is embedded in ClientManager so a store which does not support dynamic registration can return ErrNotFound from each method.

See: https://datatracker.ietf.org/doc/html/rfc7591 and https://datatracker.ietf.org/doc/html/rfc7592.

type ClientRegistrationMetadata added in v0.3.0 

type ClientRegistrationMetadata struct {
	RedirectURIs            []string            `json:"redirect_uris,omitempty"`
	TokenEndpointAuthMethod string              `json:"token_endpoint_auth_method,omitempty"`
	GrantTypes              []string            `json:"grant_types,omitempty"`
	ResponseTypes           []string            `json:"response_types,omitempty"`
	ClientName              string              `json:"client_name,omitempty"`
	ClientURI               string              `json:"client_uri,omitempty"`
	LogoURI                 string              `json:"logo_uri,omitempty"`
	Scope                   string              `json:"scope,omitempty"`
	Contacts                []string            `json:"contacts,omitempty"`
	TOSURI                  string              `json:"tos_uri,omitempty"`
	PolicyURI               string              `json:"policy_uri,omitempty"`
	JSONWebKeysURI          string              `json:"jwks_uri,omitempty"`
	JSONWebKeys             *jose.JSONWebKeySet `json:"jwks,omitempty"`
	SoftwareID              string              `json:"software_id,omitempty"`
	SoftwareStatement       string              `json:"software_statement,omitempty"`
	SoftwareVersion         string              `json:"software_version,omitempty"`

	ApplicationType              string   `json:"application_type,omitempty"`
	SectorIdentifierURI          string   `json:"sector_identifier_uri,omitempty"`
	SubjectType                  string   `json:"subject_type,omitempty"`
	IDTokenSignedResponseAlg     string   `json:"id_token_signed_response_alg,omitempty"`
	IDTokenEncryptedResponseAlg  string   `json:"id_token_encrypted_response_alg,omitempty"`
	IDTokenEncryptedResponseEnc  string   `json:"id_token_encrypted_response_enc,omitempty"`
	UserinfoSignedResponseAlg    string   `json:"userinfo_signed_response_alg,omitempty"`
	UserinfoEncryptedResponseAlg string   `json:"userinfo_encrypted_response_alg,omitempty"`
	UserinfoEncryptedResponseEnc string   `json:"userinfo_encrypted_response_enc,omitempty"`
	RequestObjectSigningAlg      string   `json:"request_object_signing_alg,omitempty"`
	RequestObjectEncryptionAlg   string   `json:"request_object_encryption_alg,omitempty"`
	RequestObjectEncryptionEnc   string   `json:"request_object_encryption_enc,omitempty"`
	TokenEndpointAuthSigningAlg  string   `json:"token_endpoint_auth_signing_alg,omitempty"`
	DefaultMaxAge                *int64   `json:"default_max_age,omitempty"`
	RequireAuthTime              bool     `json:"require_auth_time,omitempty"`
	DefaultACRValues             []string `json:"default_acr_values,omitempty"`
	InitiateLoginURI             string   `json:"initiate_login_uri,omitempty"`
	RequestURIs                  []string `json:"request_uris,omitempty"`

	RequireSignedRequestObject bool `json:"require_signed_request_object,omitempty"`

	PostLogoutRedirectURIs           []string `json:"post_logout_redirect_uris,omitempty"`
	BackChannelLogoutURI             string   `json:"backchannel_logout_uri,omitempty"`
	BackChannelLogoutSessionRequired bool     `json:"backchannel_logout_session_required,omitempty"`

	TokenExchangeSubjectTokenTypes  []string `json:"token_exchange_subject_token_types,omitempty"`
	TokenExchangeActorTokenTypes    []string `json:"token_exchange_actor_token_types,omitempty"`
	TokenExchangeRequestTokenTypes  []string `json:"token_exchange_request_token_types,omitempty"`
	TokenExchangePermittedClientIDs []string `json:"token_exchange_permitted_client_ids,omitempty"`

	TLSClientAuthSubjectDN                string `json:"tls_client_auth_subject_dn,omitempty"`
	TLSClientAuthSANDNS                   string `json:"tls_client_auth_san_dns,omitempty"`
	TLSClientAuthSANURI                   string `json:"tls_client_auth_san_uri,omitempty"`
	TLSClientAuthSANIP                    string `json:"tls_client_auth_san_ip,omitempty"`
	TLSClientAuthSANEmail                 string `json:"tls_client_auth_san_email,omitempty"`
	TLSClientCertificateBoundAccessTokens bool   `json:"tls_client_certificate_bound_access_tokens,omitempty"`

	IDTokenSignedResponseKeyID          string   `json:"id_token_signed_response_kid,omitempty"`
	IDTokenEncryptedResponseKeyID       string   `json:"id_token_encrypted_response_kid,omitempty"`
	UserinfoSignedResponseKeyID         string   `json:"userinfo_signed_response_kid,omitempty"`
	UserinfoEncryptedResponseKeyID      string   `json:"userinfo_encrypted_response_kid,omitempty"`
	RequestObjectSigningKeyID           string   `json:"request_object_signing_kid,omitempty"`
	RequestObjectEncryptionKeyID        string   `json:"request_object_encryption_kid,omitempty"`
	AuthorizationSignedResponseKeyID    string   `json:"authorization_signed_response_kid,omitempty"`
	AuthorizationSignedResponseAlg      string   `json:"authorization_signed_response_alg,omitempty"`
	AuthorizationEncryptedResponseKeyID string   `json:"authorization_encrypted_response_kid,omitempty"`
	AuthorizationEncryptedResponseAlg   string   `json:"authorization_encrypted_response_alg,omitempty"`
	AuthorizationEncryptedResponseEnc   string   `json:"authorization_encrypted_response_enc,omitempty"`
	IntrospectionSignedResponseKeyID    string   `json:"introspection_signed_response_kid,omitempty"`
	IntrospectionSignedResponseAlg      string   `json:"introspection_signed_response_alg,omitempty"`
	IntrospectionEncryptedResponseKeyID string   `json:"introspection_encrypted_response_kid,omitempty"`
	IntrospectionEncryptedResponseAlg   string   `json:"introspection_encrypted_response_alg,omitempty"`
	IntrospectionEncryptedResponseEnc   string   `json:"introspection_encrypted_response_enc,omitempty"`
	AccessTokenSignedResponseKeyID      string   `json:"access_token_signed_response_kid,omitempty"`
	AccessTokenSignedResponseAlg        string   `json:"access_token_signed_response_alg,omitempty"`
	AccessTokenEncryptedResponseKeyID   string   `json:"access_token_encrypted_response_kid,omitempty"`
	AccessTokenEncryptedResponseAlg     string   `json:"access_token_encrypted_response_alg,omitempty"`
	AccessTokenEncryptedResponseEnc     string   `json:"access_token_encrypted_response_enc,omitempty"`
	IntrospectionEndpointAuthMethod     string   `json:"introspection_endpoint_auth_method,omitempty"`
	IntrospectionEndpointAuthSigningAlg string   `json:"introspection_endpoint_auth_signing_alg,omitempty"`
	RevocationEndpointAuthMethod        string   `json:"revocation_endpoint_auth_method,omitempty"`
	RevocationEndpointAuthSigningAlg    string   `json:"revocation_endpoint_auth_signing_alg,omitempty"`
	RequirePushedAuthorizationRequests  bool     `json:"require_pushed_authorization_requests,omitempty"`
	DPoPBoundAccessTokens               bool     `json:"dpop_bound_access_tokens,omitempty"`
	ResponseModes                       []string `json:"response_modes,omitempty"`
	Audience                            []string `json:"audience,omitempty"`

	// Extra holds every unregistered client metadata parameter so it survives a registration round trip.
	Extra map[string]any `json:"-"`
}

ClientRegistrationMetadata is the client metadata wire format used by OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591), OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592), and OpenID Connect Dynamic Client Registration 1.0. It is the union of every client metadata parameter defined by those specifications together with the values this codebase already models on its own client interfaces (see client.go). Any parameter not recognized by one of the typed fields below is preserved in Extra so it survives a decode/encode round trip.

func (*ClientRegistrationMetadata) GetScopes added in v0.3.0 

func (m *ClientRegistrationMetadata) GetScopes() (scopes Arguments)

GetScopes returns the 'scope' value as space-delimited Arguments.

func (*ClientRegistrationMetadata) MarshalJSON added in v0.3.0 

func (m *ClientRegistrationMetadata) MarshalJSON() (data []byte, err error)

MarshalJSON encodes the registered parameters and merges the unregistered parameters held in Extra. A value in Extra never overwrites a registered parameter.

func (*ClientRegistrationMetadata) UnmarshalJSON added in v0.3.0 

func (m *ClientRegistrationMetadata) UnmarshalJSON(data []byte) (err error)

UnmarshalJSON decodes the registered client metadata parameters into their typed fields and preserves every unregistered parameter in Extra so it survives a registration round trip.

type ClientRegistrationMetadataStrategy added in v0.3.0 

type ClientRegistrationMetadataStrategy interface {
	// FilterClientRegistrationMetadata adjusts metadata in place. client is nil on a client registration request,
	// and the existing client on a client configuration request. Returning an error aborts the request, so an
	// implementation preferring to reject unsupported metadata rather than remove it may return one wrapping
	// ErrInvalidClientMetadata.
	FilterClientRegistrationMetadata(ctx context.Context, client Client, metadata *ClientRegistrationMetadata) (err error)
}

ClientRegistrationMetadataStrategy normalizes client registration metadata before it reaches ClientRegistrationStrategy, and before metadata rendered from a client is returned to that client. It is the seam a deployment uses to decide which client metadata it is willing to honour, such as withholding the RFC 8705 mutual-TLS values when mutual-TLS handling is disabled.

type ClientRegistrationRequest added in v0.3.0 

type ClientRegistrationRequest struct {
	// Metadata is the client metadata submitted by the client.
	Metadata *ClientRegistrationMetadata

	// Authenticated is the requester authenticated by the endpoint's configured
	// ClientRegistrationEndpointAuthStrategy, or nil when the endpoint does not require authentication.
	Authenticated Requester

	*Request
}

ClientRegistrationRequest is an implementation of ClientRegistrationRequester.

func NewClientRegistrationRequest added in v0.3.0 

func NewClientRegistrationRequest() *ClientRegistrationRequest

NewClientRegistrationRequest returns an empty ClientRegistrationRequest with its embedded Request initialized.

func (*ClientRegistrationRequest) GetAuthenticatedRequester added in v0.3.0 

func (r *ClientRegistrationRequest) GetAuthenticatedRequester() (requester Requester)

GetAuthenticatedRequester returns the requester authenticated by the endpoint's configured ClientRegistrationEndpointAuthStrategy, or nil when the endpoint does not require authentication.

func (*ClientRegistrationRequest) GetMetadata added in v0.3.0 

func (r *ClientRegistrationRequest) GetMetadata() (metadata *ClientRegistrationMetadata)

GetMetadata returns the client metadata submitted by the client.

type ClientRegistrationRequester added in v0.3.0 

type ClientRegistrationRequester interface {
	// GetMetadata returns the client metadata submitted by the client.
	GetMetadata() (metadata *ClientRegistrationMetadata)

	// GetAuthenticatedRequester returns the requester authenticated by the endpoint's configured
	// ClientRegistrationEndpointAuthStrategy, or nil when the endpoint does not require authentication.
	GetAuthenticatedRequester() (requester Requester)

	Requester
}

ClientRegistrationRequester is the interface for a client registration endpoint request, extended by the RFC 7591 client registration endpoint.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3

type ClientRegistrationResponder added in v0.3.0 

type ClientRegistrationResponder interface {
	// SetMetadata sets the client metadata to be returned to the client.
	SetMetadata(metadata *ClientRegistrationMetadata)

	// GetMetadata returns the client metadata to be returned to the client.
	GetMetadata() (metadata *ClientRegistrationMetadata)

	// SetClientID sets the 'client_id' value.
	SetClientID(id string)

	// SetClientSecret sets the 'client_secret' value. An empty value omits both 'client_secret' and
	// 'client_secret_expires_at' from ToMap.
	SetClientSecret(secret string)

	// SetClientIDIssuedAt sets the 'client_id_issued_at' value. A zero value omits 'client_id_issued_at' from ToMap
	// entirely, since RFC 7591 defines no zero sentinel for this OPTIONAL field.
	SetClientIDIssuedAt(issued time.Time)

	// SetClientSecretExpiresAt sets the 'client_secret_expires_at' value. A zero value indicates the secret does not
	// expire and is reported as 0 per RFC 7591 Section 3.2.1.
	SetClientSecretExpiresAt(expires time.Time)

	// SetRegistrationAccessToken sets the 'registration_access_token' value.
	SetRegistrationAccessToken(token string)

	// SetRegistrationClientURI sets the 'registration_client_uri' value.
	SetRegistrationClientURI(uri string)

	// SetStatusCode sets the HTTP status code the response should be written with.
	SetStatusCode(code int)

	// GetStatusCode returns the HTTP status code the response should be written with.
	GetStatusCode() (code int)

	// GetHeader returns the HTTP headers to be written with the response.
	GetHeader() (header http.Header)

	// AddHeader adds an HTTP header to be written with the response.
	AddHeader(key, value string)

	// ToMap marshals the metadata and overlays the registration values, keyed by their wire names. Timestamps are
	// emitted as int64 Unix seconds. 'client_id_issued_at' is omitted entirely when unset, since RFC 7591 defines no
	// zero sentinel for that OPTIONAL field. The 'client_secret' and 'client_secret_expires_at' values are omitted
	// entirely when there is no client secret. Every key ToMap is responsible for is deterministically controlled by
	// the server: it is either always set or explicitly deleted, so an unregistered 'Extra' metadata parameter of the
	// same name submitted by the client can never survive into the response in its place.
	ToMap() (values map[string]any)
}

ClientRegistrationResponder is the response object for the RFC 7591 client registration endpoint and the RFC 7592 client configuration endpoint.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1 and https://datatracker.ietf.org/doc/html/rfc7592#section-3

type ClientRegistrationResponse added in v0.3.0 

type ClientRegistrationResponse struct {
	Metadata                *ClientRegistrationMetadata
	ClientID                string
	ClientSecret            string
	ClientIDIssuedAt        time.Time
	ClientSecretExpiresAt   time.Time
	RegistrationAccessToken string
	RegistrationClientURI   string
	StatusCode              int
	Header                  http.Header
}

ClientRegistrationResponse is an implementation of ClientRegistrationResponder.

func NewClientRegistrationResponse added in v0.3.0 

func NewClientRegistrationResponse() *ClientRegistrationResponse

NewClientRegistrationResponse returns an empty ClientRegistrationResponse with its status code set to http.StatusOK and its header initialized.

func (*ClientRegistrationResponse) AddHeader added in v0.3.0 

func (r *ClientRegistrationResponse) AddHeader(key, value string)

AddHeader adds an HTTP header to be written with the response.

func (*ClientRegistrationResponse) GetHeader added in v0.3.0 

func (r *ClientRegistrationResponse) GetHeader() (header http.Header)

GetHeader returns the HTTP headers to be written with the response.

func (*ClientRegistrationResponse) GetMetadata added in v0.3.0 

func (r *ClientRegistrationResponse) GetMetadata() (metadata *ClientRegistrationMetadata)

GetMetadata returns the client metadata to be returned to the client.

func (*ClientRegistrationResponse) GetStatusCode added in v0.3.0 

func (r *ClientRegistrationResponse) GetStatusCode() (code int)

GetStatusCode returns the HTTP status code the response should be written with.

func (*ClientRegistrationResponse) SetClientID added in v0.3.0 

func (r *ClientRegistrationResponse) SetClientID(id string)

SetClientID sets the 'client_id' value.

func (*ClientRegistrationResponse) SetClientIDIssuedAt added in v0.3.0 

func (r *ClientRegistrationResponse) SetClientIDIssuedAt(issued time.Time)

SetClientIDIssuedAt sets the 'client_id_issued_at' value. A zero value omits 'client_id_issued_at' from ToMap entirely, since RFC 7591 defines no zero sentinel for this OPTIONAL field.

func (*ClientRegistrationResponse) SetClientSecret added in v0.3.0 

func (r *ClientRegistrationResponse) SetClientSecret(secret string)

SetClientSecret sets the 'client_secret' value.

func (*ClientRegistrationResponse) SetClientSecretExpiresAt added in v0.3.0 

func (r *ClientRegistrationResponse) SetClientSecretExpiresAt(expires time.Time)

SetClientSecretExpiresAt sets the 'client_secret_expires_at' value.

func (*ClientRegistrationResponse) SetMetadata added in v0.3.0 

func (r *ClientRegistrationResponse) SetMetadata(metadata *ClientRegistrationMetadata)

SetMetadata sets the client metadata to be returned to the client.

func (*ClientRegistrationResponse) SetRegistrationAccessToken added in v0.3.0 

func (r *ClientRegistrationResponse) SetRegistrationAccessToken(token string)

SetRegistrationAccessToken sets the 'registration_access_token' value.

func (*ClientRegistrationResponse) SetRegistrationClientURI added in v0.3.0 

func (r *ClientRegistrationResponse) SetRegistrationClientURI(uri string)

SetRegistrationClientURI sets the 'registration_client_uri' value.

func (*ClientRegistrationResponse) SetStatusCode added in v0.3.0 

func (r *ClientRegistrationResponse) SetStatusCode(code int)

SetStatusCode sets the HTTP status code the response should be written with.

func (*ClientRegistrationResponse) ToMap added in v0.3.0 

func (r *ClientRegistrationResponse) ToMap() (values map[string]any)

ToMap marshals the metadata through json.Marshal into a map[string]any and overlays the registration values on top, keyed by the consts.ClientRegistrationResponse* constants. 'client_secret_expires_at' is emitted as an int64 Unix seconds value, and a zero ClientSecretExpiresAt emits 0, which per RFC 7591 Section 3.2.1 means the secret does not expire. 'client_id_issued_at' is also emitted as an int64 Unix seconds value when set, but is omitted entirely when zero since RFC 7591 defines no zero sentinel for that OPTIONAL field. Both 'client_secret' and 'client_secret_expires_at' are omitted entirely when there is no client secret.

Every key overlaid here is deterministically controlled by the server: it is either always set unconditionally (which is enough to override anything of the same name decoded from Metadata's Extra) or, when it may be omitted, explicitly deleted first. This matters because none of these keys are registered ClientRegistrationMetadata fields, so a client that submits e.g. 'client_secret' or 'client_id_issued_at' as an unrecognized metadata parameter has it land in Extra, which MarshalJSON merges into the map above. Without the delete, an omitted server-controlled value would silently let that client-submitted value survive into the response.

type ClientRegistrationStrategy added in v0.3.0 

type ClientRegistrationStrategy interface {
	// NewClient constructs a new concrete Client from the given id, secret, and metadata. The secret is provided
	// pre-generated so callers can control its format and control the plaintext value returned to the client.
	NewClient(ctx context.Context, id string, secret ClientSecret, metadata *ClientRegistrationMetadata) (client Client, err error)

	// PatchClient applies the complete metadata set onto an existing concrete Client, implementing the full
	// replacement semantics of RFC 7592 Section 2.2: values absent from the metadata revert to their default or are
	// removed. It is not a merge. A nil secret leaves the existing client secret untouched.
	PatchClient(ctx context.Context, client Client, secret ClientSecret, metadata *ClientRegistrationMetadata) (patched Client, err error)

	// MetadataFromClient converts a concrete Client back into its RFC 7591 / RFC 7592 metadata representation, as
	// returned by the client registration and client configuration endpoints.
	MetadataFromClient(ctx context.Context, client Client) (metadata *ClientRegistrationMetadata, err error)
}

ClientRegistrationStrategy constructs and patches concrete Client values from RFC 7591 / RFC 7592 client registration metadata, and converts a concrete Client back into that metadata.

type ClientRegistrationValidator added in v0.3.0 

type ClientRegistrationValidator interface {
	// ValidateClientRegistrationMetadata validates metadata submitted for the given client, returning an error
	// (typically wrapping ErrInvalidClientMetadata) when the metadata is invalid. client is nil on a client
	// registration request, and the existing client on a client configuration request.
	ValidateClientRegistrationMetadata(ctx context.Context, client Client, metadata *ClientRegistrationMetadata) (err error)
}

ClientRegistrationValidator validates submitted client registration metadata beyond what parsing and type coercion already enforce, such as cross-field consistency and deployment-specific policy.

type ClientSecret 

type ClientSecret interface {
	// Compare is the primary function of the interface which is used to compare this ClientSecret to the form input.
	// This function SHOULD return nil if the secret input matches the expected value, otherwise it should return an
	// error.
	Compare(ctx context.Context, secret []byte) (err error)

	// IsPlainText is a utility function to determine if this secret is in a plaintext format making it usable for the
	// client_secret_jwt authentication method.
	IsPlainText() (is bool)

	// GetPlainTextValue is a utility function to return the secret in the plaintext format making it usable for the
	// client_secret_jwt authentication method. If the client secret doesn't have a value that is plaintext it should
	// return oauth2.ErrClientSecretNotPlainText for the sake of deterministic error values.
	GetPlainTextValue() (secret []byte, err error)

	// Valid should return false if the secret is nil or otherwise invalid.
	Valid() (valid bool)
}

ClientSecret is a service interface for client secret comparisons and functionality.

type Config 

type Config struct {
	// AccessTokenLifespan sets how long an access token is going to be valid. Defaults to one hour.
	AccessTokenLifespan time.Duration

	// VerifiableCredentialsNonceLifespan sets how long a verifiable credentials nonce is going to be valid. Defaults to one hour.
	VerifiableCredentialsNonceLifespan time.Duration

	// RefreshTokenLifespan sets how long a refresh token is going to be valid. Defaults to 30 days. Set to -1 for
	// refresh tokens that never expire.
	RefreshTokenLifespan time.Duration

	// AuthorizeCodeLifespan sets how long an authorize code is going to be valid. Defaults to fifteen minutes.
	AuthorizeCodeLifespan time.Duration

	// IDTokenLifespan sets the default id token lifetime. Defaults to one hour.
	IDTokenLifespan time.Duration

	// Sets how long a device user/device code pair is valid for
	RFC8628CodeLifespan time.Duration

	// IDTokenIssuer sets the default issuer of the ID Token.
	IDTokenIssuer string

	// AccessTokenIssuer is the issuer to be used when generating access tokens.
	AccessTokenIssuer string

	// 	AuthorizationServerIdentificationIssuer string sets the issuer identifier for authorization responses (RFC9207).
	AuthorizationServerIdentificationIssuer string

	// IntrospectionIssuer is the issuer to be used when generating signed introspection responses.
	IntrospectionIssuer string

	// IntrospectionJWTResponseStrategy is the signer for Introspection Responses. Has no default.
	IntrospectionJWTResponseStrategy jwt.Strategy

	// IDTokenValidationStrategy validates ID Tokens presented to the authorization server by a client, such as the
	// 'id_token_hint' of an RP-Initiated Logout request. Has no default.
	IDTokenValidationStrategy TokenValidationStrategy

	// BackChannelLogoutTokenStrategy generates the Logout Tokens delivered to Relying Parties for OpenID
	// Connect Back-Channel Logout. Has no default.
	BackChannelLogoutTokenStrategy BackChannelLogoutTokenStrategy

	// BackChannelLogoutLifespan is the lifespan of a Logout Token. Defaults to 5 minutes.
	BackChannelLogoutLifespan time.Duration

	// BackChannelLogoutConcurrency is the maximum number of Back-Channel Logout requests delivered
	// concurrently. Defaults to 10.
	BackChannelLogoutConcurrency int

	// HashCost sets the cost of the password hashing cost. Defaults to 12.
	HashCost int

	// DisableRefreshTokenValidation sets the introspection endpoint to disable refresh token validation.
	DisableRefreshTokenValidation bool

	// DisableRefreshTokenRotation keeps the presented refresh token during the refresh token grant rather than issuing
	// a new one. The refresh token keeps the expiry it was issued with, and access tokens previously issued for the
	// grant are revoked. FAPI 2.0 Security Profile Section 5.3.2.1 permits rotation only in extraordinary circumstances.
	DisableRefreshTokenRotation bool

	// SendDebugMessagesToClients if set to true, includes error debug messages in response payloads. Be aware that sensitive
	// data may be exposed, depending on your implementation of Fosite. Such sensitive data might include database error
	// codes or other information. Proceed with caution!
	SendDebugMessagesToClients bool

	// RevokeRefreshTokensExplicit determines if Refresh Tokens should only be revoked explicitly.
	RevokeRefreshTokensExplicit bool

	// EnforceRevokeFlowRevokeRefreshTokensExplicitClient determines if a RevokeFlowRevokeRefreshTokensExplicitClient
	// should be prioritized even if it returns false.
	EnforceRevokeFlowRevokeRefreshTokensExplicitClient bool

	// ScopeStrategy sets the scope strategy that should be supported, for example oauth2.WildcardScopeStrategy.
	ScopeStrategy ScopeStrategy

	// AudienceStrategy sets the audience matching strategy that should be supported, defaults to oauth2.ExactAudienceStrategy.
	AudienceStrategy AudienceStrategy

	// ResourceStrategy sets the RFC 8707 resource indicator matching strategy, defaults to oauth2.DefaultAudienceStrategy.
	ResourceStrategy ResourceStrategy

	ClientCredentialsFlowImplicitGrantRequested bool

	// EnforcePKCE, if set to true, requires clients to perform authorize code flows with PKCE. Defaults to false.
	EnforcePKCE bool

	// EnforcePKCEForPublicClients requires only public clients to use PKCE with the authorize code flow. Defaults to false.
	EnforcePKCEForPublicClients bool

	// EnablePKCEPlainChallengeMethod sets whether or not to allow the plain challenge method (S256 should be used whenever possible, plain is really discouraged). Defaults to false.
	EnablePKCEPlainChallengeMethod bool

	// AllowedPromptValues sets which OpenID Connect prompt values the server supports. Defaults to []string{"login", "none", "consent", "select_account"}.
	AllowedPromptValues []string

	// EnforceClientAssertionIssuerAudience requires a JWT client authentication assertion to carry the issuer
	// identifier as the sole value of its 'aud' claim. See GetEnforceClientAssertionIssuerAudience.
	EnforceClientAssertionIssuerAudience bool

	// AllowedJWTAssertionAudiences is a list of permitted client assertion audiences. If the authorization server is
	// intended to be compatible with the client_secret_jwt or private_key_jwt client authentication methods
	// (see http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth), this value MUST be set.
	AllowedJWTAssertionAudiences []string

	// AllowedIntrospectionAudiences is a list of audiences permitted for an Access Token used to authenticate a request
	// to the introspection endpoint. Such an Access Token MUST have at least one of these values within its granted
	// audience or granted RFC 8707 resource indicators. Defaults to empty, which does not disable the check: it means
	// the URL the request was made to is expected instead.
	AllowedIntrospectionAudiences []string

	// AllowedIntrospectionScopes is a list of scopes permitted for an Access Token used to authenticate a request to
	// the introspection endpoint. Such an Access Token MUST have at least one of these values within its granted
	// scopes. Defaults to consts.ScopeIntrospection.
	AllowedIntrospectionScopes []string

	// JWKSFetcherStrategy is responsible for fetching JSON Web Keys from remote URLs. This is required when the private_key_jwt
	// client authentication method is used. Defaults to oauth2.DefaultJWKSFetcherStrategy.
	JWKSFetcherStrategy jwt.JWKSFetcherStrategy

	// TokenEntropy indicates the entropy of the random string, used as the "message" part of the HMAC token.
	// Defaults to 32.
	TokenEntropy int

	// RFC8628UserVerificationURL is the URL of the device verification endpoint, this is is included with the device code request responses
	RFC8628UserVerificationURL string

	// RFC8628TokenPollingInterval sets the interval that clients should check for device code grants
	RFC8628TokenPollingInterval time.Duration

	// RedirectSecureChecker is a function that returns true if the provided URL can be securely used as a redirect URL.
	RedirectSecureChecker func(context.Context, *url.URL) bool

	// RefreshTokenScopes defines which OAuth scopes will be given refresh tokens during the authorization code grant exchange. This defaults to "offline" and "offline_access". When set to an empty array, all exchanges will be given refresh tokens.
	RefreshTokenScopes []string

	// MinParameterEntropy controls the minimum size of state and nonce parameters. Defaults to oauth2.MinParameterEntropy.
	MinParameterEntropy int

	// UseLegacyErrorFormat controls whether the legacy error format (with `error_debug`, `error_hint`, ...)
	// should be used or not.
	UseLegacyErrorFormat bool

	// GrantTypeJWTBearerCanSkipClientAuth indicates, if client authentication can be skipped, when using jwt as assertion.
	GrantTypeJWTBearerCanSkipClientAuth bool

	// GrantTypeJWTBearerIDOptional indicates, if jti (JWT ID) claim required or not in JWT.
	GrantTypeJWTBearerIDOptional bool

	// GrantTypeJWTBearerIssuedDateOptional indicates, if "iat" (issued at) claim required or not in JWT.
	GrantTypeJWTBearerIssuedDateOptional bool

	// GrantTypeJWTBearerMaxDuration sets the maximum time after JWT issued date, during which the JWT is considered valid.
	GrantTypeJWTBearerMaxDuration time.Duration

	// ClientAuthenticationStrategy indicates the Strategy to authenticate client requests
	ClientAuthenticationStrategy ClientAuthenticationStrategy

	// TokenEndpointClientAuthStrategy indicates the EndpointClientAuthStrategy used to authenticate clients at the token
	// endpoint. Defaults to a TokenEndpointClientAuthStrategy.
	TokenEndpointClientAuthStrategy EndpointClientAuthStrategy

	// IntrospectionEndpointClientAuthStrategy indicates the EndpointClientAuthStrategy used to authenticate clients at
	// the introspection endpoint. Defaults to an IntrospectionEndpointClientAuthStrategy.
	IntrospectionEndpointClientAuthStrategy EndpointClientAuthStrategy

	// IntrospectionEndpointClientAuthDisabled turns off client authentication at the introspection endpoint, leaving
	// an Access Token presented as a bearer credential the only way to authorize a call to it. Defaults to false,
	// which permits both. See IntrospectionEndpointClientAuthDisabledProvider for why a deployment would set it.
	IntrospectionEndpointClientAuthDisabled bool

	// RevocationEndpointClientAuthStrategy indicates the EndpointClientAuthStrategy used to authenticate clients at the
	// revocation endpoint. Defaults to a RevocationEndpointClientAuthStrategy.
	RevocationEndpointClientAuthStrategy EndpointClientAuthStrategy

	// AuthorizeErrorFieldResponseStrategy handles authorize error responses when the user can't be redirected in a
	// normal way for example when the redirect uri is invalid or for any other reason, just writing the fields in some
	// way to the response. By default this happens as a JSON document but this may also be a redirect to a internal
	// page as well.
	AuthorizeErrorFieldResponseStrategy AuthorizeErrorFieldResponseStrategy

	// ResponseModeHandlers provides the handlers for performing response mode formatting.
	ResponseModeHandlers ResponseModeHandlers

	// ResponseModeParameterHandlers provides handlers for injecting additional parameters into the authorize responses.
	ResponseModeParameterHandlers ResponseModeParameterHandlers

	// MessageCatalog is the message bundle used for i18n
	MessageCatalog i18n.MessageCatalog

	// FormPostHTMLTemplate sets html template for rendering the authorization response when the request has response_mode=form_post.
	FormPostHTMLTemplate *template.Template

	// FormPostResponseWriter is the FormPostResponseWriter used for writing the form post response. Useful for
	// overwriting the behaviour of this element.
	FormPostResponseWriter FormPostResponseWriter

	// OmitRedirectScopeParam indicates whether the "scope" parameter should be omitted from the redirect URL.
	OmitRedirectScopeParam bool

	// SanitationWhiteList is a whitelist of form values that are required by the token endpoint. These values
	// are safe for storage in a database (cleartext).
	SanitationWhiteList []string

	// JWTScopeClaimKey defines the claim key to be used to set the scope in. Valid fields are "scope" or "scp" or both.
	JWTScopeClaimKey jwt.JWTScopeFieldEnum

	// JWTSecuredAuthorizeResponseModeIssuer sets the default issuer for the JWT Secured Authorization Response Mode.
	JWTSecuredAuthorizeResponseModeIssuer string

	// JWTSecuredAuthorizeResponseModeLifespan sets the default lifetime for the tokens issued in the
	// JWT Secured Authorization Response Mode. Defaults to 10 minutes.
	JWTSecuredAuthorizeResponseModeLifespan time.Duration

	// JWTSecuredAuthorizeResponseModeStrategy is the signer for JWT Secured Authorization Response Mode. Has no default.
	JWTSecuredAuthorizeResponseModeStrategy jwt.Strategy

	// JWTStrategy handles less specific jwt.Strategy cases.
	JWTStrategy jwt.Strategy

	// EnforceJWTProfileAccessTokens forces the issuer to return JWT Profile Access Tokens to all clients.
	EnforceJWTProfileAccessTokens bool

	// HTTPClient is the HTTP client to use for requests.
	HTTPClient *retryablehttp.Client

	// AuthorizeEndpointHandlers is a list of handlers that are called before the authorization endpoint is served.
	AuthorizeEndpointHandlers AuthorizeEndpointHandlers

	// TokenEndpointHandlers is a list of handlers that are called before the token endpoint is served.
	TokenEndpointHandlers TokenEndpointHandlers

	// AuthorizeEndpointBindingHandlers is a list of handlers that record a proof-of-possession binding on an
	// authorize request before the authorize endpoint handlers run.
	AuthorizeEndpointBindingHandlers AuthorizeEndpointBindingHandlers

	// TokenEndpointBindingHandlers is a list of handlers that record and enforce a proof-of-possession binding on
	// an access request a grant handler has accepted.
	TokenEndpointBindingHandlers TokenEndpointBindingHandlers

	// RFC8628DeviceAuthorizeEndpointBindingHandlers is a list of handlers that record a proof-of-possession binding
	// on a device authorization request before the device authorization endpoint handlers run.
	RFC8628DeviceAuthorizeEndpointBindingHandlers RFC8628DeviceAuthorizeEndpointBindingHandlers

	// TokenIntrospectionHandlers is a list of handlers that are called before the token introspection endpoint is served.
	TokenIntrospectionHandlers TokenIntrospectionHandlers

	// RevocationHandlers is a list of handlers that are called before the revocation endpoint is served.
	RevocationHandlers RevocationHandlers

	// PushedAuthorizeEndpointHandlers is a list of handlers that are called before the PAR endpoint is served.
	PushedAuthorizeEndpointHandlers PushedAuthorizeEndpointHandlers

	// RFC8628DeviceAuthorizeEndpointHandlers is a list of handlers that are called before the device authorization endpoint is served.
	RFC8628DeviceAuthorizeEndpointHandlers RFC8628DeviceAuthorizeEndpointHandlers

	// RFC8628UserAuthorizeEndpointHandlers is a list of handlers that are called before the device grant user interaction endpoint is served.
	RFC8628UserAuthorizeEndpointHandlers RFC8628UserAuthorizeEndpointHandlers

	// RFC7591ClientRegistrationEndpointHandlers is a list of handlers that are called before the client registration endpoint is served.
	RFC7591ClientRegistrationEndpointHandlers RFC7591ClientRegistrationEndpointHandlers

	// RFC7592ClientConfigurationEndpointHandlers is a list of handlers that are called before the client configuration endpoint is served.
	RFC7592ClientConfigurationEndpointHandlers RFC7592ClientConfigurationEndpointHandlers

	// GlobalSecret is the global secret used to sign and verify signatures.
	GlobalSecret []byte

	// RotatedGlobalSecrets is a list of global secrets that are used to verify signatures.
	RotatedGlobalSecrets [][]byte

	// HMACHasher is the hasher used to generate HMAC signatures.
	HMACHasher func() hash.Hash

	// PushedAuthorizeRequestURIPrefix is the URI prefix for the PAR request_uri.
	// This is defaulted to 'urn:ietf:params:oauth:request_uri:'.
	PushedAuthorizeRequestURIPrefix string

	// PushedAuthorizeContextLifespan is the lifespan of the PAR context
	PushedAuthorizeContextLifespan time.Duration

	// RequirePushedAuthorizationRequests requires pushed authorization request for /authorize
	RequirePushedAuthorizationRequests bool

	// RequireRedirectURIPushedAuthorizationRequests requires the 'redirect_uri' parameter in Pushed Authorization
	// Requests. This is required by FAPI 2.0 Security Profile Section 5.3.2.2.
	RequireRedirectURIPushedAuthorizationRequests bool

	// RequireSignedRequestObject requires all authorization requests be protected as a signed Request Object provided
	// by either the 'request' or 'request_uri' parameter. This is equivalent to the 'require_signed_request_object'
	// authorization server metadata value.
	RequireSignedRequestObject bool

	// RequireSignedRequestObjectSkipPushedAuthorizationRequests skips the signed Request Object requirement for
	// requests made directly to the Pushed Authorization Request endpoint. This applies to the requirement from both
	// the authorization server and client metadata values.
	RequireSignedRequestObjectSkipPushedAuthorizationRequests bool

	// RequireRequestObjectAudienceAndLifetime requires a Request Object to contain the 'aud', 'nbf' and 'exp' claims,
	// and bounds its lifetime to RequestObjectMaximumLifetime. This is required by FAPI 2.0 Message Signing Section
	// 5.3.1.
	RequireRequestObjectAudienceAndLifetime bool

	// RequestObjectMaximumLifetime bounds a Request Object's 'nbf' and 'exp' claims when
	// RequireRequestObjectAudienceAndLifetime is enabled. Defaults to 60 minutes when zero, and is disabled when
	// negative.
	//
	// See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1
	RequestObjectMaximumLifetime time.Duration

	RFC8693TokenTypes map[string]RFC8693TokenType

	DefaultRequestedTokenType string

	// JWTClockSkew is how far into the future an 'iat' or 'nbf' claim may be in a JWT received from a client: a client
	// assertion, a request object, or an RFC 7523 authorization grant. Defaults to 10 seconds when zero, is disabled
	// when negative, and is capped at 60 seconds.
	//
	// See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1
	JWTClockSkew time.Duration

	// DPoPEnabled enables RFC 9449 DPoP handling.
	DPoPEnabled bool

	// DPoPEnforce requires DPoP for all clients regardless of client metadata.
	DPoPEnforce bool

	// DPoPAllowedJWSAlgorithms is the permitted asymmetric DPoP proof signing algorithms.
	DPoPAllowedJWSAlgorithms []string

	// DPoPClockSkew is the tolerance allowed for disagreement between this server's clock and the client's when
	// judging a DPoP proof's 'iat' claim. Defaults to ten seconds.
	//
	// It is not how long a proof lasts; that is DPoPProofLifespan. Skew widens the acceptance window at both ends,
	// so a proof is accepted from DPoPClockSkew before its 'iat' until DPoPProofLifespan+DPoPClockSkew after it.
	// Raise this, and only this, to tolerate clients whose clocks are not synchronized.
	DPoPClockSkew time.Duration

	// DPoPProofLifespan is how long a DPoP proof remains valid after the 'iat' it was minted with. Defaults to ten
	// seconds.
	//
	// A proof is single use, so this bounds how long a captured one could be replayed if the replay record were
	// lost, and how long a client may sit on a proof before sending it. Combined with the default DPoPClockSkew a
	// proof is usable for at most 20 seconds after it was minted.
	DPoPProofLifespan time.Duration

	// DPoPNonceRequired requires a server nonce in DPoP proofs.
	DPoPNonceRequired bool

	// DPoPNonceLifespan is the lifespan of issued DPoP server nonces. Defaults to one hour.
	DPoPNonceLifespan time.Duration

	// DPoPStrategy is the configured DPoP strategy.
	DPoPStrategy DPoPStrategy

	// OIDCKeyBindingEnabled enables OpenID Connect Key Binding 1.0, which issues an ID Token carrying the 'cnf'
	// claim of a DPoP proof-of-possession key. Requires DPoPEnabled. Defaults to false.
	OIDCKeyBindingEnabled bool

	// MTLSEnabled enables RFC 8705 Mutual-TLS handling.
	MTLSEnabled bool

	// MTLSEnforce requires certificate-bound access tokens for all clients regardless of client metadata.
	MTLSEnforce bool

	// MTLSClientCertificateHeader is the name of the header a trusted TLS terminating proxy forwards the client
	// certificate in, for example 'X-Forwarded-Tls-Client-Cert'. It is empty by default, which disables the header
	// entirely so that only a certificate from the TLS connection itself is used.
	//
	// Setting this is a decision to trust the named header absolutely. It is not authenticated, and a request that
	// reaches this server without transiting the proxy can set it to any value, authenticating the sender as any
	// client registered with an mTLS authentication method and binding tokens to a certificate it does not hold. A
	// deployment that sets this MUST ensure the proxy unconditionally overwrites the header on every inbound request,
	// and that the server is unreachable except through that proxy.
	//
	// The certificate chain is not validated here. For a certificate from the TLS connection Go has already done so
	// against the listener's ClientCAs; for a forwarded one the proxy that performed the handshake is the component
	// that validated it, and RFC 8705 Section 6.5 places that channel out of scope. Per Section 7.4 the trust anchors
	// accepted there SHOULD be limited to CAs whose issuance policy meets this server's requirements.
	MTLSClientCertificateHeader string

	// RFC7591ClientRegistrationGlobalSecret is the secret used to sign client registration tokens. It is
	// deliberately separate from GlobalSecret: a client management token never expires and RFC 7592 provides no way
	// to re-issue one, so signing it with the global secret would mean routine rotation of that secret permanently
	// locked every registered client out of its own registration.
	RFC7591ClientRegistrationGlobalSecret []byte

	// RFC7591ClientRegistrationRotatedGlobalSecrets is a list of rotated client registration token secrets, which
	// remain valid for verification but are not used for signing.
	RFC7591ClientRegistrationRotatedGlobalSecrets [][]byte

	// RFC7591ClientRegistrationEndpointURL is the absolute URL of the client registration endpoint.
	RFC7591ClientRegistrationEndpointURL string

	// RFC7591ClientSecretLifespan is the lifespan used to derive 'client_secret_expires_at'. Zero means the secret
	// does not expire.
	RFC7591ClientSecretLifespan time.Duration

	// RFC7591ClientRegistrationStrategy is the strategy used to construct and patch clients.
	RFC7591ClientRegistrationStrategy ClientRegistrationStrategy

	// RFC7591ClientRegistrationMetadataStrategy is the strategy used to filter client metadata before it reaches
	// the client registration strategy and before it is returned to the client.
	RFC7591ClientRegistrationMetadataStrategy ClientRegistrationMetadataStrategy

	// RFC7591ClientRegistrationEndpointAuthStrategy is the strategy used to authenticate requests at the client
	// registration and client configuration endpoints.
	RFC7591ClientRegistrationEndpointAuthStrategy ClientRegistrationEndpointAuthStrategy

	// RFC7591ClientRegistrationValidators are the validators run in order against submitted metadata.
	RFC7591ClientRegistrationValidators []ClientRegistrationValidator

	// RFC7591ClientRegistrationEndpointAudiences are the audiences a client creation token may carry. The token must
	// carry at least one of them. Empty means the configured registration endpoint URL is expected, falling back to
	// the request URL.
	RFC7591ClientRegistrationEndpointAudiences []string

	// RFC7591ClientRegistrationScopes are the scopes a client creation token may carry. The token must carry at least
	// one of them. Empty means consts.ScopeClientRegistration.
	RFC7591ClientRegistrationScopes []string

	// RFC7591ClientRegistrationGrantTypes are the grant types a client may register for. Empty permits any grant.
	// See GetRFC7591ClientRegistrationGrantTypes for why, and when a deployment should set it.
	RFC7591ClientRegistrationGrantTypes []string
	// contains filtered or unexported fields
}

func (*Config) GetAccessTokenIssuer 

func (c *Config) GetAccessTokenIssuer(ctx context.Context) string

GetAccessTokenIssuer returns the issuer for JWT profile access tokens, falling back to the ID Token issuer. RFC 9068 Section 2.2 makes 'iss' a required claim, and RFC 8414 gives an authorization server one issuer identifier, so the value that identifies it as an ID Token issuer identifies it here too. Without the fallback a deployment that enabled JWT profile access tokens without setting this minted tokens carrying no 'iss' at all.

func (*Config) GetAccessTokenLifespan 

func (c *Config) GetAccessTokenLifespan(_ context.Context) time.Duration

GetAccessTokenLifespan returns how long an access token should be valid. Defaults to one hour.

func (*Config) GetAllowedIntrospectionAudiences added in v0.3.0 

func (c *Config) GetAllowedIntrospectionAudiences(ctx context.Context) (audiences []string)

func (*Config) GetAllowedIntrospectionScopes added in v0.3.0 

func (c *Config) GetAllowedIntrospectionScopes(ctx context.Context) (scopes []string)

func (*Config) GetAllowedJWTAssertionAudiences added in v0.1.17 

func (c *Config) GetAllowedJWTAssertionAudiences(ctx context.Context) []string

func (*Config) GetAllowedPrompts 

func (c *Config) GetAllowedPrompts(_ context.Context) []string

func (*Config) GetAudienceStrategy 

func (c *Config) GetAudienceStrategy(_ context.Context) AudienceStrategy

GetAudienceStrategy returns the audience matching strategy. Defaults to ExactAudienceStrategy (audience parameter values are matched against the client's allowed audience list via exact string equality).

func (*Config) GetAuthorizationServerIdentificationIssuer 

func (c *Config) GetAuthorizationServerIdentificationIssuer(ctx context.Context) (issuer string)

func (*Config) GetAuthorizeCodeLifespan 

func (c *Config) GetAuthorizeCodeLifespan(_ context.Context) time.Duration

GetAuthorizeCodeLifespan returns how long an authorize code should be valid. Defaults to one fifteen minutes.

func (*Config) GetAuthorizeEndpointBindingHandlers added in v0.3.0 

func (c *Config) GetAuthorizeEndpointBindingHandlers(ctx context.Context) AuthorizeEndpointBindingHandlers

func (*Config) GetAuthorizeEndpointHandlers 

func (c *Config) GetAuthorizeEndpointHandlers(ctx context.Context) AuthorizeEndpointHandlers

func (*Config) GetAuthorizeErrorFieldResponseStrategy added in v0.2.11 

func (c *Config) GetAuthorizeErrorFieldResponseStrategy(ctx context.Context) (strategy AuthorizeErrorFieldResponseStrategy)

func (*Config) GetBCryptCost 

func (c *Config) GetBCryptCost(_ context.Context) int

GetBCryptCost returns the bcrypt cost factor. Defaults to 12.

func (*Config) GetBackChannelLogoutConcurrency added in v0.3.0 

func (c *Config) GetBackChannelLogoutConcurrency(ctx context.Context) (n int)

func (*Config) GetBackChannelLogoutLifespan added in v0.3.0 

func (c *Config) GetBackChannelLogoutLifespan(ctx context.Context) (lifespan time.Duration)

func (*Config) GetBackChannelLogoutTokenStrategy added in v0.3.0 

func (c *Config) GetBackChannelLogoutTokenStrategy(ctx context.Context) (strategy BackChannelLogoutTokenStrategy)

func (*Config) GetClientAuthenticationStrategy 

func (c *Config) GetClientAuthenticationStrategy(_ context.Context) ClientAuthenticationStrategy

GetClientAuthenticationStrategy returns the configured client authentication strategy. Defaults to nil. Note that on a nil strategy `oauth2.Fosite` fallbacks to its default client authentication strategy `oauth2.Fosite.DefaultClientAuthenticationStrategy`

func (*Config) GetClientCredentialsFlowImplicitGrantRequested 

func (c *Config) GetClientCredentialsFlowImplicitGrantRequested(_ context.Context) bool

func (*Config) GetDPoPAllowedJWSAlgorithms added in v0.2.37 

func (c *Config) GetDPoPAllowedJWSAlgorithms(ctx context.Context) (algs []string)

GetDPoPAllowedJWSAlgorithms returns the asymmetric algorithms a DPoP proof may be signed with.

Both Edwards-curve identifiers are listed: 'EdDSA' from RFC 8037 Section 3.1, and the fully-specified 'Ed25519' that RFC 9864 Table 2 registers for the same parameter set and recommends in its place, so a client using either identifier is accepted. RFC 9864's 'Ed448' is absent because token/jose does not implement it.

func (*Config) GetDPoPClockSkew added in v0.2.37 

func (c *Config) GetDPoPClockSkew(ctx context.Context) (skew time.Duration)

func (*Config) GetDPoPEnabled added in v0.2.37 

func (c *Config) GetDPoPEnabled(ctx context.Context) (enabled bool)

func (*Config) GetDPoPEnforce added in v0.2.37 

func (c *Config) GetDPoPEnforce(ctx context.Context) (enforce bool)

func (*Config) GetDPoPNonceLifespan added in v0.2.37 

func (c *Config) GetDPoPNonceLifespan(ctx context.Context) (lifespan time.Duration)

func (*Config) GetDPoPNonceRequired added in v0.2.37 

func (c *Config) GetDPoPNonceRequired(ctx context.Context) (required bool)

func (*Config) GetDPoPProofLifespan added in v0.3.0 

func (c *Config) GetDPoPProofLifespan(ctx context.Context) (lifespan time.Duration)

func (*Config) GetDPoPStrategy added in v0.2.37 

func (c *Config) GetDPoPStrategy(ctx context.Context) (strategy DPoPStrategy)

func (*Config) GetDefaultRFC8693RequestedTokenType 

func (c *Config) GetDefaultRFC8693RequestedTokenType(ctx context.Context) string

func (*Config) GetDisableRefreshTokenRotation added in v0.3.3 

func (c *Config) GetDisableRefreshTokenRotation(_ context.Context) bool

GetDisableRefreshTokenRotation returns whether the refresh token grant keeps the presented refresh token.

func (*Config) GetDisableRefreshTokenValidation 

func (c *Config) GetDisableRefreshTokenValidation(_ context.Context) bool

GetDisableRefreshTokenValidation returns whether to disable the validation of the refresh token.

func (*Config) GetEnablePKCEPlainChallengeMethod 

func (c *Config) GetEnablePKCEPlainChallengeMethod(ctx context.Context) bool

GetEnablePKCEPlainChallengeMethod returns whether or not to allow the plain challenge method (S256 should be used whenever possible, plain is really discouraged).

func (*Config) GetEnforceClientAssertionIssuerAudience added in v0.3.0 

func (c *Config) GetEnforceClientAssertionIssuerAudience(ctx context.Context) (enforce bool)

GetEnforceClientAssertionIssuerAudience returns whether a JWT client authentication assertion must carry this server's issuer identifier as the sole value of its 'aud' claim.

draft-ietf-oauth-rfc7523bis Section 4 replaces RFC 7523 Section 3 item 3 and differentiates two cases: the authorization grant MAY identify the server by "either its issuer identifier or its token endpoint URL", while for client authentication the value "MUST use the issuer identifier of the authorization server as its sole value", adding that "the token endpoint URL ... MUST NOT be used as an audience value". Accepting either at both endpoints is the ambiguity Audience.Injection exploits: an assertion minted for one endpoint is replayed at another.

It is off by default because the tightening lives in a draft, while published RFC 7523 permits the token endpoint URL, so enabling it rejects assertions from clients that conform to the published specification. A deployment whose clients have adopted the draft should turn it on; the default should be revisited when the draft is published.

func (*Config) GetEnforceJWTProfileAccessTokens 

func (c *Config) GetEnforceJWTProfileAccessTokens(ctx context.Context) (enable bool)

func (*Config) GetEnforcePKCE 

func (c *Config) GetEnforcePKCE(ctx context.Context) bool

GetEnforcePKCE If set to true, public clients must use PKCE.

func (*Config) GetEnforcePKCEForPublicClients 

func (c *Config) GetEnforcePKCEForPublicClients(ctx context.Context) bool

GetEnforcePKCEForPublicClients returns the value of EnforcePKCEForPublicClients.

func (*Config) GetEnforceRevokeFlowRevokeRefreshTokensExplicitClient 

func (c *Config) GetEnforceRevokeFlowRevokeRefreshTokensExplicitClient(ctx context.Context) bool

func (*Config) GetFormPostHTMLTemplate 

func (c *Config) GetFormPostHTMLTemplate(ctx context.Context) *template.Template

func (*Config) GetFormPostResponseWriter 

func (c *Config) GetFormPostResponseWriter(ctx context.Context) FormPostResponseWriter

func (*Config) GetGlobalSecret 

func (c *Config) GetGlobalSecret(ctx context.Context) ([]byte, error)

func (*Config) GetGrantTypeJWTBearerCanSkipClientAuth 

func (c *Config) GetGrantTypeJWTBearerCanSkipClientAuth(ctx context.Context) bool

GetGrantTypeJWTBearerCanSkipClientAuth returns the GrantTypeJWTBearerCanSkipClientAuth field.

func (*Config) GetGrantTypeJWTBearerIDOptional 

func (c *Config) GetGrantTypeJWTBearerIDOptional(ctx context.Context) bool

GetGrantTypeJWTBearerIDOptional returns the GrantTypeJWTBearerIDOptional field.

func (*Config) GetGrantTypeJWTBearerIssuedDateOptional 

func (c *Config) GetGrantTypeJWTBearerIssuedDateOptional(ctx context.Context) bool

GetGrantTypeJWTBearerIssuedDateOptional returns the GrantTypeJWTBearerIssuedDateOptional field.

func (*Config) GetHMACHasher 

func (c *Config) GetHMACHasher(ctx context.Context) func() hash.Hash

func (*Config) GetHTTPClient 

func (c *Config) GetHTTPClient(ctx context.Context) *retryablehttp.Client

func (*Config) GetIDTokenIssuer 

func (c *Config) GetIDTokenIssuer(ctx context.Context) string

func (*Config) GetIDTokenLifespan 

func (c *Config) GetIDTokenLifespan(_ context.Context) time.Duration

GetIDTokenLifespan returns how long an id token should be valid. Defaults to one hour.

func (*Config) GetIDTokenValidationStrategy added in v0.3.0 

func (c *Config) GetIDTokenValidationStrategy(ctx context.Context) (strategy TokenValidationStrategy)

func (*Config) GetIntrospectionEndpointClientAuthDisabled added in v0.3.0 

func (c *Config) GetIntrospectionEndpointClientAuthDisabled(ctx context.Context) (disabled bool)

func (*Config) GetIntrospectionEndpointClientAuthStrategy added in v0.2.37 

func (c *Config) GetIntrospectionEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)

func (*Config) GetIntrospectionIssuer added in v0.1.4 

func (c *Config) GetIntrospectionIssuer(ctx context.Context) string

func (*Config) GetIntrospectionJWTResponseStrategy added in v0.2.0 

func (c *Config) GetIntrospectionJWTResponseStrategy(ctx context.Context) jwt.Strategy

func (*Config) GetJWKSFetcherStrategy 

func (c *Config) GetJWKSFetcherStrategy(_ context.Context) jwt.JWKSFetcherStrategy

GetJWKSFetcherStrategy returns the jwt.JWKSFetcherStrategy.

func (*Config) GetJWTClockSkew added in v0.3.3 

func (c *Config) GetJWTClockSkew(_ context.Context) time.Duration

GetJWTClockSkew returns how far into the future an 'iat' or 'nbf' claim may be in a JWT received from a client. Defaults to 10 seconds when zero, is disabled when negative, and is capped at 60 seconds.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1

func (*Config) GetJWTMaxDuration 

func (c *Config) GetJWTMaxDuration(_ context.Context) time.Duration

GetJWTMaxDuration specified the maximum amount of allowed `exp` time for a JWT. It compares the time with the JWT's `exp` time if the JWT time is larger, will cause the JWT to be invalid.

Defaults to a day.

func (*Config) GetJWTScopeField 

func (c *Config) GetJWTScopeField(ctx context.Context) jwt.JWTScopeFieldEnum

func (*Config) GetJWTSecuredAuthorizeResponseModeIssuer 

func (c *Config) GetJWTSecuredAuthorizeResponseModeIssuer(ctx context.Context) string

func (*Config) GetJWTSecuredAuthorizeResponseModeLifespan 

func (c *Config) GetJWTSecuredAuthorizeResponseModeLifespan(_ context.Context) time.Duration

GetJWTSecuredAuthorizeResponseModeLifespan returns how long a JWT issued by the JWT Secured Authorize Response Mode should be valid. Defaults to 10 minutes.

func (*Config) GetJWTSecuredAuthorizeResponseModeStrategy added in v0.2.0 

func (c *Config) GetJWTSecuredAuthorizeResponseModeStrategy(ctx context.Context) jwt.Strategy

func (*Config) GetJWTStrategy added in v0.2.0 

func (c *Config) GetJWTStrategy(ctx context.Context) jwt.Strategy

func (*Config) GetMTLSClientCertificateHeader added in v0.3.0 

func (c *Config) GetMTLSClientCertificateHeader(ctx context.Context) (header string)

func (*Config) GetMTLSEnabled added in v0.3.0 

func (c *Config) GetMTLSEnabled(ctx context.Context) (enabled bool)

func (*Config) GetMTLSEnforce added in v0.3.0 

func (c *Config) GetMTLSEnforce(ctx context.Context) (enforce bool)

func (*Config) GetMessageCatalog 

func (c *Config) GetMessageCatalog(ctx context.Context) i18n.MessageCatalog

func (*Config) GetMinParameterEntropy 

func (c *Config) GetMinParameterEntropy(_ context.Context) int

GetMinParameterEntropy returns MinParameterEntropy if set. Defaults to oauth2.MinParameterEntropy.

func (*Config) GetOIDCKeyBindingEnabled added in v0.3.1 

func (c *Config) GetOIDCKeyBindingEnabled(ctx context.Context) (enabled bool)

func (*Config) GetOmitRedirectScopeParam 

func (c *Config) GetOmitRedirectScopeParam(ctx context.Context) bool

func (*Config) GetPushedAuthorizeContextLifespan 

func (c *Config) GetPushedAuthorizeContextLifespan(ctx context.Context) time.Duration

GetPushedAuthorizeContextLifespan is the lifespan of the short-lived PAR context.

func (*Config) GetPushedAuthorizeEndpointHandlers 

func (c *Config) GetPushedAuthorizeEndpointHandlers(ctx context.Context) PushedAuthorizeEndpointHandlers

GetPushedAuthorizeEndpointHandlers returns the handlers.

func (*Config) GetPushedAuthorizeRequestURIPrefix 

func (c *Config) GetPushedAuthorizeRequestURIPrefix(ctx context.Context) string

GetPushedAuthorizeRequestURIPrefix is the request URI prefix. This is usually 'urn:ietf:params:oauth:request_uri:'.

func (*Config) GetRFC7591ClientRegistrationEndpointAudiences added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationEndpointAudiences(ctx context.Context) (audiences []string)

func (*Config) GetRFC7591ClientRegistrationEndpointAuthStrategy added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationEndpointAuthStrategy(ctx context.Context) (strategy ClientRegistrationEndpointAuthStrategy)

func (*Config) GetRFC7591ClientRegistrationEndpointHandlers added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationEndpointHandlers(_ context.Context) RFC7591ClientRegistrationEndpointHandlers

func (*Config) GetRFC7591ClientRegistrationEndpointURL added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationEndpointURL(ctx context.Context) (endpoint string)

func (*Config) GetRFC7591ClientRegistrationGlobalSecret added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationGlobalSecret(ctx context.Context) (secret []byte, err error)

func (*Config) GetRFC7591ClientRegistrationGrantTypes added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationGrantTypes(ctx context.Context) (grantTypes []string)

GetRFC7591ClientRegistrationGrantTypes returns the grant types a client may register for, or nil to permit any.

RFC 7591 Section 2 permits the authorization server to "reject any requested client metadata values ... by returning an error response". The registrant chooses 'grant_types' and every token endpoint authorization check in this library is a GetGrantTypes().Has call, so a client that can register unrestricted grants its own authority: asserting 'client_credentials' produces a client that acts with no resource owner, and 'password' one that RFC 9700 Section 2.4 says MUST NOT be used at all.

It is empty by default, permitting any grant, because registering a non-redirecting grant is legitimate and specified: an mTLS client registered under RFC 8705 is a client credentials client, and Section 2 requires only that 'grant_types' and 'response_types' be internally coherent. A deployment whose registration endpoint is open, or is reachable by parties it does not intend to grant every flow to, should set this to the grants it means to hand out.

func (*Config) GetRFC7591ClientRegistrationMetadataStrategy added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationMetadataStrategy(ctx context.Context) (strategy ClientRegistrationMetadataStrategy)

func (*Config) GetRFC7591ClientRegistrationRotatedGlobalSecrets added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationRotatedGlobalSecrets(ctx context.Context) (secrets [][]byte, err error)

func (*Config) GetRFC7591ClientRegistrationScopes added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationScopes(ctx context.Context) (scopes []string)

func (*Config) GetRFC7591ClientRegistrationStrategy added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationStrategy(ctx context.Context) (strategy ClientRegistrationStrategy)

func (*Config) GetRFC7591ClientRegistrationValidators added in v0.3.0 

func (c *Config) GetRFC7591ClientRegistrationValidators(ctx context.Context) (validators []ClientRegistrationValidator)

func (*Config) GetRFC7591ClientSecretLifespan added in v0.3.0 

func (c *Config) GetRFC7591ClientSecretLifespan(ctx context.Context) (lifespan time.Duration)

func (*Config) GetRFC7592ClientConfigurationEndpointHandlers added in v0.3.0 

func (c *Config) GetRFC7592ClientConfigurationEndpointHandlers(_ context.Context) RFC7592ClientConfigurationEndpointHandlers

func (*Config) GetRFC8628CodeLifespan 

func (c *Config) GetRFC8628CodeLifespan(_ context.Context) time.Duration

GetRFC8628CodeLifespan returns the device and user code lifespan.

func (*Config) GetRFC8628DeviceAuthorizeEndpointBindingHandlers added in v0.3.1 

func (c *Config) GetRFC8628DeviceAuthorizeEndpointBindingHandlers(ctx context.Context) RFC8628DeviceAuthorizeEndpointBindingHandlers

func (*Config) GetRFC8628DeviceAuthorizeEndpointHandlers 

func (c *Config) GetRFC8628DeviceAuthorizeEndpointHandlers(_ context.Context) RFC8628DeviceAuthorizeEndpointHandlers

func (*Config) GetRFC8628TokenPollingInterval 

func (c *Config) GetRFC8628TokenPollingInterval(_ context.Context) time.Duration

func (*Config) GetRFC8628UserAuthorizeEndpointHandlers 

func (c *Config) GetRFC8628UserAuthorizeEndpointHandlers(_ context.Context) RFC8628UserAuthorizeEndpointHandlers

func (*Config) GetRFC8628UserVerificationURL 

func (c *Config) GetRFC8628UserVerificationURL(_ context.Context) string

func (*Config) GetRFC8693TokenTypes 

func (c *Config) GetRFC8693TokenTypes(ctx context.Context) map[string]RFC8693TokenType

func (*Config) GetRedirectSecureChecker 

func (c *Config) GetRedirectSecureChecker(_ context.Context) func(context.Context, *url.URL) bool

GetRedirectSecureChecker returns the checker to check if redirect URI is secure. Defaults to oauth2.IsRedirectURISecure.

func (*Config) GetRefreshTokenLifespan 

func (c *Config) GetRefreshTokenLifespan(_ context.Context) time.Duration

GetRefreshTokenLifespan sets how long a refresh token is going to be valid. Defaults to 30 days. Set to -1 for refresh tokens that never expire.

func (*Config) GetRefreshTokenScopes 

func (c *Config) GetRefreshTokenScopes(_ context.Context) []string

GetRefreshTokenScopes returns which scopes will provide refresh tokens.

func (*Config) GetRequestObjectMaximumLifetime added in v0.3.3 

func (c *Config) GetRequestObjectMaximumLifetime(_ context.Context) time.Duration

GetRequestObjectMaximumLifetime returns the bound applied to a Request Object's 'nbf' and 'exp' claims. Defaults to 60 minutes when zero, and is disabled when negative.

See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1

func (*Config) GetRequirePushedAuthorizationRequests 

func (c *Config) GetRequirePushedAuthorizationRequests(ctx context.Context) bool

GetRequirePushedAuthorizationRequests indicates if PAR is enforced. In this mode, a client cannot pass authorize parameters at the 'authorize' endpoint. The 'authorize' endpoint must contain the PAR request_uri.

func (*Config) GetRequireRedirectURIPushedAuthorizationRequests added in v0.3.3 

func (c *Config) GetRequireRedirectURIPushedAuthorizationRequests(ctx context.Context) bool

GetRequireRedirectURIPushedAuthorizationRequests indicates if the 'redirect_uri' parameter is required in Pushed Authorization Requests.

func (*Config) GetRequireRequestObjectAudienceAndLifetime added in v0.3.3 

func (c *Config) GetRequireRequestObjectAudienceAndLifetime(ctx context.Context) bool

GetRequireRequestObjectAudienceAndLifetime indicates if a Request Object must contain the 'aud', 'nbf' and 'exp' claims, and have a lifetime of no more than 60 minutes.

func (*Config) GetRequireSignedRequestObject added in v0.3.0 

func (c *Config) GetRequireSignedRequestObject(ctx context.Context) bool

GetRequireSignedRequestObject indicates if JWT-Secured Authorization Requests are enforced. In this mode, a client cannot pass authorization parameters via the OAuth 2.0 request syntax alone; the request must be protected as a signed Request Object provided by either the 'request' or 'request_uri' parameter.

func (*Config) GetRequireSignedRequestObjectSkipPushedAuthorizationRequests added in v0.3.0 

func (c *Config) GetRequireSignedRequestObjectSkipPushedAuthorizationRequests(ctx context.Context) bool

GetRequireSignedRequestObjectSkipPushedAuthorizationRequests indicates if the signed Request Object requirement is skipped for requests made directly to the Pushed Authorization Request endpoint.

func (*Config) GetResourceStrategy added in v0.2.32 

func (c *Config) GetResourceStrategy(_ context.Context) ResourceStrategy

GetResourceStrategy returns the RFC 8707 resource indicator matching strategy. Defaults to DefaultAudienceStrategy (URL-based matching against the client's allowed audience list).

func (*Config) GetResponseModeHandlers 

func (c *Config) GetResponseModeHandlers(ctx context.Context) ResponseModeHandlers

func (*Config) GetResponseModeParameterHandlers added in v0.1.3 

func (c *Config) GetResponseModeParameterHandlers(ctx context.Context) ResponseModeParameterHandlers

func (*Config) GetRevocationEndpointClientAuthStrategy added in v0.2.37 

func (c *Config) GetRevocationEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)

func (*Config) GetRevocationHandlers 

func (c *Config) GetRevocationHandlers(ctx context.Context) RevocationHandlers

func (*Config) GetRevokeRefreshTokensExplicit 

func (c *Config) GetRevokeRefreshTokensExplicit(ctx context.Context) bool

func (*Config) GetRotatedGlobalSecrets 

func (c *Config) GetRotatedGlobalSecrets(ctx context.Context) ([][]byte, error)

func (*Config) GetSanitationWhiteList 

func (c *Config) GetSanitationWhiteList(ctx context.Context) []string

GetSanitationWhiteList returns a list of allowed form values that are required by the token endpoint. These values are safe for storage in a database (cleartext).

func (*Config) GetScopeStrategy 

func (c *Config) GetScopeStrategy(_ context.Context) ScopeStrategy

GetScopeStrategy returns the scope strategy to be used. Defaults to glob scope strategy.

func (*Config) GetSendDebugMessagesToClients 

func (c *Config) GetSendDebugMessagesToClients(ctx context.Context) bool

func (*Config) GetTokenEndpointBindingHandlers added in v0.3.0 

func (c *Config) GetTokenEndpointBindingHandlers(ctx context.Context) TokenEndpointBindingHandlers

func (*Config) GetTokenEndpointClientAuthStrategy added in v0.2.37 

func (c *Config) GetTokenEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)

func (*Config) GetTokenEndpointHandlers 

func (c *Config) GetTokenEndpointHandlers(ctx context.Context) TokenEndpointHandlers

func (*Config) GetTokenEntropy 

func (c *Config) GetTokenEntropy(_ context.Context) int

GetTokenEntropy returns the entropy of the "message" part of a HMAC Token. Defaults to 32.

func (*Config) GetTokenIntrospectionHandlers 

func (c *Config) GetTokenIntrospectionHandlers(ctx context.Context) TokenIntrospectionHandlers

func (*Config) GetUseLegacyErrorFormat 

func (c *Config) GetUseLegacyErrorFormat(ctx context.Context) bool

func (*Config) GetVerifiableCredentialsNonceLifespan 

func (c *Config) GetVerifiableCredentialsNonceLifespan(_ context.Context) time.Duration

GetVerifiableCredentialsNonceLifespan returns how long a nonce should be valid. Defaults to one hour.

type Configurator 

type Configurator interface {
	IDTokenIssuerProvider
	IDTokenValidationStrategyProvider
	BackChannelLogoutTokenStrategyProvider
	BackChannelLogoutLifespanProvider
	BackChannelLogoutConcurrencyProvider
	IDTokenLifespanProvider
	AuthorizationServerIssuerIdentificationProvider
	AllowedPromptsProvider
	EnforcePKCEProvider
	EnforcePKCEForPublicClientsProvider
	EnablePKCEPlainChallengeMethodProvider
	GrantTypeJWTBearerCanSkipClientAuthProvider
	GrantTypeJWTBearerIDOptionalProvider
	GrantTypeJWTBearerIssuedDateOptionalProvider
	GetJWTMaxDurationProvider
	JWTClockSkewProvider
	ScopeStrategyProvider
	AudienceStrategyProvider
	ClientCredentialsImplicitProvider
	RedirectSecureCheckerProvider
	OmitRedirectScopeParamProvider
	SanitationAllowedProvider
	JWTScopeFieldProvider
	JWTSecuredAuthorizeResponseModeIssuerProvider
	JWTSecuredAuthorizeResponseModeStrategyProvider
	JWTSecuredAuthorizeResponseModeLifespanProvider
	JWTProfileAccessTokensProvider
	AccessTokenIssuerProvider
	DisableRefreshTokenValidationProvider
	DisableRefreshTokenRotationProvider
	RefreshTokenScopesProvider
	AccessTokenLifespanProvider
	RefreshTokenLifespanProvider
	VerifiableCredentialsNonceLifespanProvider
	AuthorizeCodeLifespanProvider
	TokenEntropyProvider
	RotatedGlobalSecretsProvider
	GlobalSecretProvider
	JWKSFetcherStrategyProvider
	HTTPClientProvider
	ScopeStrategyProvider
	AudienceStrategyProvider
	MinParameterEntropyProvider
	HMACHashingProvider
	ClientAuthenticationStrategyProvider
	ResponseModeHandlerProvider
	SendDebugMessagesToClientsProvider
	RevokeRefreshTokensExplicitlyProvider
	JWKSFetcherStrategyProvider
	ClientAuthenticationStrategyProvider
	MessageCatalogProvider
	FormPostHTMLTemplateProvider
	FormPostResponseProvider
	AllowedJWTAssertionAudiencesProvider
	AllowedIntrospectionAudiencesProvider
	AllowedIntrospectionScopesProvider
	AuthorizeEndpointHandlersProvider
	TokenEndpointHandlersProvider
	AuthorizeEndpointBindingHandlersProvider
	TokenEndpointBindingHandlersProvider
	RFC8628DeviceAuthorizeEndpointBindingHandlersProvider
	TokenIntrospectionHandlersProvider
	RevocationHandlersProvider
	PushedAuthorizeRequestHandlersProvider
	PushedAuthorizeRequestConfigProvider
	JWTSecuredAuthorizationRequestConfigProvider
	RFC8693ConfigProvider
	RFC8628DeviceAuthorizeEndpointHandlersProvider
	RFC8628UserAuthorizeEndpointHandlersProvider
	RFC8628DeviceAuthorizeConfigProvider
	IntrospectionIssuerProvider
	IntrospectionJWTResponseStrategyProvider
	JWTStrategyProvider
	AuthorizeErrorFieldResponseStrategyProvider
	UseLegacyErrorFormatProvider
	ResourceStrategyProvider
	TokenEndpointClientAuthStrategyProvider
	RevocationEndpointClientAuthStrategyProvider
	IntrospectionEndpointClientAuthStrategyProvider
	IntrospectionEndpointClientAuthDisabledProvider
	DPoPConfigProvider
	MTLSConfigProvider
	OIDCKeyBindingConfigProvider
	RFC7591ClientRegistrationConfigProvider
	RFC7591ClientRegistrationEndpointHandlersProvider
	RFC7592ClientConfigurationEndpointHandlersProvider
}

Configurator is the full configuration surface a Provider requires.

type ConfirmationConfigProvider added in v0.3.0 

type ConfirmationConfigProvider interface {
	// GetDPoPEnabled returns true if DPoP handling is enabled.
	GetDPoPEnabled(ctx context.Context) (enabled bool)

	// GetMTLSEnabled returns true if RFC 8705 handling is enabled.
	GetMTLSEnabled(ctx context.Context) (enabled bool)
}

ConfirmationConfigProvider is the configuration ApplyConfirmation consults to decide whether a given RFC 7800 confirmation method may be asserted in a token or an introspection response.

It deliberately restates the two 'enabled' getters rather than embedding DPoPConfigProvider and MTLSConfigProvider, which together carry ten methods where two are needed. Go interfaces are structural, so any configuration already satisfying those providers satisfies this one without change.

type ContextKey 

type ContextKey string

type CustomTokenLifespansClient 

type CustomTokenLifespansClient interface {
	// GetEffectiveLifespan either maps GrantType x TokenType to the client's configured lifespan, or returns the fallback value.
	GetEffectiveLifespan(gt GrantType, tt TokenType, fallback time.Duration) (lifespan time.Duration)

	Client
}

CustomTokenLifespansClient is a Client with specific lifespans.

type DPoPBoundSession added in v0.2.37 

type DPoPBoundSession interface {
	// SetDPoPJWKThumbprint records the RFC 7638 JWK SHA-256 Thumbprint (jkt) the token is bound to.
	SetDPoPJWKThumbprint(jkt string)

	// GetDPoPJWKThumbprint returns the bound JWK thumbprint, or an empty string when the session is not DPoP bound.
	GetDPoPJWKThumbprint() (jkt string)

	// SetRequestedDPoPJWKThumbprint records the RFC 9449 Section 10.1 'dpop_jkt' the authentication request carried.
	//
	// Only the authorization and device authorization endpoints record it. The token endpoint must not, because
	// OpenID Connect Key Binding 1.0 Section 2.3 distinguishes a grant whose authentication request asked to be
	// bound from one that merely presented a proof, and SetDPoPJWKThumbprint cannot express that difference: RFC 9449
	// binds an access token to the presented key either way.
	SetRequestedDPoPJWKThumbprint(jkt string)

	// GetRequestedDPoPJWKThumbprint returns the 'dpop_jkt' the authentication request carried, or an empty string
	// when it carried none.
	GetRequestedDPoPJWKThumbprint() (jkt string)

	// SetDPoPPublicKeyJWK records the proof-of-possession public key an ID Token is bound to, as the raw JWK JSON
	// from the proof's 'jwk' header.
	//
	// OpenID Connect Key Binding 1.0 Section 4 requires the key itself in the 'cnf' claim rather than its
	// thumbprint, and a thumbprint is one-way, so the key cannot be recovered from SetDPoPJWKThumbprint's value.
	SetDPoPPublicKeyJWK(jwk []byte)

	// GetDPoPPublicKeyJWK returns the bound public key, or nil when the session is not key bound.
	GetDPoPPublicKeyJWK() (jwk []byte)

	// SetOIDCKeyBindingGranted records that the 'bound_key' scope was granted, so that the ID Tokens of this grant
	// are key bound.
	//
	// It is recorded where consent has already decided it; the authorization endpoint, and for the device flow the
	// user authorization endpoint; because the token endpoint's binding phase runs before the authorization code
	// and device code grants copy their granted scopes onto the request.
	//
	// Neither thumbprint answers this. They record that DPoP is in play and that the authentication request asked
	// to be bound; a grant that requested 'bound_key' and was granted only 'openid' carries both and is not key
	// bound.
	SetOIDCKeyBindingGranted(granted bool)

	// GetOIDCKeyBindingGranted returns whether the 'bound_key' scope was granted for this grant.
	GetOIDCKeyBindingGranted() (granted bool)
}

DPoPBoundSession is implemented by sessions that can be bound to a DPoP proof-of-possession key.

type DPoPClient added in v0.2.37 

type DPoPClient interface {
	// GetEnableDPoPBoundAccessTokens returns the 'dpop_bound_access_tokens' client metadata value. When true, DPoP is
	// required for this client.
	GetEnableDPoPBoundAccessTokens() (enable bool)

	Client
}

DPoPClient represents a client that can advertise the 'dpop_bound_access_tokens' metadata value per RFC 9449.

type DPoPConfigProvider added in v0.2.37 

type DPoPConfigProvider interface {
	// GetDPoPEnabled returns true if DPoP handling is enabled.
	GetDPoPEnabled(ctx context.Context) (enabled bool)

	// GetDPoPEnforce returns true if DPoP is required for all clients regardless of client metadata.
	GetDPoPEnforce(ctx context.Context) (enforce bool)

	// GetDPoPAllowedJWSAlgorithms returns the permitted asymmetric DPoP proof signing algorithms.
	GetDPoPAllowedJWSAlgorithms(ctx context.Context) (algs []string)

	// GetDPoPClockSkew returns the tolerance allowed for disagreement between this server's clock and the client's
	// when judging a DPoP proof's 'iat' claim. It widens the acceptance window at both ends and is not itself a
	// lifespan; see GetDPoPProofLifespan for that.
	GetDPoPClockSkew(ctx context.Context) (skew time.Duration)

	// GetDPoPProofLifespan returns how long a DPoP proof remains valid after the 'iat' it was minted with.
	//
	// Together with GetDPoPClockSkew this fixes the acceptance window: a proof is accepted from one clock skew
	// before its 'iat' until one lifespan plus one clock skew after it.
	GetDPoPProofLifespan(ctx context.Context) (lifespan time.Duration)

	// GetDPoPNonceRequired returns true if a server nonce is required in DPoP proofs.
	GetDPoPNonceRequired(ctx context.Context) (required bool)

	// GetDPoPNonceLifespan returns the lifespan of issued DPoP server nonces.
	GetDPoPNonceLifespan(ctx context.Context) (lifespan time.Duration)

	// GetDPoPStrategy returns the configured DPoP strategy, or nil when DPoP is not wired.
	GetDPoPStrategy(ctx context.Context) (strategy DPoPStrategy)
}

DPoPConfigProvider is the configuration provider for RFC 9449 DPoP.

type DPoPProof added in v0.2.37 

type DPoPProof struct {
	// Thumbprint is the RFC 7638 base64url SHA-256 JWK Thumbprint (jkt) of the proof's public key.
	Thumbprint string

	// JWK is the public key from the proof's 'jwk' header, of which Thumbprint is the RFC 7638 digest. It is
	// required by OpenID Connect Key Binding 1.0 Section 4, which puts the key itself into the ID Token's 'cnf'
	// claim rather than its thumbprint.
	JWK *jose.JSONWebKey

	// ID is the 'jti' claim.
	ID string

	// Method is the 'htm' claim (the HTTP method).
	Method string

	// URL is the 'htu' claim (the HTTP target URI without query or fragment).
	URL string

	// Nonce is the 'nonce' claim, if present.
	Nonce string

	// AccessTokenHash is the 'ath' claim, if present. Unused on the authorization-server side.
	AccessTokenHash string

	// CodeHash is the 'c_s256' claim, if present. It is defined by OpenID Connect Key Binding 1.0 Section 2.3
	// rather than by RFC 9449, and no RFC 9449 handler reads it; see handler/oidckb.
	CodeHash string

	// IssuedAt is the 'iat' claim.
	IssuedAt time.Time
}

DPoPProof is the validated result of a RFC 9449 DPoP proof JWT.

func GetDPoPProof added in v0.3.1 

func GetDPoPProof(ctx context.Context) (proof *DPoPProof)

GetDPoPProof returns the proof published for this request, or nil when none was published.

A returned proof has passed every check RFC 9449 Section 5 requires and matched any binding the grant already carried; see the publish site in handler/rfc9449.

type DPoPProofHolder added in v0.3.1 

type DPoPProofHolder struct {
	// Proof is the validated proof, or nil when no handler has published one.
	Proof *DPoPProof
}

DPoPProofHolder carries a validated RFC 9449 DPoP proof between the token endpoint binding handlers of a single request.

It is deliberately not part of any session. A proof's 'jti', 'iat' and 'nonce' are per-request values, so a session field would persist replay detection state with the grant, where it means nothing once the request has ended.

type DPoPResourceStrategy added in v0.3.0 

type DPoPResourceStrategy interface {
	// ValidateResourceAccess performs the RFC 9449 7.1/7.2 resource-server checks for a DPoP-bound access token. It
	// verifies the token was presented under the DPoP scheme, that the proof covers this request and this token via
	// the 'ath' claim, and that the proof key is the key the token is bound to.
	ValidateResourceAccess(ctx context.Context, r *http.Request, accessToken, boundJKT string, requireNonce bool) (parsed *DPoPProof, err error)
}

DPoPResourceStrategy is the resource-server half of the RFC 9449 strategy, which an endpoint accepting an access token as a credential needs and DPoPStrategy - the type GetDPoPStrategy returns - does not declare. *rfc9449.DefaultStrategy implements it; the assertion is made at the point of use rather than by widening DPoPStrategy so a deployment supplying its own strategy is not broken by a method it has no bound tokens to serve.

type DPoPStrategy added in v0.2.37 

type DPoPStrategy interface {
	// ValidateDPoPProof parses and validates the compact proof JWT against the request method and url. When
	// requireNonce is true, a valid 'nonce' claim is mandatory. It returns the validated proof or an error that wraps
	// ErrInvalidDPoPProof or ErrUseDPoPNonce.
	ValidateDPoPProof(ctx context.Context, method, url, proof string, requireNonce bool) (parsed *DPoPProof, err error)

	// NewDPoPNonce issues, persists, and returns a fresh server nonce.
	NewDPoPNonce(ctx context.Context) (nonce string, err error)

	// ValidateDPoPNonce returns nil when the nonce exists and is unexpired, otherwise an error wrapping ErrUseDPoPNonce.
	ValidateDPoPNonce(ctx context.Context, nonce string) (err error)
}

DPoPStrategy validates DPoP proofs and manages server-provided nonces per RFC 9449.

type DebugRFC6749Error 

type DebugRFC6749Error struct {
	*RFC6749Error
}

DebugRFC6749Error is a decorator type which makes the underlying *RFC6749Error expose debug information and show the full error description.

func (*DebugRFC6749Error) Error 

func (err *DebugRFC6749Error) Error() string

Error implements the builtin error interface and shows the error with its debug info and description.

type DefaultBackChannelLogoutClient added in v0.3.0 

type DefaultBackChannelLogoutClient struct {
	BackChannelLogoutURI             string `json:"backchannel_logout_uri"`
	BackChannelLogoutSessionRequired bool   `json:"backchannel_logout_session_required"`

	*DefaultClient
}

func (*DefaultBackChannelLogoutClient) GetBackChannelLogoutSessionRequired added in v0.3.0 

func (c *DefaultBackChannelLogoutClient) GetBackChannelLogoutSessionRequired() (required bool)

func (*DefaultBackChannelLogoutClient) GetBackChannelLogoutURI added in v0.3.0 

func (c *DefaultBackChannelLogoutClient) GetBackChannelLogoutURI() (uri string)

type DefaultClient 

type DefaultClient struct {
	ID                                    string         `json:"id"`
	ClientSecret                          ClientSecret   `json:"-"`
	RotatedClientSecrets                  []ClientSecret `json:"-"`
	RedirectURIs                          []string       `json:"redirect_uris"`
	GrantTypes                            []string       `json:"grant_types"`
	ResponseTypes                         []string       `json:"response_types"`
	Scopes                                []string       `json:"scopes"`
	Audience                              []string       `json:"audience"`
	Public                                bool           `json:"public"`
	DPoPBoundAccessTokens                 bool           `json:"dpop_bound_access_tokens"`
	TLSClientCertificateBoundAccessTokens bool           `json:"tls_client_certificate_bound_access_tokens"`
}

DefaultClient is a simple default implementation of the Client interface.

func (*DefaultClient) GetAudience 

func (c *DefaultClient) GetAudience() Arguments

func (*DefaultClient) GetClientSecret 

func (c *DefaultClient) GetClientSecret() (secret ClientSecret)

func (*DefaultClient) GetClientSecretPlainText added in v0.2.0 

func (c *DefaultClient) GetClientSecretPlainText() (secret []byte, ok bool, err error)

func (*DefaultClient) GetEnableDPoPBoundAccessTokens added in v0.2.37 

func (c *DefaultClient) GetEnableDPoPBoundAccessTokens() bool

func (*DefaultClient) GetEnableTLSClientAuthBoundAccessTokens added in v0.3.0 

func (c *DefaultClient) GetEnableTLSClientAuthBoundAccessTokens() bool

func (*DefaultClient) GetGrantTypes 

func (c *DefaultClient) GetGrantTypes() Arguments

func (*DefaultClient) GetID 

func (c *DefaultClient) GetID() string

func (*DefaultClient) GetRedirectURIs 

func (c *DefaultClient) GetRedirectURIs() []string

func (*DefaultClient) GetResponseTypes 

func (c *DefaultClient) GetResponseTypes() Arguments

func (*DefaultClient) GetRotatedClientSecrets 

func (c *DefaultClient) GetRotatedClientSecrets() (secrets []ClientSecret)

func (*DefaultClient) GetScopes 

func (c *DefaultClient) GetScopes() Arguments

func (*DefaultClient) IsPublic 

func (c *DefaultClient) IsPublic() bool

type DefaultClientAuthenticationStrategy 

type DefaultClientAuthenticationStrategy struct {
	Store interface {
		ClientManager
	}
	Config interface {
		JWTStrategyProvider
		JWKSFetcherStrategyProvider
		AllowedJWTAssertionAudiencesProvider
		JWTClockSkewProvider
		MTLSConfigProvider
	}
}

func (*DefaultClientAuthenticationStrategy) AuthenticateClient 

func (s *DefaultClientAuthenticationStrategy) AuthenticateClient(ctx context.Context, r *http.Request, form url.Values, strategy EndpointClientAuthStrategy) (client Client, method string, err error)

type DefaultClientWithCustomTokenLifespans 

type DefaultClientWithCustomTokenLifespans struct {
	*DefaultClient
	TokenLifespans *ClientLifespanConfig `json:"token_lifespans"`
}

func (*DefaultClientWithCustomTokenLifespans) GetEffectiveLifespan 

func (c *DefaultClientWithCustomTokenLifespans) GetEffectiveLifespan(gt GrantType, tt TokenType, fallback time.Duration) time.Duration

GetEffectiveLifespan either maps GrantType x TokenType to the client's configured lifespan, or returns the fallback value.

TODO: Refactor time permitting.

func (*DefaultClientWithCustomTokenLifespans) GetTokenLifespans 

func (c *DefaultClientWithCustomTokenLifespans) GetTokenLifespans() *ClientLifespanConfig

func (*DefaultClientWithCustomTokenLifespans) SetTokenLifespans 

func (c *DefaultClientWithCustomTokenLifespans) SetTokenLifespans(lifespans *ClientLifespanConfig)

type DefaultJARClient added in v0.1.15 

type DefaultJARClient struct {
	JSONWebKeysURI                      string              `json:"jwks_uri"`
	JSONWebKeys                         *jose.JSONWebKeySet `json:"jwks"`
	TokenEndpointAuthMethod             string              `json:"token_endpoint_auth_method"`
	IntrospectionEndpointAuthMethod     string              `json:"introspection_endpoint_auth_method"`
	RevocationEndpointAuthMethod        string              `json:"revocation_endpoint_auth_method"`
	RequestURIs                         []string            `json:"request_uris"`
	RequireSignedRequestObject          bool                `json:"require_signed_request_object"`
	RequestObjectSigningKeyID           string              `json:"request_object_signing_kid"`
	RequestObjectSigningAlg             string              `json:"request_object_signing_alg"`
	RequestObjectEncryptionKeyID        string              `json:"request_object_encryption_kid"`
	RequestObjectEncryptionAlg          string              `json:"request_object_encryption_alg"`
	RequestObjectEncryptionEnc          string              `json:"request_object_encryption_enc"`
	TokenEndpointAuthSigningAlg         string              `json:"token_endpoint_auth_signing_alg"`
	IntrospectionEndpointAuthSigningAlg string              `json:"introspection_endpoint_auth_signing_alg"`
	RevocationEndpointAuthSigningAlg    string              `json:"revocation_endpoint_auth_signing_alg"`

	RequireRequestObjectAudienceAndLifetime bool          `json:"-"`
	RequestObjectMaximumLifetime            time.Duration `json:"-"`

	*DefaultClient
}

func (*DefaultJARClient) GetIntrospectionEndpointAuthMethod added in v0.1.15 

func (c *DefaultJARClient) GetIntrospectionEndpointAuthMethod() string

func (*DefaultJARClient) GetIntrospectionEndpointAuthSigningAlg added in v0.1.15 

func (c *DefaultJARClient) GetIntrospectionEndpointAuthSigningAlg() string

func (*DefaultJARClient) GetJSONWebKeys added in v0.1.15 

func (c *DefaultJARClient) GetJSONWebKeys() *jose.JSONWebKeySet

func (*DefaultJARClient) GetJSONWebKeysURI added in v0.1.15 

func (c *DefaultJARClient) GetJSONWebKeysURI() string

func (*DefaultJARClient) GetRequestObjectEncryptionAlg added in v0.1.15 

func (c *DefaultJARClient) GetRequestObjectEncryptionAlg() string

func (*DefaultJARClient) GetRequestObjectEncryptionEnc added in v0.1.15 

func (c *DefaultJARClient) GetRequestObjectEncryptionEnc() string

func (*DefaultJARClient) GetRequestObjectEncryptionKeyID added in v0.1.15 

func (c *DefaultJARClient) GetRequestObjectEncryptionKeyID() string

func (*DefaultJARClient) GetRequestObjectMaximumLifetime added in v0.3.3 

func (c *DefaultJARClient) GetRequestObjectMaximumLifetime() time.Duration

func (*DefaultJARClient) GetRequestObjectSigningAlg added in v0.1.15 

func (c *DefaultJARClient) GetRequestObjectSigningAlg() string

func (*DefaultJARClient) GetRequestObjectSigningKeyID added in v0.1.15 

func (c *DefaultJARClient) GetRequestObjectSigningKeyID() string

func (*DefaultJARClient) GetRequestURIs added in v0.1.15 

func (c *DefaultJARClient) GetRequestURIs() []string

func (*DefaultJARClient) GetRequireRequestObjectAudienceAndLifetime added in v0.3.3 

func (c *DefaultJARClient) GetRequireRequestObjectAudienceAndLifetime() bool

func (*DefaultJARClient) GetRequireSignedRequestObject added in v0.3.0 

func (c *DefaultJARClient) GetRequireSignedRequestObject() bool

func (*DefaultJARClient) GetRevocationEndpointAuthMethod added in v0.1.15 

func (c *DefaultJARClient) GetRevocationEndpointAuthMethod() string

func (*DefaultJARClient) GetRevocationEndpointAuthSigningAlg added in v0.1.15 

func (c *DefaultJARClient) GetRevocationEndpointAuthSigningAlg() string

func (*DefaultJARClient) GetTokenEndpointAuthMethod added in v0.1.15 

func (c *DefaultJARClient) GetTokenEndpointAuthMethod() string

func (*DefaultJARClient) GetTokenEndpointAuthSigningAlg added in v0.1.15 

func (c *DefaultJARClient) GetTokenEndpointAuthSigningAlg() string

type DefaultJWKSFetcherStrategy 

type DefaultJWKSFetcherStrategy struct {
	// contains filtered or unexported fields
}

DefaultJWKSFetcherStrategy is a default implementation of the jwt.JWKSFetcherStrategy interface.

func (*DefaultJWKSFetcherStrategy) Resolve 

func (s *DefaultJWKSFetcherStrategy) Resolve(ctx context.Context, location string, ignoreCache bool) (*jose.JSONWebKeySet, error)

Resolve returns the JSON Web Key Set, or an error if something went wrong. The forceRefresh, if true, forces the strategy to fetch the key from the remote. If forceRefresh is false, the strategy may use a caching strategy to fetch the key.

func (*DefaultJWKSFetcherStrategy) WaitForCache 

func (s *DefaultJWKSFetcherStrategy) WaitForCache()

WaitForCache blocks until the in-flight JWKS fetch (if any) has completed and the cache is consistent. It is intended for use in tests that need deterministic cache state before asserting behavior.

type DefaultMTLSClient added in v0.3.0 

type DefaultMTLSClient struct {
	TLSClientAuthSubjectDN string `json:"tls_client_auth_subject_dn"`
	TLSClientAuthSANDNS    string `json:"tls_client_auth_san_dns"`
	TLSClientAuthSANURI    string `json:"tls_client_auth_san_uri"`
	TLSClientAuthSANIP     string `json:"tls_client_auth_san_ip"`
	TLSClientAuthSANEmail  string `json:"tls_client_auth_san_email"`

	*DefaultJARClient
}

DefaultMTLSClient registers the RFC 8705 Section 2.1.2 certificate subject metadata required by the 'tls_client_auth' method.

It embeds *DefaultJARClient rather than *DefaultClient because both RFC 8705 authentication methods are unreachable without what that type supplies. A certificate is only counted as an authentication method when the client's registered '*_endpoint_auth_method' names one of them, which is read through AuthenticationMethodClient, and *DefaultClient does not implement it; so a DefaultMTLSClient embedding *DefaultClient could never present 'tls_client_auth' at all. The same embed supplies the 'jwks'/'jwks_uri' metadata that 'self_signed_tls_client_auth' reads the accepted certificates from per Section 2.2.2. *DefaultJARClient embeds *DefaultClient in turn, so every DefaultClient value and accessor remains available.

func (*DefaultMTLSClient) GetTLSClientAuthSANDNS added in v0.3.0 

func (c *DefaultMTLSClient) GetTLSClientAuthSANDNS() string

func (*DefaultMTLSClient) GetTLSClientAuthSANEmail added in v0.3.0 

func (c *DefaultMTLSClient) GetTLSClientAuthSANEmail() string

func (*DefaultMTLSClient) GetTLSClientAuthSANIP added in v0.3.0 

func (c *DefaultMTLSClient) GetTLSClientAuthSANIP() string

func (*DefaultMTLSClient) GetTLSClientAuthSANURI added in v0.3.0 

func (c *DefaultMTLSClient) GetTLSClientAuthSANURI() string

func (*DefaultMTLSClient) GetTLSClientAuthSubjectDN added in v0.3.0 

func (c *DefaultMTLSClient) GetTLSClientAuthSubjectDN() string

type DefaultRPInitiatedLogoutClient added in v0.3.0 

type DefaultRPInitiatedLogoutClient struct {
	PostLogoutRedirectURIs []string `json:"post_logout_redirect_uris"`

	*DefaultClient
}

func (*DefaultRPInitiatedLogoutClient) GetPostLogoutRedirectURIs added in v0.3.0 

func (c *DefaultRPInitiatedLogoutClient) GetPostLogoutRedirectURIs() (uris []string)

type DefaultRegisteredClient added in v0.3.0 

type DefaultRegisteredClient struct {
	*DefaultClient

	// ClientIDIssuedAt is the time at which the client identifier was issued. It is registration bookkeeping, not
	// client metadata.
	ClientIDIssuedAt time.Time

	// ClientSecretExpiresAt is the time at which the client secret will expire, or the zero value if it does not
	// expire. It is registration bookkeeping, not client metadata.
	ClientSecretExpiresAt time.Time

	TokenEndpointAuthMethod string              `json:"token_endpoint_auth_method"`
	ClientName              string              `json:"client_name"`
	ClientURI               string              `json:"client_uri"`
	LogoURI                 string              `json:"logo_uri"`
	Contacts                []string            `json:"contacts"`
	TOSURI                  string              `json:"tos_uri"`
	PolicyURI               string              `json:"policy_uri"`
	JSONWebKeysURI          string              `json:"jwks_uri"`
	JSONWebKeys             *jose.JSONWebKeySet `json:"jwks"`
	SoftwareID              string              `json:"software_id"`
	SoftwareStatement       string              `json:"software_statement"`
	SoftwareVersion         string              `json:"software_version"`

	ApplicationType              string   `json:"application_type"`
	SectorIdentifierURI          string   `json:"sector_identifier_uri"`
	SubjectType                  string   `json:"subject_type"`
	IDTokenSignedResponseAlg     string   `json:"id_token_signed_response_alg"`
	IDTokenEncryptedResponseAlg  string   `json:"id_token_encrypted_response_alg"`
	IDTokenEncryptedResponseEnc  string   `json:"id_token_encrypted_response_enc"`
	UserinfoSignedResponseAlg    string   `json:"userinfo_signed_response_alg"`
	UserinfoEncryptedResponseAlg string   `json:"userinfo_encrypted_response_alg"`
	UserinfoEncryptedResponseEnc string   `json:"userinfo_encrypted_response_enc"`
	RequestObjectSigningAlg      string   `json:"request_object_signing_alg"`
	RequestObjectEncryptionAlg   string   `json:"request_object_encryption_alg"`
	RequestObjectEncryptionEnc   string   `json:"request_object_encryption_enc"`
	TokenEndpointAuthSigningAlg  string   `json:"token_endpoint_auth_signing_alg"`
	DefaultMaxAge                *int64   `json:"default_max_age,omitempty"`
	RequireAuthTime              bool     `json:"require_auth_time"`
	DefaultACRValues             []string `json:"default_acr_values"`
	InitiateLoginURI             string   `json:"initiate_login_uri"`
	RequestURIs                  []string `json:"request_uris"`

	// RFC 8693 (OAuth 2.0 Token Exchange) restrictions. An empty value applies no restriction.
	TokenExchangeSubjectTokenTypes  []string `json:"token_exchange_subject_token_types"`
	TokenExchangeActorTokenTypes    []string `json:"token_exchange_actor_token_types"`
	TokenExchangeRequestTokenTypes  []string `json:"token_exchange_request_token_types"`
	TokenExchangePermittedClientIDs []string `json:"token_exchange_permitted_client_ids"`

	RequireSignedRequestObject bool `json:"require_signed_request_object"`

	PostLogoutRedirectURIs           []string `json:"post_logout_redirect_uris"`
	BackChannelLogoutURI             string   `json:"backchannel_logout_uri"`
	BackChannelLogoutSessionRequired bool     `json:"backchannel_logout_session_required"`

	TLSClientAuthSubjectDN string `json:"tls_client_auth_subject_dn"`
	TLSClientAuthSANDNS    string `json:"tls_client_auth_san_dns"`
	TLSClientAuthSANURI    string `json:"tls_client_auth_san_uri"`
	TLSClientAuthSANIP     string `json:"tls_client_auth_san_ip"`
	TLSClientAuthSANEmail  string `json:"tls_client_auth_san_email"`

	IDTokenSignedResponseKeyID          string             `json:"id_token_signed_response_kid"`
	IDTokenEncryptedResponseKeyID       string             `json:"id_token_encrypted_response_kid"`
	UserinfoSignedResponseKeyID         string             `json:"userinfo_signed_response_kid"`
	UserinfoEncryptedResponseKeyID      string             `json:"userinfo_encrypted_response_kid"`
	RequestObjectSigningKeyID           string             `json:"request_object_signing_kid"`
	RequestObjectEncryptionKeyID        string             `json:"request_object_encryption_kid"`
	AuthorizationSignedResponseKeyID    string             `json:"authorization_signed_response_kid"`
	AuthorizationSignedResponseAlg      string             `json:"authorization_signed_response_alg"`
	AuthorizationEncryptedResponseKeyID string             `json:"authorization_encrypted_response_kid"`
	AuthorizationEncryptedResponseAlg   string             `json:"authorization_encrypted_response_alg"`
	AuthorizationEncryptedResponseEnc   string             `json:"authorization_encrypted_response_enc"`
	IntrospectionSignedResponseKeyID    string             `json:"introspection_signed_response_kid"`
	IntrospectionSignedResponseAlg      string             `json:"introspection_signed_response_alg"`
	IntrospectionEncryptedResponseKeyID string             `json:"introspection_encrypted_response_kid"`
	IntrospectionEncryptedResponseAlg   string             `json:"introspection_encrypted_response_alg"`
	IntrospectionEncryptedResponseEnc   string             `json:"introspection_encrypted_response_enc"`
	AccessTokenSignedResponseKeyID      string             `json:"access_token_signed_response_kid"`
	AccessTokenSignedResponseAlg        string             `json:"access_token_signed_response_alg"`
	AccessTokenEncryptedResponseKeyID   string             `json:"access_token_encrypted_response_kid"`
	AccessTokenEncryptedResponseAlg     string             `json:"access_token_encrypted_response_alg"`
	AccessTokenEncryptedResponseEnc     string             `json:"access_token_encrypted_response_enc"`
	IntrospectionEndpointAuthMethod     string             `json:"introspection_endpoint_auth_method"`
	IntrospectionEndpointAuthSigningAlg string             `json:"introspection_endpoint_auth_signing_alg"`
	RevocationEndpointAuthMethod        string             `json:"revocation_endpoint_auth_method"`
	RevocationEndpointAuthSigningAlg    string             `json:"revocation_endpoint_auth_signing_alg"`
	RequirePushedAuthorizationRequests  bool               `json:"require_pushed_authorization_requests"`
	ResponseModes                       []ResponseModeType `json:"response_modes"`

	EnableJWTProfileOAuthAccessTokens bool          `json:"-"`
	EnforcePKCE                       bool          `json:"-"`
	EnforcePKCEChallengeMethod        bool          `json:"-"`
	PKCEChallengeMethod               string        `json:"-"`
	PushedAuthorizeContextLifespan    time.Duration `json:"-"`

	RequireRedirectURIPushedAuthorizationRequests bool          `json:"-"`
	RequireRequestObjectAudienceAndLifetime       bool          `json:"-"`
	RequestObjectMaximumLifetime                  time.Duration `json:"-"`
	DisableRefreshTokenRotation                   bool          `json:"-"`

	// Extra holds every unregistered client metadata parameter carried by ClientRegistrationMetadata.Extra so it can
	// survive a registration round trip. This type only provides the storage location; converting to and from
	// ClientRegistrationMetadata.Extra is not this type's responsibility.
	Extra map[string]any `json:"-"`
}

DefaultRegisteredClient is a Client implementation capable of holding every client metadata value defined by OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591), OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592), and OpenID Connect Dynamic Client Registration 1.0. It is the concrete client type produced by dynamic client registration; see ClientRegistrationMetadata for the wire format this type is populated from.

func (*DefaultRegisteredClient) GetAccessTokenEncryptedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetAccessTokenEncryptedResponseAlg() string

func (*DefaultRegisteredClient) GetAccessTokenEncryptedResponseEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetAccessTokenEncryptedResponseEnc() string

func (*DefaultRegisteredClient) GetAccessTokenEncryptedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetAccessTokenEncryptedResponseKeyID() string

func (*DefaultRegisteredClient) GetAccessTokenSignedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetAccessTokenSignedResponseAlg() string

func (*DefaultRegisteredClient) GetAccessTokenSignedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetAccessTokenSignedResponseKeyID() string

func (*DefaultRegisteredClient) GetAllowActorTokenWithoutMayAct added in v0.3.0 

func (c *DefaultRegisteredClient) GetAllowActorTokenWithoutMayAct() (allow bool)

GetAllowActorTokenWithoutMayAct reports false: delegation on a subject token carrying no 'may_act' claim requires an out-of-band authorization mechanism, which registered metadata cannot express.

func (*DefaultRegisteredClient) GetAuthorizationEncryptedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetAuthorizationEncryptedResponseAlg() string

func (*DefaultRegisteredClient) GetAuthorizationEncryptedResponseEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetAuthorizationEncryptedResponseEnc() string

func (*DefaultRegisteredClient) GetAuthorizationEncryptedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetAuthorizationEncryptedResponseKeyID() string

func (*DefaultRegisteredClient) GetAuthorizationSignedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetAuthorizationSignedResponseAlg() string

func (*DefaultRegisteredClient) GetAuthorizationSignedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetAuthorizationSignedResponseKeyID() string

func (*DefaultRegisteredClient) GetBackChannelLogoutSessionRequired added in v0.3.0 

func (c *DefaultRegisteredClient) GetBackChannelLogoutSessionRequired() (required bool)

func (*DefaultRegisteredClient) GetBackChannelLogoutURI added in v0.3.0 

func (c *DefaultRegisteredClient) GetBackChannelLogoutURI() (uri string)

func (*DefaultRegisteredClient) GetClientIDIssuedAt added in v0.3.0 

func (c *DefaultRegisteredClient) GetClientIDIssuedAt() (issued time.Time)

GetClientIDIssuedAt returns the time the client identifier was issued, or the zero time when it is not recorded.

func (*DefaultRegisteredClient) GetClientSecretExpiresAt added in v0.3.0 

func (c *DefaultRegisteredClient) GetClientSecretExpiresAt() (expires time.Time)

GetClientSecretExpiresAt returns the time the client secret expires, or the zero time when it does not.

func (*DefaultRegisteredClient) GetDisableRefreshTokenRotation added in v0.3.3 

func (c *DefaultRegisteredClient) GetDisableRefreshTokenRotation() bool

func (*DefaultRegisteredClient) GetEnableJWTProfileOAuthAccessTokens added in v0.3.0 

func (c *DefaultRegisteredClient) GetEnableJWTProfileOAuthAccessTokens() bool

func (*DefaultRegisteredClient) GetEnforcePKCE added in v0.3.0 

func (c *DefaultRegisteredClient) GetEnforcePKCE() bool

func (*DefaultRegisteredClient) GetEnforcePKCEChallengeMethod added in v0.3.0 

func (c *DefaultRegisteredClient) GetEnforcePKCEChallengeMethod() bool

func (*DefaultRegisteredClient) GetIDTokenEncryptedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetIDTokenEncryptedResponseAlg() string

func (*DefaultRegisteredClient) GetIDTokenEncryptedResponseEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetIDTokenEncryptedResponseEnc() string

func (*DefaultRegisteredClient) GetIDTokenEncryptedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetIDTokenEncryptedResponseKeyID() string

func (*DefaultRegisteredClient) GetIDTokenSignedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetIDTokenSignedResponseAlg() string

GetIDTokenSignedResponseAlg returns the 'id_token_signed_response_alg' value, defaulting to RS256 when unset per OpenID Connect Dynamic Client Registration 1.0's stated default.

func (*DefaultRegisteredClient) GetIDTokenSignedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetIDTokenSignedResponseKeyID() string

func (*DefaultRegisteredClient) GetIntrospectionEncryptedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionEncryptedResponseAlg() string

func (*DefaultRegisteredClient) GetIntrospectionEncryptedResponseEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionEncryptedResponseEnc() string

func (*DefaultRegisteredClient) GetIntrospectionEncryptedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionEncryptedResponseKeyID() string

func (*DefaultRegisteredClient) GetIntrospectionEndpointAuthMethod added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionEndpointAuthMethod() string

GetIntrospectionEndpointAuthMethod returns the 'introspection_endpoint_auth_method' value, falling back to the client's token endpoint method when unset. No specification defines a default for this value, so the choice is this implementation's: inheriting keeps a single registered method meaningful at every endpoint, where returning an empty value would instead mean no method is registered and so let the introspection endpoint accept any authenticated method - widening what the client asked for rather than honouring it.

func (*DefaultRegisteredClient) GetIntrospectionEndpointAuthSigningAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionEndpointAuthSigningAlg() string

func (*DefaultRegisteredClient) GetIntrospectionSignedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionSignedResponseAlg() string

func (*DefaultRegisteredClient) GetIntrospectionSignedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetIntrospectionSignedResponseKeyID() string

func (*DefaultRegisteredClient) GetJSONWebKeys added in v0.3.0 

func (c *DefaultRegisteredClient) GetJSONWebKeys() *jose.JSONWebKeySet

func (*DefaultRegisteredClient) GetJSONWebKeysURI added in v0.3.0 

func (c *DefaultRegisteredClient) GetJSONWebKeysURI() string

func (*DefaultRegisteredClient) GetPKCEChallengeMethod added in v0.3.0 

func (c *DefaultRegisteredClient) GetPKCEChallengeMethod() string

func (*DefaultRegisteredClient) GetPostLogoutRedirectURIs added in v0.3.0 

func (c *DefaultRegisteredClient) GetPostLogoutRedirectURIs() (uris []string)

func (*DefaultRegisteredClient) GetPushedAuthorizeContextLifespan added in v0.3.0 

func (c *DefaultRegisteredClient) GetPushedAuthorizeContextLifespan() time.Duration

func (*DefaultRegisteredClient) GetRequestObjectEncryptionAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestObjectEncryptionAlg() string

func (*DefaultRegisteredClient) GetRequestObjectEncryptionEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestObjectEncryptionEnc() string

func (*DefaultRegisteredClient) GetRequestObjectEncryptionKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestObjectEncryptionKeyID() string

func (*DefaultRegisteredClient) GetRequestObjectMaximumLifetime added in v0.3.3 

func (c *DefaultRegisteredClient) GetRequestObjectMaximumLifetime() time.Duration

func (*DefaultRegisteredClient) GetRequestObjectSigningAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestObjectSigningAlg() string

func (*DefaultRegisteredClient) GetRequestObjectSigningKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestObjectSigningKeyID() string

func (*DefaultRegisteredClient) GetRequestURIs added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequestURIs() []string

func (*DefaultRegisteredClient) GetRequirePushedAuthorizationRequests added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequirePushedAuthorizationRequests() bool

func (*DefaultRegisteredClient) GetRequireRedirectURIPushedAuthorizationRequests added in v0.3.3 

func (c *DefaultRegisteredClient) GetRequireRedirectURIPushedAuthorizationRequests() bool

func (*DefaultRegisteredClient) GetRequireRequestObjectAudienceAndLifetime added in v0.3.3 

func (c *DefaultRegisteredClient) GetRequireRequestObjectAudienceAndLifetime() bool

func (*DefaultRegisteredClient) GetRequireSignedRequestObject added in v0.3.0 

func (c *DefaultRegisteredClient) GetRequireSignedRequestObject() bool

func (*DefaultRegisteredClient) GetResponseModes added in v0.3.0 

func (c *DefaultRegisteredClient) GetResponseModes() []ResponseModeType

func (*DefaultRegisteredClient) GetRevocationEndpointAuthMethod added in v0.3.0 

func (c *DefaultRegisteredClient) GetRevocationEndpointAuthMethod() string

GetRevocationEndpointAuthMethod returns the 'revocation_endpoint_auth_method' value, falling back to the client's token endpoint method when unset, for the reasons given on GetIntrospectionEndpointAuthMethod.

func (*DefaultRegisteredClient) GetRevocationEndpointAuthSigningAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetRevocationEndpointAuthSigningAlg() string

func (*DefaultRegisteredClient) GetSupportedActorTokenIssuers added in v0.3.0 

func (c *DefaultRegisteredClient) GetSupportedActorTokenIssuers() (issuers []string)

GetSupportedActorTokenIssuers returns no per-client issuer restriction, deferring to the token type's own issuer setting as the interface documents. There is no registered metadata for it.

func (*DefaultRegisteredClient) GetSupportedActorTokenTypes added in v0.3.0 

func (c *DefaultRegisteredClient) GetSupportedActorTokenTypes() (types []string)

GetSupportedActorTokenTypes returns the RFC 8693 'actor_token_type' values this client may present. Empty applies no restriction.

func (*DefaultRegisteredClient) GetSupportedRequestTokenTypes added in v0.3.0 

func (c *DefaultRegisteredClient) GetSupportedRequestTokenTypes() (types []string)

GetSupportedRequestTokenTypes returns the RFC 8693 'requested_token_type' values this client may ask for. Empty applies no restriction.

func (*DefaultRegisteredClient) GetSupportedSubjectTokenIssuers added in v0.3.0 

func (c *DefaultRegisteredClient) GetSupportedSubjectTokenIssuers() (issuers []string)

GetSupportedSubjectTokenIssuers returns no per-client issuer restriction, deferring to the token type's own issuer setting as the interface documents. There is no registered metadata for it.

func (*DefaultRegisteredClient) GetSupportedSubjectTokenTypes added in v0.3.0 

func (c *DefaultRegisteredClient) GetSupportedSubjectTokenTypes() (types []string)

GetSupportedSubjectTokenTypes returns the RFC 8693 'subject_token_type' values this client may present. Empty applies no restriction.

func (*DefaultRegisteredClient) GetTLSClientAuthSANDNS added in v0.3.0 

func (c *DefaultRegisteredClient) GetTLSClientAuthSANDNS() (dns string)

func (*DefaultRegisteredClient) GetTLSClientAuthSANEmail added in v0.3.0 

func (c *DefaultRegisteredClient) GetTLSClientAuthSANEmail() (email string)

func (*DefaultRegisteredClient) GetTLSClientAuthSANIP added in v0.3.0 

func (c *DefaultRegisteredClient) GetTLSClientAuthSANIP() (ip string)

func (*DefaultRegisteredClient) GetTLSClientAuthSANURI added in v0.3.0 

func (c *DefaultRegisteredClient) GetTLSClientAuthSANURI() (uri string)

func (*DefaultRegisteredClient) GetTLSClientAuthSubjectDN added in v0.3.0 

func (c *DefaultRegisteredClient) GetTLSClientAuthSubjectDN() (dn string)

func (*DefaultRegisteredClient) GetTokenEndpointAuthMethod added in v0.3.0 

func (c *DefaultRegisteredClient) GetTokenEndpointAuthMethod() string

GetTokenEndpointAuthMethod returns the 'token_endpoint_auth_method' value, defaulting to client_secret_basic when unset per OpenID Connect Dynamic Client Registration 1.0 Section 2.

func (*DefaultRegisteredClient) GetTokenEndpointAuthSigningAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetTokenEndpointAuthSigningAlg() string

func (*DefaultRegisteredClient) GetTokenExchangePermitted added in v0.3.0 

func (c *DefaultRegisteredClient) GetTokenExchangePermitted(client Client, requestedTokenType RFC8693TokenType) (allowed bool)

GetTokenExchangePermitted reports whether client may exchange a token issued to this one, per RFC 8693 Section 5's recommendation that the exchange be restricted "to only those clients explicitly authorized to perform the exchange operation".

An empty list permits any client, which is how a client expressing no policy behaves; the requested token type is not consulted, so a deployment needing a rule of that shape supplies its own client type.

func (*DefaultRegisteredClient) GetUserinfoEncryptedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetUserinfoEncryptedResponseAlg() string

func (*DefaultRegisteredClient) GetUserinfoEncryptedResponseEnc added in v0.3.0 

func (c *DefaultRegisteredClient) GetUserinfoEncryptedResponseEnc() string

func (*DefaultRegisteredClient) GetUserinfoEncryptedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetUserinfoEncryptedResponseKeyID() string

func (*DefaultRegisteredClient) GetUserinfoSignedResponseAlg added in v0.3.0 

func (c *DefaultRegisteredClient) GetUserinfoSignedResponseAlg() string

func (*DefaultRegisteredClient) GetUserinfoSignedResponseKeyID added in v0.3.0 

func (c *DefaultRegisteredClient) GetUserinfoSignedResponseKeyID() string

type DefaultResponseModeClient 

type DefaultResponseModeClient struct {
	ResponseModes []ResponseModeType `json:"response_modes"`

	*DefaultClient
}

func (*DefaultResponseModeClient) GetResponseModes 

func (c *DefaultResponseModeClient) GetResponseModes() []ResponseModeType

type DefaultResponseModeHandler 

type DefaultResponseModeHandler struct {
	Config ResponseModeHandlerConfigurator
}

func (*DefaultResponseModeHandler) EncodeResponseForm 

func (h *DefaultResponseModeHandler) EncodeResponseForm(ctx context.Context, rm ResponseModeType, request AuthorizeRequester, parameters url.Values) (form url.Values, err error)

EncodeResponseForm encodes the response form if necessary.

func (*DefaultResponseModeHandler) ResponseModes 

func (h *DefaultResponseModeHandler) ResponseModes() ResponseModeTypes

ResponseModes returns the response modes this fosite.ResponseModeHandler is responsible for.

func (*DefaultResponseModeHandler) WriteAuthorizeError 

func (h *DefaultResponseModeHandler) WriteAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, e error)

WriteAuthorizeError writes authorization errors.

func (*DefaultResponseModeHandler) WriteAuthorizeResponse 

func (h *DefaultResponseModeHandler) WriteAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, response AuthorizeResponder)

WriteAuthorizeResponse writes authorization responses.

type DefaultSession 

type DefaultSession struct {
	// ExpiresAt maps each token type to its expiration time.
	ExpiresAt map[TokenType]time.Time `json:"expires_at"`

	// Username is the subject's username. It is optional and only used during token introspection.
	Username string `json:"username"`

	// Subject is the subject's identifier. It is optional and only used during token introspection.
	Subject string `json:"subject"`

	// Extra holds arbitrary additional claims associated with the session.
	Extra map[string]any `json:"extra"`

	// JWKThumbprint is the RFC 7638 JWK Thumbprint (jkt) this session's tokens are DPoP bound to, if any.
	JWKThumbprint string `json:"jwk_thumbprint,omitempty"`

	// ClientCertificateThumbprint is the RFC 8705 X.509 SHA-256 certificate thumbprint (x5t#S256) this session's
	// tokens are bound to, if any.
	ClientCertificateThumbprint string `json:"client_certificate_thumbprint,omitempty"`

	// PublicKeyJWK is the raw JWK JSON of the DPoP proof-of-possession public key this session's ID Tokens are
	// bound to, if any.
	PublicKeyJWK []byte `json:"public_key_jwk,omitempty"`

	// RequestedJWKThumbprint is the RFC 9449 Section 10.1 'dpop_jkt' the authentication request carried, if any.
	RequestedJWKThumbprint string `json:"requested_jwk_thumbprint,omitempty"`

	// KeyBindingGranted records that the 'bound_key' scope was granted, so this grant's ID Tokens are key bound.
	KeyBindingGranted bool `json:"key_binding_granted,omitempty"`
}

DefaultSession is a default implementation of the Session interface.

func (*DefaultSession) Clone 

func (s *DefaultSession) Clone() Session

Clone returns a deep copy of the session, or nil if the receiver is nil.

func (*DefaultSession) GetClientCertificateSHA256Thumbprint added in v0.3.0 

func (s *DefaultSession) GetClientCertificateSHA256Thumbprint() string

GetClientCertificateSHA256Thumbprint implements MTLSBoundSession for DefaultSession.

func (*DefaultSession) GetDPoPJWKThumbprint added in v0.2.37 

func (s *DefaultSession) GetDPoPJWKThumbprint() string

GetDPoPJWKThumbprint implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) GetDPoPPublicKeyJWK added in v0.3.1 

func (s *DefaultSession) GetDPoPPublicKeyJWK() (jwk []byte)

GetDPoPPublicKeyJWK implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) GetExpiresAt 

func (s *DefaultSession) GetExpiresAt(key TokenType) time.Time

GetExpiresAt returns the expiration time of the token identified by key, or the zero time if it is not set.

func (*DefaultSession) GetExtraClaims 

func (s *DefaultSession) GetExtraClaims() map[string]any

GetExtraClaims implements ExtraClaimsSession for DefaultSession. The returned value can be modified in-place.

func (*DefaultSession) GetOIDCKeyBindingGranted added in v0.3.1 

func (s *DefaultSession) GetOIDCKeyBindingGranted() (granted bool)

GetOIDCKeyBindingGranted implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) GetRequestedDPoPJWKThumbprint added in v0.3.1 

func (s *DefaultSession) GetRequestedDPoPJWKThumbprint() (jkt string)

GetRequestedDPoPJWKThumbprint implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) GetSubject 

func (s *DefaultSession) GetSubject() string

GetSubject returns the subject, or an empty string if it is not set.

func (*DefaultSession) GetUsername 

func (s *DefaultSession) GetUsername() string

GetUsername returns the username, or an empty string if it is not set.

func (*DefaultSession) SetClientCertificateSHA256Thumbprint added in v0.3.0 

func (s *DefaultSession) SetClientCertificateSHA256Thumbprint(x5t string)

SetClientCertificateSHA256Thumbprint implements MTLSBoundSession for DefaultSession.

func (*DefaultSession) SetDPoPJWKThumbprint added in v0.2.37 

func (s *DefaultSession) SetDPoPJWKThumbprint(jkt string)

SetDPoPJWKThumbprint implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) SetDPoPPublicKeyJWK added in v0.3.1 

func (s *DefaultSession) SetDPoPPublicKeyJWK(jwk []byte)

SetDPoPPublicKeyJWK implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) SetExpiresAt 

func (s *DefaultSession) SetExpiresAt(key TokenType, exp time.Time)

SetExpiresAt sets the expiration time of the token identified by key.

func (*DefaultSession) SetOIDCKeyBindingGranted added in v0.3.1 

func (s *DefaultSession) SetOIDCKeyBindingGranted(granted bool)

SetOIDCKeyBindingGranted implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) SetRequestedDPoPJWKThumbprint added in v0.3.1 

func (s *DefaultSession) SetRequestedDPoPJWKThumbprint(jkt string)

SetRequestedDPoPJWKThumbprint implements DPoPBoundSession for DefaultSession.

func (*DefaultSession) SetSubject 

func (s *DefaultSession) SetSubject(subject string)

SetSubject sets the subject's identifier.

type DeviceAuthorizeRequest 

type DeviceAuthorizeRequest struct {
	Request
	DeviceCodeSignature string
	UserCodeSignature   string
	Status              DeviceAuthorizeStatus
	LastChecked         time.Time
}

DeviceAuthorizeRequest is an implementation of DeviceAuthorizeRequester

func NewDeviceAuthorizeRequest 

func NewDeviceAuthorizeRequest() *DeviceAuthorizeRequest

NewDeviceAuthorizeRequest returns an empty DeviceAuthorizeRequest with its embedded Request initialized.

func (*DeviceAuthorizeRequest) GetDeviceCodeSignature 

func (d *DeviceAuthorizeRequest) GetDeviceCodeSignature() string

GetDeviceCodeSignature returns the device code signature

func (*DeviceAuthorizeRequest) GetLastChecked 

func (d *DeviceAuthorizeRequest) GetLastChecked() time.Time

GetLastChecked returns the time of the most recent token endpoint polling attempt for the request.

func (*DeviceAuthorizeRequest) GetStatus 

func (d *DeviceAuthorizeRequest) GetStatus() DeviceAuthorizeStatus

GetStatus returns the user authorization status (new, approved, or denied) for the device flow.

func (*DeviceAuthorizeRequest) GetUserCodeSignature 

func (d *DeviceAuthorizeRequest) GetUserCodeSignature() string

GetUserCodeSignature returns the user code signature

func (*DeviceAuthorizeRequest) Merge 

func (d *DeviceAuthorizeRequest) Merge(requester Requester)

Merge copies the requester data into this request. When requester is a *DeviceAuthorizeRequest the status, code signatures, and last-checked timestamp are also merged.

func (*DeviceAuthorizeRequest) SetDeviceCodeSignature 

func (d *DeviceAuthorizeRequest) SetDeviceCodeSignature(signature string)

SetDeviceCodeSignature set the device code signature

func (*DeviceAuthorizeRequest) SetLastChecked 

func (d *DeviceAuthorizeRequest) SetLastChecked(lastChecked time.Time)

SetLastChecked records the time of the most recent token endpoint polling attempt for the request. The value is normalized to UTC and is used by token endpoint handlers to enforce the polling interval.

func (*DeviceAuthorizeRequest) SetStatus 

func (d *DeviceAuthorizeRequest) SetStatus(status DeviceAuthorizeStatus)

SetStatus records the user authorization status (new, approved, or denied) for the device flow.

func (*DeviceAuthorizeRequest) SetUserCodeSignature 

func (d *DeviceAuthorizeRequest) SetUserCodeSignature(signature string)

SetUserCodeSignature set the user code signature

type DeviceAuthorizeRequester 

type DeviceAuthorizeRequester interface {
	// SetDeviceCodeSignature set the device code signature.
	SetDeviceCodeSignature(signature string)

	// GetDeviceCodeSignature returns the device code signature.
	GetDeviceCodeSignature() (signature string)

	// SetUserCodeSignature set the user code signature.
	SetUserCodeSignature(signature string)

	// GetUserCodeSignature returns the user code signature.
	GetUserCodeSignature() (signature string)

	SetStatus(status DeviceAuthorizeStatus)

	GetStatus() (status DeviceAuthorizeStatus)

	SetLastChecked(lastChecked time.Time)

	GetLastChecked() (lastChecked time.Time)

	Requester
}

DeviceAuthorizeRequester is a device authorization endpoint's request context.

type DeviceAuthorizeResponder 

type DeviceAuthorizeResponder interface {
	GetDeviceCode() string

	SetDeviceCode(code string)

	// GetHeader returns the response's header.
	GetHeader() (header http.Header)

	// AddHeader adds an header key value pair to the response.
	AddHeader(key, value string)

	GetUserCode() (code string)

	SetUserCode(code string)

	GetVerificationURI() (uri string)

	SetVerificationURI(uri string)

	GetVerificationURIComplete() (completeURI string)

	SetVerificationURIComplete(uri string)

	GetExpiresIn() (expires int64)

	SetExpiresIn(seconds int64)

	GetInterval() (interval int)

	SetInterval(seconds int)

	// SetExtra sets a key value pair for the access response.
	SetExtra(key string, value any)

	// GetExtra returns a key's value.
	GetExtra(key string) (extra any)

	// ToMap converts the response to a map.
	ToMap() (values map[string]any)
}

type DeviceAuthorizeResponse 

type DeviceAuthorizeResponse struct {
	Header                  http.Header    `json:"-"`
	DeviceCode              string         `json:"device_code"`
	UserCode                string         `json:"user_code"`
	VerificationURI         string         `json:"verification_uri"`
	VerificationURIComplete string         `json:"verification_uri_complete,omitempty"`
	ExpiresIn               int64          `json:"expires_in"`
	Interval                int            `json:"interval,omitempty"`
	Extra                   map[string]any `json:"-"`
}

func NewDeviceAuthorizeResponse 

func NewDeviceAuthorizeResponse() *DeviceAuthorizeResponse

NewDeviceAuthorizeResponse returns an empty RFC 8628 device authorization response with its extras map initialized.

func (*DeviceAuthorizeResponse) AddHeader 

func (d *DeviceAuthorizeResponse) AddHeader(key, value string)

AddHeader appends the value to the named response header.

func (*DeviceAuthorizeResponse) FromJSON added in v0.2.37 

func (d *DeviceAuthorizeResponse) FromJSON(r io.Reader) error

FromJSON decodes a JSON-encoded device authorization response from r into the receiver.

func (*DeviceAuthorizeResponse) GetDeviceCode 

func (d *DeviceAuthorizeResponse) GetDeviceCode() string

GetDeviceCode returns the device verification code generated by the authorization server per RFC 8628 section 3.2.

func (*DeviceAuthorizeResponse) GetExpiresIn 

func (d *DeviceAuthorizeResponse) GetExpiresIn() int64

GetExpiresIn returns the response's device code and user code lifetime in seconds if set

func (*DeviceAuthorizeResponse) GetExtra 

func (d *DeviceAuthorizeResponse) GetExtra(key string) any

GetExtra returns the value previously stored under key by SetExtra, or nil if none has been set.

func (*DeviceAuthorizeResponse) GetHeader 

func (d *DeviceAuthorizeResponse) GetHeader() http.Header

GetHeader returns the response HTTP headers that will be written to the client.

func (*DeviceAuthorizeResponse) GetInterval 

func (d *DeviceAuthorizeResponse) GetInterval() int

GetInterval returns the response's polling interval if set

func (*DeviceAuthorizeResponse) GetUserCode 

func (d *DeviceAuthorizeResponse) GetUserCode() string

GetUserCode returns the user code that the resource owner enters at the verification URI to authorize the device.

func (*DeviceAuthorizeResponse) GetVerificationURI 

func (d *DeviceAuthorizeResponse) GetVerificationURI() string

GetVerificationURI returns the response's verification uri

func (*DeviceAuthorizeResponse) GetVerificationURIComplete 

func (d *DeviceAuthorizeResponse) GetVerificationURIComplete() string

GetVerificationURIComplete returns the response's complete verification uri if set

func (*DeviceAuthorizeResponse) SetDeviceCode 

func (d *DeviceAuthorizeResponse) SetDeviceCode(code string)

SetDeviceCode returns the response's user code

func (*DeviceAuthorizeResponse) SetExpiresIn 

func (d *DeviceAuthorizeResponse) SetExpiresIn(seconds int64)

SetExpiresIn records the lifetime of the device code and user code in seconds.

func (*DeviceAuthorizeResponse) SetExtra 

func (d *DeviceAuthorizeResponse) SetExtra(key string, value any)

SetExtra sets an extension parameter on the response, allowing handlers to inject additional response fields.

func (*DeviceAuthorizeResponse) SetInterval 

func (d *DeviceAuthorizeResponse) SetInterval(seconds int)

SetInterval records the minimum polling interval, in seconds, that the device must observe when polling the token endpoint.

func (*DeviceAuthorizeResponse) SetUserCode 

func (d *DeviceAuthorizeResponse) SetUserCode(code string)

SetUserCode records the user code that the resource owner enters at the verification URI to authorize the device.

func (*DeviceAuthorizeResponse) SetVerificationURI 

func (d *DeviceAuthorizeResponse) SetVerificationURI(uri string)

SetVerificationURI records the end-user verification URI returned to the device.

func (*DeviceAuthorizeResponse) SetVerificationURIComplete 

func (d *DeviceAuthorizeResponse) SetVerificationURIComplete(uri string)

SetVerificationURIComplete records the optional verification_uri_complete value that combines the verification URI and user code into a single URI.

func (*DeviceAuthorizeResponse) ToMap 

func (d *DeviceAuthorizeResponse) ToMap() map[string]any

ToMap converts the response to a map.

type DeviceAuthorizeStatus 

type DeviceAuthorizeStatus int
const (
	DeviceAuthorizeStatusNew DeviceAuthorizeStatus = iota
	DeviceAuthorizeStatusApproved
	DeviceAuthorizeStatusDenied
)

type DeviceUserAuthorizeResponder added in v0.1.9 

type DeviceUserAuthorizeResponder interface {
	// GetHeader returns the response's header.
	GetHeader() (header http.Header)

	// AddHeader adds an header key value pair to the response.
	AddHeader(key, value string)

	// GetParameters returns the response's parameters.
	GetParameters() (query url.Values)

	// AddParameter adds key value pair to the response.
	AddParameter(key, value string)

	// GetStatus returns the device grant user verification status.
	GetStatus() (status string)

	// SetStatus sets the device grant user verification status.
	SetStatus(status string)

	// SetExtra sets a key value pair for the access response.
	SetExtra(key string, value any)

	// GetExtra returns a key's value.
	GetExtra(key string) (extra any)

	// ToMap converts the response to a map.
	ToMap() (values map[string]any)
}

DeviceUserAuthorizeResponder is device grant user verification endpoint response.

type DisableRefreshTokenRotationProvider added in v0.3.3 

type DisableRefreshTokenRotationProvider interface {
	// GetDisableRefreshTokenRotation returns true if the refresh token grant should keep the presented refresh token
	// rather than issue a new one.
	//
	// See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1
	GetDisableRefreshTokenRotation(ctx context.Context) (disable bool)
}

DisableRefreshTokenRotationProvider returns the provider for configuring refresh token rotation.

type DisableRefreshTokenValidationProvider 

type DisableRefreshTokenValidationProvider interface {
	// GetDisableRefreshTokenValidation returns the disable refresh token validation flag.
	GetDisableRefreshTokenValidation(ctx context.Context) bool
}

DisableRefreshTokenValidationProvider returns the provider for configuring the refresh token validation.

type EnablePKCEPlainChallengeMethodProvider 

type EnablePKCEPlainChallengeMethodProvider interface {
	// GetEnablePKCEPlainChallengeMethod returns the enable PKCE plain challenge method.
	GetEnablePKCEPlainChallengeMethod(ctx context.Context) (enable bool)
}

EnablePKCEPlainChallengeMethodProvider returns the provider for configuring the enable PKCE plain challenge method.

type EndpointClientAuthJWTClient added in v0.2.0 

type EndpointClientAuthJWTClient struct {
	// contains filtered or unexported fields
}

EndpointClientAuthJWTClient adapts an AuthenticationMethodClient and its EndpointClientAuthStrategy into a jwt.Client. It is passed to the jwt.Strategy when decoding a client assertion (i.e. the 'private_key_jwt' or 'client_secret_jwt' method) so the assertion is verified using the keys and algorithms configured for the endpoint the strategy represents.

func (*EndpointClientAuthJWTClient) GetClientSecretPlainText added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetClientSecretPlainText() (secret []byte, ok bool, err error)

GetClientSecretPlainText returns the underlying client's plaintext secret, used to verify 'client_secret_jwt' assertions. See jwt.BaseClient for the semantics of the return values.

func (*EndpointClientAuthJWTClient) GetEncryptionAlg added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetEncryptionAlg() (alg string)

GetEncryptionAlg returns an empty algorithm as client assertions are verified, not encrypted, by this client.

func (*EndpointClientAuthJWTClient) GetEncryptionEnc added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetEncryptionEnc() (enc string)

GetEncryptionEnc returns an empty content encryption algorithm as client assertions are verified, not encrypted, by this client.

func (*EndpointClientAuthJWTClient) GetEncryptionKeyID added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetEncryptionKeyID() (kid string)

GetEncryptionKeyID returns an empty key id as client assertions are verified, not encrypted, by this client.

func (*EndpointClientAuthJWTClient) GetID added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetID() string

GetID returns the underlying client's ID.

func (*EndpointClientAuthJWTClient) GetJSONWebKeys added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetJSONWebKeys() (jwks *jose.JSONWebKeySet)

GetJSONWebKeys returns the underlying client's registered JSON Web Key Set used to verify 'private_key_jwt' assertions.

func (*EndpointClientAuthJWTClient) GetJSONWebKeysURI added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetJSONWebKeysURI() (uri string)

GetJSONWebKeysURI returns the underlying client's registered JSON Web Key Set URI used to verify 'private_key_jwt' assertions.

func (*EndpointClientAuthJWTClient) GetSigningAlg added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetSigningAlg() (alg string)

GetSigningAlg returns the signing algorithm configured for the endpoint, resolved via the strategy (for example the client's 'token_endpoint_auth_signing_alg').

func (*EndpointClientAuthJWTClient) GetSigningKeyID added in v0.2.0 

func (c *EndpointClientAuthJWTClient) GetSigningKeyID() (kid string)

GetSigningKeyID returns an empty key id as the key is resolved from the client's JSON Web Key Set rather than a fixed key id.

func (*EndpointClientAuthJWTClient) IsClientSigned added in v0.2.0 

func (c *EndpointClientAuthJWTClient) IsClientSigned() (is bool)

IsClientSigned returns true as a client assertion is always signed by the client.

type EndpointClientAuthStrategy added in v0.2.37 

type EndpointClientAuthStrategy interface {
	// GetAuthMethod returns the registered client authentication method configured for this endpoint (for example the
	// value of the client's 'token_endpoint_auth_method').
	GetAuthMethod(client AuthenticationMethodClient) string

	// GetAuthSigningKeyID returns the registered signing key id used to verify client assertions at this endpoint.
	GetAuthSigningKeyID(client AuthenticationMethodClient) string

	// GetAuthSigningAlg returns the registered signing algorithm used to verify client assertions at this endpoint.
	GetAuthSigningAlg(client AuthenticationMethodClient) string

	// GetAuthEncryptionKeyID returns the registered encryption key id used for client assertions at this endpoint.
	GetAuthEncryptionKeyID(client AuthenticationMethodClient) string

	// GetAuthEncryptionAlg returns the registered encryption key algorithm used for client assertions at this endpoint.
	GetAuthEncryptionAlg(client AuthenticationMethodClient) string

	// GetAuthEncryptionEnc returns the registered content encryption algorithm used for client assertions at this
	// endpoint.
	GetAuthEncryptionEnc(client AuthenticationMethodClient) string

	// Name returns the name of the endpoint this strategy represents, used when building error and log messages (for
	// example 'token', 'introspection', or 'revocation').
	Name() string

	// AllowAuthMethodAny returns true if this endpoint permits any client authentication method when the client has not
	// registered a specific method for the endpoint.
	AllowAuthMethodAny() bool

	// AllowMethodNone returns true if this endpoint permits clients to authenticate using the 'none' method.
	// When false, a client using the 'none' method is rejected even if it is otherwise correctly configured.
	AllowMethodNone() bool
}

EndpointClientAuthStrategy abstracts the per-endpoint client authentication configuration so that a single ClientAuthenticationStrategy implementation can authenticate clients across the various endpoints that support client authentication (i.e. the token, introspection, and revocation endpoints). Each endpoint reads different client metadata (for example the 'token_endpoint_auth_method' versus the 'introspection_endpoint_auth_method') and enforces a different policy, and this strategy resolves the correct values and policy for the endpoint it represents.

type EnforcePKCEForPublicClientsProvider 

type EnforcePKCEForPublicClientsProvider interface {
	// GetEnforcePKCEForPublicClients returns the enforcement of PKCE for public clients.
	GetEnforcePKCEForPublicClients(ctx context.Context) (enforce bool)
}

EnforcePKCEForPublicClientsProvider returns the provider for configuring the enforcement of PKCE for public clients.

type EnforcePKCEProvider 

type EnforcePKCEProvider interface {
	// GetEnforcePKCE returns the enforcement of PKCE.
	GetEnforcePKCE(ctx context.Context) (enforce bool)
}

EnforcePKCEProvider returns the provider for configuring the enforcement of PKCE.

type ExpiringClientSecretClient added in v0.3.0 

type ExpiringClientSecretClient interface {
	GetClientSecretExpiresAt() (expires time.Time)

	Client
}

ExpiringClientSecretClient extends Client interface by a method providing the time the client secret expires. A zero time means the secret does not expire, which RFC 7591 Section 3.2.1 also assigns to a 'client_secret_expires_at' of 0.

type ExtraClaimsSession 

type ExtraClaimsSession interface {
	// GetExtraClaims returns a map to store extra claims.
	// The returned value can be modified in-place.
	GetExtraClaims() map[string]any
}

ExtraClaimsSession provides an interface for session to store any extra claims.

type FormPostHTMLTemplateProvider 

type FormPostHTMLTemplateProvider interface {
	// GetFormPostHTMLTemplate returns the form post HTML template.
	GetFormPostHTMLTemplate(ctx context.Context) (tmpl *template.Template)
}

FormPostHTMLTemplateProvider returns the provider for configuring the form post HTML template.

type FormPostResponseProvider 

type FormPostResponseProvider interface {
	// GetFormPostResponseWriter returns a FormPostResponseWriter which should be utilized for writing the
	// form post response type.
	GetFormPostResponseWriter(ctx context.Context) FormPostResponseWriter
}

FormPostResponseProvider provides a writer interface for writing the form post responses.

type FormPostResponseWriter 

type FormPostResponseWriter func(wr io.Writer, template *template.Template, redirectURL string, parameters url.Values)

type Fosite 

type Fosite struct {
	Store  Storage
	Config Configurator
}

Fosite implements Provider.

func New 

func New(store Storage, config Configurator) *Fosite

New returns a Fosite Provider backed by the given Storage and Configurator. For most consumers the compose package offers higher-level constructors that wire up the appropriate handlers and strategies.

func (*Fosite) AuthenticateClient 

func (f *Fosite) AuthenticateClient(ctx context.Context, r *http.Request, form url.Values) (client Client, method string, err error)

AuthenticateClient authenticates client requests using the configured strategy returned by the oauth2.Configurator function GetClientAuthenticationStrategy, if nil it uses `oauth2.DefaultClientAuthenticationStrategy`.

func (*Fosite) AuthenticateClientWithAuthHandler added in v0.1.12 

func (f *Fosite) AuthenticateClientWithAuthHandler(ctx context.Context, r *http.Request, form url.Values, strategyECA EndpointClientAuthStrategy) (client Client, method string, err error)

AuthenticateClientWithAuthHandler authenticates a client at the endpoint represented by handler using the configured ClientAuthenticationStrategy, falling back to DefaultClientAuthenticationStrategy if none is configured. Use this in preference to AuthenticateClient when the request is not destined for the token endpoint.

func (*Fosite) DisableRefreshTokenRotation added in v0.3.3 

func (f *Fosite) DisableRefreshTokenRotation(ctx context.Context, client Client) (disable bool)

DisableRefreshTokenRotation determines if the refresh token grant keeps the presented refresh token. Rotation is disabled when either the provider-wide option or the client's own policy is set.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1

func (*Fosite) GetMinParameterEntropy 

func (f *Fosite) GetMinParameterEntropy(ctx context.Context) int

GetMinParameterEntropy returns MinParameterEntropy if set. Defaults to oauth2.MinParameterEntropy.

func (*Fosite) IntrospectToken 

func (f *Fosite) IntrospectToken(ctx context.Context, token string, tokenUse TokenUse, session Session, scopes ...string) (TokenUse, AccessRequester, error)

IntrospectToken validates the provided opaque or structured token against each configured TokenIntrospector. It returns the detected token use (access, refresh, etc.), the populated AccessRequester for downstream callers, or ErrRequestUnauthorized if no introspector recognizes the token. The tokenUse argument is treated as a hint that introspectors may use to short-circuit when the token type is known in advance.

func (*Fosite) NewAccessRequest 

func (f *Fosite) NewAccessRequest(ctx context.Context, r *http.Request, session Session) (ar AccessRequester, err error)

NewAccessRequest Implements

  • https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1 Clients in possession of a client password MAY use the HTTP Basic authentication scheme as defined in [RFC2617] to authenticate with the authorization server. The client identifier is encoded using the "application/x-www-form-urlencoded" encoding algorithm per Appendix B, and the encoded value is used as the username; the client password is encoded using the same algorithm and used as the password. The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a client password. Including the client credentials in the request-body using the two parameters is NOT RECOMMENDED and SHOULD be limited to clients unable to directly utilize the HTTP Basic authentication scheme (or other password-based HTTP authentication schemes). The parameters can only be transmitted in the request-body and MUST NOT be included in the request URI.
  • https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1
  • Confidential clients or other clients issued client credentials MUST authenticate with the authorization server as described in Section 2.3 when making requests to the token endpoint.
  • If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in Section 3.2.1.

TODO: Refactor time permitting.

func (*Fosite) NewAccessResponse 

func (f *Fosite) NewAccessResponse(ctx context.Context, request AccessRequester) (AccessResponder, error)

NewAccessResponse dispatches the access request to each configured TokenEndpointHandler to populate the response. It returns ErrServerError if no handler issued an access token. Use WriteAccessResponse to send the result, or WriteAccessError if this method returns an error.

func (*Fosite) NewAuthorizeRequest 

func (f *Fosite) NewAuthorizeRequest(ctx context.Context, r *http.Request) (AuthorizeRequester, error)

NewAuthorizeRequest parses and validates an authorization endpoint request per RFC 6749 section 3.1 and OpenID Connect 1.0. The HTTP method must be GET or POST as defined by the specification; any other method results in ErrInvalidRequest. The returned AuthorizeRequester carries the parsed client, scopes, audience, redirect URI and response type. Errors from this method should be sent to the client via WriteAuthorizeError.

func (*Fosite) NewAuthorizeResponse 

func (f *Fosite) NewAuthorizeResponse(ctx context.Context, request AuthorizeRequester, session Session) (responder AuthorizeResponder, err error)

NewAuthorizeResponse dispatches the authorize request to each configured AuthorizeEndpointHandler to produce the response parameters. Returns ErrUnsupportedResponseType when not every requested response_type was handled, or ErrUnsupportedResponseMode if the negotiated response mode would expose tokens via the URL query for a flow that defaults to fragment delivery.

func (*Fosite) NewIntrospectionRequest 

func (f *Fosite) NewIntrospectionRequest(ctx context.Context, r *http.Request, session Session) (responder IntrospectionResponder, err error)

NewIntrospectionRequest initiates token introspection as defined in https://datatracker.ietf.org/doc/html/rfc7662#section-2.1

The protected resource calls the introspection endpoint using an HTTP POST [RFC7231] request with parameters sent as "application/x-www-form-urlencoded" data as defined in [W3C.REC-html5-20141028]. The protected resource sends a parameter representing the token along with optional parameters representing additional context that is known by the protected resource to aid the authorization server in its response.

* token REQUIRED. The string value of the token. For access tokens, this is the "access_token" value returned from the token endpoint defined in OAuth 2.0 [RFC6749], Section 5.1. For refresh tokens, this is the "refresh_token" value returned from the token endpoint as defined in OAuth 2.0 [RFC6749], Section 5.1. Other token types are outside the scope of this specification.

* token_type_hint OPTIONAL. A hint about the type of the token submitted for introspection. The protected resource MAY pass this parameter to help the authorization server optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. Values for this field are defined in the "OAuth Token Type Hints" registry defined in OAuth Token Revocation [RFC7009].

The introspection endpoint MAY accept other OPTIONAL parameters to provide further context to the query. For instance, an authorization server may desire to know the IP address of the client accessing the protected resource to determine if the correct client is likely to be presenting the token. The definition of this or any other parameters are outside the scope of this specification, to be defined by service documentation or extensions to this specification. If the authorization server is unable to determine the state of the token without additional information, it SHOULD return an introspection response indicating the token is not active as described in Section 2.2.

To prevent token scanning attacks, the endpoint MUST also require some form of authorization to access this endpoint, such as client authentication as described in OAuth 2.0 [RFC6749] or a separate OAuth 2.0 access token such as the bearer token described in OAuth 2.0 Bearer Token Usage [RFC6750]. The methods of managing and validating these authentication credentials are out of scope of this specification.

For example, the following shows a protected resource calling the token introspection endpoint to query about an OAuth 2.0 bearer token. The protected resource is using a separate OAuth 2.0 bearer token to authorize this call.

The following is a non-normative example request: 

POST /introspect HTTP/1.1
Host: server.example.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer 23410913-abewfq.123483

token=2YotnFZFEjr1zCsicMWpAA

In this example, the protected resource uses a client identifier and client secret to authenticate itself to the introspection endpoint. The protected resource also sends a token type hint indicating that it is inquiring about an access token.

The following is a non-normative example request: 

POST /introspect HTTP/1.1
Host: server.example.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW

token=mF_9.B5f-4.1JqM&token_type_hint=access_token

func (*Fosite) NewPushedAuthorizeRequest 

func (f *Fosite) NewPushedAuthorizeRequest(ctx context.Context, r *http.Request) (requester AuthorizeRequester, err error)

NewPushedAuthorizeRequest validates the request and produces an AuthorizeRequester object that can be stored

func (*Fosite) NewPushedAuthorizeResponse 

func (f *Fosite) NewPushedAuthorizeResponse(ctx context.Context, request AuthorizeRequester, session Session) (responder PushedAuthorizeResponder, err error)

NewPushedAuthorizeResponse executes the handlers and builds the response

func (*Fosite) NewRFC862DeviceAuthorizeRequest 

func (f *Fosite) NewRFC862DeviceAuthorizeRequest(ctx context.Context, r *http.Request) (requester DeviceAuthorizeRequester, err error)

NewRFC862DeviceAuthorizeRequest parses and validates an RFC 8628 device authorization endpoint request. The HTTP method must be POST as specified by section 3.1 of the RFC. The client is authenticated using the token endpoint authentication method (section 3.1 also requires this), the client must hold the device_code grant type, and the requested scopes, audience, and RFC 8707 resource indicators are validated against the client's registration.

func (*Fosite) NewRFC862DeviceAuthorizeResponse 

func (f *Fosite) NewRFC862DeviceAuthorizeResponse(ctx context.Context, r DeviceAuthorizeRequester, session Session) (DeviceAuthorizeResponder, error)

NewRFC862DeviceAuthorizeResponse dispatches the device authorization request to each configured RFC 8628 device authorization endpoint handler to populate the device_code, user_code, verification URIs and polling interval.

func (*Fosite) NewRFC7591ClientRegistrationRequest added in v0.3.0 

func (f *Fosite) NewRFC7591ClientRegistrationRequest(ctx context.Context, r *http.Request) (requester ClientRegistrationRequester, err error)

NewRFC7591ClientRegistrationRequest validates the request and produces a ClientRegistrationRequester that can be passed to NewRFC7591ClientRegistrationResponse.

The following specs must be considered in any implementation of this method: * https://datatracker.ietf.org/doc/html/rfc7591#section-3.1 

This request MUST be authenticated using a valid Initial Access Token, if authorization is required. The
request body is a JSON document consisting of a JSON object.

func (*Fosite) NewRFC7591ClientRegistrationResponse added in v0.3.0 

func (f *Fosite) NewRFC7591ClientRegistrationResponse(ctx context.Context, requester ClientRegistrationRequester) (responder ClientRegistrationResponder, err error)

NewRFC7591ClientRegistrationResponse executes the configured client registration endpoint handlers and builds the response.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1

func (*Fosite) NewRFC7592ClientConfigurationRequest added in v0.3.0 

func (f *Fosite) NewRFC7592ClientConfigurationRequest(ctx context.Context, r *http.Request) (requester ClientConfigurationRequester, err error)

NewRFC7592ClientConfigurationRequest validates the request and produces a ClientConfigurationRequester that can be passed to NewRFC7592ClientConfigurationResponse. The HTTP method itself is not validated here - GET, PUT, and DELETE are all accepted, a JSON body is decoded only for PUT, and any other method is recorded on the request as given. HandleRFC7592ClientConfigurationEndpointRequest (handler/rfc7591) is the one that rejects an unsupported method, with ErrInvalidRequest naming it; WriteRFC7592ClientConfigurationError maps that to 405.

The following specs must be considered in any implementation of this method: * https://datatracker.ietf.org/doc/html/rfc7592#section-2 

The client_id and, if issued, the client_secret, MUST NOT be included in the metadata returned in response to
this request, unless they are being rotated. All requests to the client configuration endpoint MUST be
authenticated using the registration access token issued to the client and MUST be rejected if the
registration access token has been revoked or is otherwise invalid.

func (*Fosite) NewRFC7592ClientConfigurationResponse added in v0.3.0 

func (f *Fosite) NewRFC7592ClientConfigurationResponse(ctx context.Context, requester ClientConfigurationRequester) (responder ClientConfigurationResponder, err error)

NewRFC7592ClientConfigurationResponse executes the configured client configuration endpoint handlers and builds the response.

See: https://datatracker.ietf.org/doc/html/rfc7592#section-2

func (*Fosite) NewRFC8628UserAuthorizeRequest 

func (f *Fosite) NewRFC8628UserAuthorizeRequest(ctx context.Context, r *http.Request) (requester DeviceAuthorizeRequester, err error)

NewRFC8628UserAuthorizeRequest parses the user-facing device authorization request and dispatches it to each configured RFC8628UserAuthorizeEndpointHandler. The returned DeviceAuthorizeRequester reflects the user's authorization decision (approval, denial, or pending) as recorded by the handlers.

func (*Fosite) NewRFC8628UserAuthorizeResponse 

func (f *Fosite) NewRFC8628UserAuthorizeResponse(ctx context.Context, requester DeviceAuthorizeRequester, session Session) (responder DeviceUserAuthorizeResponder, err error)

NewRFC8628UserAuthorizeResponse dispatches the user-facing device authorization request to each configured handler to populate the response with the user's authorization decision and any extension parameters.

func (*Fosite) NewRPInitiatedLogoutRequest added in v0.3.0 

func (f *Fosite) NewRPInitiatedLogoutRequest(ctx context.Context, r *http.Request) (requester RPInitiatedLogoutRequester, err error)

NewRPInitiatedLogoutRequest parses and validates a request to the OpenID Connect end session endpoint.

It resolves the client from the 'client_id' parameter, the 'id_token_hint' parameter, or both; validates the 'id_token_hint' when present, permitting it to be expired; and validates 'post_logout_redirect_uri' against the client's registered post logout redirect URIs.

It does not authenticate the client: the end session endpoint is a front channel endpoint reached via the user agent. It does not end any session and does not write a response; the caller decides whether to confirm the logout with the End-User, terminates its own session, and redirects.

On any error the returned requester's post logout redirect URI is nil, so an error can never be redirected to an unvalidated URI.

See: https://openid.net/specs/openid-connect-rpinitiated-1_0.html

func (*Fosite) NewRevocationRequest 

func (f *Fosite) NewRevocationRequest(ctx context.Context, r *http.Request) error

NewRevocationRequest handles incoming token revocation requests and validates various parameters as specified in: https://datatracker.ietf.org/doc/html/rfc7009#section-2.1

The authorization server first validates the client credentials (in case of a confidential client) and then verifies whether the token was issued to the client making the revocation request. If this validation fails, the request is refused and the client is informed of the error by the authorization server as described below.

In the next step, the authorization server invalidates the token. The invalidation takes place immediately, and the token cannot be used again after the revocation.

* https://datatracker.ietf.org/doc/html/rfc7009#section-2.2 An invalid token type hint value is ignored by the authorization server and does not influence the revocation response.

func (*Fosite) ParseResponseMode 

func (f *Fosite) ParseResponseMode(ctx context.Context, r *http.Request, request *AuthorizeRequest) error

ParseResponseMode reads the 'response_mode' query parameter from r and, if a configured ResponseModeHandler supports it, records it on the request. It returns ErrInsufficientEntropy if the form parameter has insufficient entropy and ErrUnsupportedResponseMode for unrecognized values.

func (*Fosite) RequestObjectAudienceAndLifetime added in v0.3.3 

func (f *Fosite) RequestObjectAudienceAndLifetime(ctx context.Context, client JARClient) (require bool, lifetime time.Duration)

RequestObjectAudienceAndLifetime determines if a Request Object must contain the 'aud', 'nbf' and 'exp' claims, and the lifetime bounding them. The claims are required when either the provider-wide option or the client's own policy is set, and a positive client lifetime overrides the provider-wide lifetime.

See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1

func (*Fosite) RequireRedirectURIPushedAuthorizationRequest added in v0.3.3 

func (f *Fosite) RequireRedirectURIPushedAuthorizationRequest(ctx context.Context, client Client) (require bool)

RequireRedirectURIPushedAuthorizationRequest determines if the 'redirect_uri' parameter is required in a Pushed Authorization Request. It is required when either the provider-wide option or the client's own policy is set.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.2

func (*Fosite) SendBackChannelLogout added in v0.3.0 

func (f *Fosite) SendBackChannelLogout(ctx context.Context, requester BackChannelLogoutRequester) (results []BackChannelLogoutResult, err error)

SendBackChannelLogout delivers a Logout Token to each of the supplied clients, as per OpenID Connect Back-Channel Logout 1.0.

The caller supplies the clients: this library does not track which clients participated in a session, and does not end any session. A result is returned for every client supplied, in the order supplied.

Delivery is best effort. A Relying Party that is unreachable or that rejects the Logout Token is reported in its own result and never fails the call, so one broken Relying Party cannot prevent the others being notified. Only whole-operation failures are returned as err.

Deliveries run concurrently, up to the configured concurrency limit. Each supplied Client and the requester's Extra map are read concurrently from the delivery goroutines, and so must be safe for concurrent reads.

See: https://openid.net/specs/openid-connect-backchannel-1_0.html

func (*Fosite) WriteAccessError 

func (f *Fosite) WriteAccessError(ctx context.Context, rw http.ResponseWriter, request AccessRequester, err error)

WriteAccessError writes an error response for the token endpoint per RFC 6749 section 5.2. The response is encoded as JSON with cache-control headers set to 'no-store' and 'no-cache' as required by the specification. When request is non-nil its language preference is used to localize the error description.

func (*Fosite) WriteAccessResponse 

func (f *Fosite) WriteAccessResponse(ctx context.Context, rw http.ResponseWriter, request AccessRequester, response AccessResponder)

WriteAccessResponse writes the successful token endpoint response per RFC 6749 section 5.1 as JSON with the required cache-control headers. Use WriteAccessError to send error responses.

func (*Fosite) WriteAuthorizeError 

func (f *Fosite) WriteAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, err error)

WriteAuthorizeError writes an error response for the authorization endpoint. The configured ResponseModeHandlers are consulted first so the error can be delivered using the requested response_mode (query, fragment, form_post, etc.). If no handler matches, the error is written as JSON to rw using the configured AuthorizeErrorFieldResponseStrategy.

func (*Fosite) WriteAuthorizeResponse 

func (f *Fosite) WriteAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, response AuthorizeResponder)

WriteAuthorizeResponse writes a successful authorization endpoint response by dispatching to the configured ResponseModeHandler that supports the request's response_mode. If no handler matches, an internal server error is written instead.

func (*Fosite) WriteBearerAuthorizationChallenge added in v0.3.0 

func (f *Fosite) WriteBearerAuthorizationChallenge(ctx context.Context, rw http.ResponseWriter, r *http.Request, err error) (rfc *RFC6749Error)

WriteBearerAuthorizationChallenge sets the RFC 6750 Section 3 / RFC 9449 Section 7.1 'WWW-Authenticate' challenge for an endpoint acting as an OAuth 2.0 protected resource, and returns the error with its status corrected for that context. The caller writes the response body.

r may be nil. The response writers that call this - WriteIntrospectionError and writeClientRegistrationError - are public API taking only a context, and the request is not reliably on it: the handlers store it under RequestContextKey on their own derived context, which a caller writing the error from the context it started with will not have. A nil request means the scheme used cannot be established, which RFC 9449 Section 7.2 covers explicitly - "otherwise, both Bearer and DPoP challenges MAY be used to deliver error information" (Figure 19). The challenge stays conformant either way; supplying the request only buys the more precise placement of Figures 16 and 18.

Status correction: ErrInvalidDPoPProof and ErrUseDPoPNonce are HTTP 400, which is correct at the token endpoint per RFC 9449 Section 5, but Section 7.1 Figure 16 and Section 9 Figure 24 both require 401 at a protected resource. They are promoted here rather than by forking the error variables, which would change public API.

func (*Fosite) WriteIntrospectionError 

func (f *Fosite) WriteIntrospectionError(ctx context.Context, rw http.ResponseWriter, err error)

WriteIntrospectionError responds with token metadata discovered by token introspection as defined in https://datatracker.ietf.org/doc/html/rfc7662#section-2.2

If the protected resource uses OAuth 2.0 client credentials to authenticate to the introspection endpoint and its credentials are invalid, the authorization server responds with an HTTP 401 (Unauthorized) as described in Section 5.2 of OAuth 2.0 [RFC6749].

If the protected resource uses an OAuth 2.0 bearer token to authorize its call to the introspection endpoint and the token used for authorization does not contain sufficient privileges or is otherwise invalid for this request, the authorization server responds with an HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token Usage [RFC6750].

Note that a properly formed and authorized query for an inactive or otherwise invalid token (or a token the protected resource is not allowed to know about) is not considered an error response by this specification. In these cases, the authorization server MUST instead respond with an introspection response with the "active" field set to "false" as described in Section 2.2.

func (*Fosite) WriteIntrospectionResponse 

func (f *Fosite) WriteIntrospectionResponse(ctx context.Context, rw http.ResponseWriter, r IntrospectionResponder)

WriteIntrospectionResponse responds with an error if token introspection failed as defined in https://datatracker.ietf.org/doc/html/rfc7662#section-2.3

The server responds with a JSON object [RFC7159] in "application/ json" format with the following top-level members.

* active REQUIRED. Boolean indicator of whether or not the presented token is currently active. The specifics of a token's "active" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a "true" value return for the "active" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time). See Section 4 for information on implementation of such checks.

* scope OPTIONAL. A JSON string containing a space-separated list of scopes associated with this token, in the format described in Section 3.3 of OAuth 2.0 [RFC6749].

* client_id OPTIONAL. Client identifier for the OAuth 2.0 client that requested this token.

* username OPTIONAL. Human-readable identifier for the resource owner who authorized this token.

* token_type OPTIONAL. Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].

* exp OPTIONAL. Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire, as defined in JWT [RFC7519].

* iat OPTIONAL. Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued, as defined in JWT [RFC7519].

* nbf OPTIONAL. Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before, as defined in JWT [RFC7519].

* sub OPTIONAL. Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.

* aud OPTIONAL. Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].

* iss OPTIONAL. String representing the issuer of this token, as defined in JWT [RFC7519].

* jti OPTIONAL. String identifier for the token, as defined in JWT [RFC7519].

Specific implementations MAY extend this structure with their own service-specific response names as top-level members of this JSON object. Response names intended to be used across domains MUST be registered in the "OAuth Token Introspection Response" registry defined in Section 3.1.

The authorization server MAY respond differently to different protected resources making the same request. For instance, an authorization server MAY limit which scopes from a given token are returned for each protected resource to prevent a protected resource from learning more about the larger network than is necessary for its operation.

The response MAY be cached by the protected resource to improve performance and reduce load on the introspection endpoint, but at the cost of liveness of the information used by the protected resource to make authorization decisions. See Section 4 for more information regarding the trade off when the response is cached.

For example, the following response contains a set of information about an active token:

The following is a non-normative example response: 

HTTP/1.1 200 OK
Content-Type: application/json

{
  "active": true,
  "client_id": "l238j323ds-23ij4",
  "username": "jdoe",
  "scope": "read write dolphin",
  "sub": "Z5O3upPC88QrAjx00dis",
  "aud": "https://protected.example.net/resource",
  "iss": "https://server.example.com/",
  "exp": 1419356238,
  "iat": 1419350238,
  "extension_field": "twenty-seven"
}

If the introspection call is properly authorized but the token is not active, does not exist on this server, or the protected resource is not allowed to introspect this particular token, then the authorization server MUST return an introspection response with the "active" field set to "false". Note that to avoid disclosing too much of the authorization server's state to a third party, the authorization server SHOULD NOT include any additional information about an inactive token, including why the token is inactive.

The following is a non-normative example response for a token that has been revoked or is otherwise invalid: 

HTTP/1.1 200 OK
Content-Type: application/json

{
  "active": false
}

func (*Fosite) WritePushedAuthorizeError 

func (f *Fosite) WritePushedAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, err error)

WritePushedAuthorizeError writes the PAR error

func (*Fosite) WritePushedAuthorizeResponse 

func (f *Fosite) WritePushedAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, response PushedAuthorizeResponder)

WritePushedAuthorizeResponse writes the PAR response

func (*Fosite) WriteRFC862DeviceAuthorizeResponse 

func (f *Fosite) WriteRFC862DeviceAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, _ DeviceAuthorizeRequester, responder DeviceAuthorizeResponder)

WriteRFC862DeviceAuthorizeResponse writes a successful RFC 8628 device authorization endpoint response as JSON with the cache-control headers mandated by the specification. Any headers attached to the responder are copied to the HTTP response.

func (*Fosite) WriteRFC7591ClientRegistrationError added in v0.3.0 

func (f *Fosite) WriteRFC7591ClientRegistrationError(ctx context.Context, rw http.ResponseWriter, requester ClientRegistrationRequester, err error)

WriteRFC7591ClientRegistrationError writes a client registration endpoint error response.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2

func (*Fosite) WriteRFC7591ClientRegistrationResponse added in v0.3.0 

func (f *Fosite) WriteRFC7591ClientRegistrationResponse(ctx context.Context, rw http.ResponseWriter, requester ClientRegistrationRequester, responder ClientRegistrationResponder)

WriteRFC7591ClientRegistrationResponse writes the client registration response.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1

func (*Fosite) WriteRFC7592ClientConfigurationError added in v0.3.0 

func (f *Fosite) WriteRFC7592ClientConfigurationError(ctx context.Context, rw http.ResponseWriter, requester ClientConfigurationRequester, err error)

WriteRFC7592ClientConfigurationError writes a client configuration endpoint error response.

The following specs must be considered in any implementation of this method: * https://datatracker.ietf.org/doc/html/rfc7592#section-3 

400 (Bad Request), 401 (Unauthorized), 403 (Forbidden), and 404 (Not Found) status codes are all used, as
appropriate, to indicate errors as described in Section 3.2.

This implementation reports 401 (accompanied by a 'WWW-Authenticate: Bearer' header per RFC 6750 Section 3) for a missing or invalid registration access token, 404 for an unknown client_id, and 405 for a method other than GET, PUT, or DELETE. RFC 7592 also describes 403 for a token that is otherwise valid but not authorized for the target client; DefaultEndpointAuthStrategy (handler/rfc7591) deliberately reports that case as 401 as well, the same as any other authentication failure, so an attacker cannot use the status code to distinguish an unknown token from one that is simply not authorized for this client. See that type's doc comment for the rationale.

func (*Fosite) WriteRFC7592ClientConfigurationResponse added in v0.3.0 

func (f *Fosite) WriteRFC7592ClientConfigurationResponse(ctx context.Context, rw http.ResponseWriter, requester ClientConfigurationRequester, responder ClientConfigurationResponder)

WriteRFC7592ClientConfigurationResponse writes the client configuration response. A 204 status - written for a successful DELETE - carries no body at all, not '{}'.

See: https://datatracker.ietf.org/doc/html/rfc7592#section-2.3

func (*Fosite) WriteRFC8628UserAuthorizeError 

func (f *Fosite) WriteRFC8628UserAuthorizeError(ctx context.Context, rw http.ResponseWriter, req DeviceAuthorizeRequester, err error)

WriteRFC8628UserAuthorizeError writes an error response for the user-facing device authorization endpoint as JSON. Debug information is included only when the provider is configured to send debug messages to clients.

func (*Fosite) WriteRFC8628UserAuthorizeResponse 

func (f *Fosite) WriteRFC8628UserAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, _ DeviceAuthorizeRequester, responder DeviceUserAuthorizeResponder)

WriteRFC8628UserAuthorizeResponse writes a successful user-facing device authorization response as JSON with the cache-control headers required by RFC 8628.

func (*Fosite) WriteRevocationResponse 

func (f *Fosite) WriteRevocationResponse(ctx context.Context, rw http.ResponseWriter, err error)

WriteRevocationResponse writes a token revocation response as specified in: https://datatracker.ietf.org/doc/html/rfc7009#section-2.2

The authorization server responds with HTTP status code 200 if the token has been revoked successfully or if the client submitted an invalid token.

Note: invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved.

type G11NContext 

type G11NContext interface {
	// GetLang returns the current language in the context.
	GetLang() (lang language.Tag)
}

G11NContext is the globalization context.

type GetJWTMaxDurationProvider 

type GetJWTMaxDurationProvider interface {
	// GetJWTMaxDuration returns the JWT max duration.
	GetJWTMaxDuration(ctx context.Context) (max time.Duration)
}

GetJWTMaxDurationProvider returns the provider for configuring the JWT max duration.

type GlobalSecretProvider 

type GlobalSecretProvider interface {
	// GetGlobalSecret returns the global secret.
	GetGlobalSecret(ctx context.Context) (secret []byte, err error)
}

GlobalSecretProvider returns the provider for configuring the global secret.

type GrantType 

type GrantType string

type GrantTypeJWTBearerCanSkipClientAuthProvider 

type GrantTypeJWTBearerCanSkipClientAuthProvider interface {
	// GetGrantTypeJWTBearerCanSkipClientAuth returns the grant type JWT bearer can skip client auth.
	GetGrantTypeJWTBearerCanSkipClientAuth(ctx context.Context) (permitted bool)
}

GrantTypeJWTBearerCanSkipClientAuthProvider returns the provider for configuring the grant type JWT bearer can skip client auth.

type GrantTypeJWTBearerIDOptionalProvider 

type GrantTypeJWTBearerIDOptionalProvider interface {
	// GetGrantTypeJWTBearerIDOptional returns the grant type JWT bearer ID optional.
	GetGrantTypeJWTBearerIDOptional(ctx context.Context) (optional bool)
}

GrantTypeJWTBearerIDOptionalProvider returns the provider for configuring the grant type JWT bearer ID optional.

type GrantTypeJWTBearerIssuedDateOptionalProvider 

type GrantTypeJWTBearerIssuedDateOptionalProvider interface {
	// GetGrantTypeJWTBearerIssuedDateOptional returns the grant type JWT bearer issued date optional.
	GetGrantTypeJWTBearerIssuedDateOptional(ctx context.Context) (optional bool)
}

GrantTypeJWTBearerIssuedDateOptionalProvider returns the provider for configuring the grant type JWT bearer issued date optional.

type HMACHashingProvider 

type HMACHashingProvider interface {
	// GetHMACHasher returns the hash function.
	GetHMACHasher(ctx context.Context) func() (hasher hash.Hash)
}

HMACHashingProvider returns the provider for configuring the hash function.

type HTTPClientProvider 

type HTTPClientProvider interface {
	// GetHTTPClient returns the HTTP client provider.
	GetHTTPClient(ctx context.Context) (client *retryablehttp.Client)
}

HTTPClientProvider returns the provider for configuring the HTTP client.

type IDTokenClient added in v0.1.15 

type IDTokenClient interface {
	// GetIDTokenSignedResponseKeyID returns the specific key identifier used to satisfy JWS requirements of the ID
	// Token specifications. If unspecified the other available parameters will be utilized to select an appropriate
	// key.
	GetIDTokenSignedResponseKeyID() (kid string)

	// GetIDTokenSignedResponseAlg is equivalent to the 'id_token_signed_response_alg' client metadata value which
	// determines the JWS alg algorithm [JWA] REQUIRED for signing the ID Token issued to this Client. The value none
	// MUST NOT be used as the ID Token alg value unless the Client uses only Response Types that return no ID Token
	// from the Authorization Endpoint (such as when only using the Authorization Code Flow). The default, if omitted,
	// is RS256. The public key for validating the signature is provided by retrieving the JWK Set referenced by the
	// jwks_uri element from OpenID Connect Discovery 1.0 [OpenID.Discovery].
	GetIDTokenSignedResponseAlg() (alg string)

	// GetIDTokenEncryptedResponseKeyID returns the specific key identifier used to satisfy JWE requirements of the ID
	// Token specifications. If unspecified the other available parameters will be utilized to select an appropriate
	// key.
	GetIDTokenEncryptedResponseKeyID() (kid string)

	// GetIDTokenEncryptedResponseAlg is equivalent to the 'id_token_encrypted_response_alg' client metadata value which
	// determines the JWE alg algorithm [JWA] REQUIRED for encrypting the ID Token issued to this Client. If this is
	// requested, the response will be signed then encrypted, with the result being a Nested JWT, as defined in [JWT].
	// The default, if omitted, is that no encryption is performed.
	GetIDTokenEncryptedResponseAlg() (alg string)

	// GetIDTokenEncryptedResponseEnc is equivalent to the 'id_token_encrypted_response_enc' client metadata value which
	// determines the JWE enc algorithm [JWA] REQUIRED for encrypting the ID Token issued to this Client. If
	// id_token_encrypted_response_alg is specified, the default id_token_encrypted_response_enc value is A128CBC-HS256.
	// When id_token_encrypted_response_enc is included, id_token_encrypted_response_alg MUST also be provided.
	GetIDTokenEncryptedResponseEnc() (enc string)

	JSONWebKeysClient
}

IDTokenClient is a client which can satisfy all JWS and JWE requirements of the ID Token responses.

type IDTokenConfirmationConfigProvider added in v0.3.1 

type IDTokenConfirmationConfigProvider interface {
	// GetOIDCKeyBindingEnabled returns true if OpenID Connect Key Binding 1.0 handling is enabled.
	GetOIDCKeyBindingEnabled(ctx context.Context) (enabled bool)

	// GetDPoPEnabled returns true if DPoP handling is enabled.
	GetDPoPEnabled(ctx context.Context) (enabled bool)
}

IDTokenConfirmationConfigProvider is the configuration ApplyIDTokenConfirmation consults to decide whether the OpenID Connect Key Binding 1.0 confirmation may be asserted in an ID Token.

Both getters are required, for the reason documented on confirmationMethod.enabled: the 'cnf' claim tells a Relying Party that a proof of possession was checked, and the handlers that check one run only while DPoP is enabled. A session outlives a configuration change, so a key recorded while DPoP was enabled survives on it afterwards; without the DPoP getter this claim would still be asserted for a refresh no proof was demanded on.

It restates the getters rather than embedding the two providers, as ConfirmationConfigProvider does and for the same reason: Go interfaces are structural, so any configuration already satisfying those providers satisfies this one.

type IDTokenIssuerProvider 

type IDTokenIssuerProvider interface {
	// GetIDTokenIssuer returns the ID token issuer.
	GetIDTokenIssuer(ctx context.Context) (issuer string)
}

IDTokenIssuerProvider returns the provider for configuring the ID token issuer.

type IDTokenLifespanProvider 

type IDTokenLifespanProvider interface {
	// GetIDTokenLifespan returns the ID token lifespan.
	GetIDTokenLifespan(ctx context.Context) (lifespan time.Duration)
}

IDTokenLifespanProvider returns the provider for configuring the ID token lifespan.

type IDTokenValidationOpt added in v0.3.0 

type IDTokenValidationOpt func(opts *IDTokenValidationOpts)

IDTokenValidationOpt configures IDTokenValidationOpts.

func WithAllowExpired added in v0.3.0 

func WithAllowExpired() IDTokenValidationOpt

WithAllowExpired permits an ID Token with an 'exp' claim in the past to validate successfully. It narrowly disables the expiration check; the 'iat' and 'nbf' claims remain enforced when present, as do signature verification and every other check.

This exists for OpenID Connect RP-Initiated Logout, where the 'id_token_hint' identifies the session the Relying Party is asking to end and is therefore expected to be expired.

func WithAllowUnverified added in v0.3.0 

func WithAllowUnverified() IDTokenValidationOpt

WithAllowUnverified decodes the token WITHOUT verifying its signature and WITHOUT validating any claim.

The result is untrusted. It must only be used to discover which client a token was issued to, so that the token can then be validated properly against that client's keys. Never return claims obtained this way to a caller and never make an authorization decision based on them.

type IDTokenValidationOpts added in v0.3.0 

type IDTokenValidationOpts struct {
	// AllowExpired permits an ID Token whose 'exp' claim is in the past to validate successfully.
	AllowExpired bool

	// AllowUnverified skips signature verification and all claim validation.
	AllowUnverified bool
}

IDTokenValidationOpts are the resolved options for TokenValidationStrategy.ValidateIDToken.

func NewIDTokenValidationOpts added in v0.3.0 

func NewIDTokenValidationOpts(opts ...IDTokenValidationOpt) (o *IDTokenValidationOpts)

NewIDTokenValidationOpts resolves the given options. Implementations of TokenValidationStrategy should use this rather than looping over the options themselves.

type IDTokenValidationStrategyProvider added in v0.3.0 

type IDTokenValidationStrategyProvider interface {
	// GetIDTokenValidationStrategy returns the ID Token validation strategy. Has no default and may be nil.
	GetIDTokenValidationStrategy(ctx context.Context) (strategy TokenValidationStrategy)
}

IDTokenValidationStrategyProvider returns the provider for configuring the ID Token validation strategy, which validates ID Tokens presented to the authorization server by a client.

type IntrospectionEndpointClientAuthDisabledProvider added in v0.3.0 

type IntrospectionEndpointClientAuthDisabledProvider interface {
	// GetIntrospectionEndpointClientAuthDisabled returns true when the introspection endpoint must not accept client
	// authentication, leaving an Access Token presented as a bearer credential the only way to authorize a call.
	//
	// RFC 7662 Section 2.1 requires the endpoint to "require some form of authorization", naming client
	// authentication and a bearer token as the two examples, and leaves the choice open. This narrows it to the
	// second. It is off by default, because turning it on rejects every caller using the first.
	//
	// A deployment turns this on to make one property hold: that authorizing a call to this endpoint always means
	// presenting a credential carrying a grant, which can be scoped, audienced, bound to a key or a certificate, and
	// revoked on its own. Client credentials carry none of those - a client registered for introspection can call it
	// for as long as it holds its secret - so while both methods are available the weaker one sets the bar.
	GetIntrospectionEndpointClientAuthDisabled(ctx context.Context) (disabled bool)
}

IntrospectionEndpointClientAuthDisabledProvider returns the provider for turning off client authentication at the introspection endpoint.

type IntrospectionEndpointClientAuthStrategy added in v0.2.37 

type IntrospectionEndpointClientAuthStrategy struct{}

IntrospectionEndpointClientAuthStrategy is the EndpointClientAuthStrategy for the introspection endpoint. It resolves client authentication configuration from the client's 'introspection_endpoint_auth_method' metadata and does not permit public clients to authenticate using the 'none' method.

func (*IntrospectionEndpointClientAuthStrategy) AllowAuthMethodAny added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) AllowAuthMethodAny() bool

AllowAuthMethodAny returns true as the introspection endpoint permits any authentication method when the client has not registered a specific 'introspection_endpoint_auth_method'.

func (*IntrospectionEndpointClientAuthStrategy) AllowMethodNone added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) AllowMethodNone() bool

AllowMethodNone returns false as the introspection endpoint does not permit clients to authenticate using the 'none' method.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionAlg added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionAlg(client AuthenticationMethodClient) string

GetAuthEncryptionAlg returns the encryption key algorithm used for client assertions at the introspection endpoint.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionEnc added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionEnc(client AuthenticationMethodClient) string

GetAuthEncryptionEnc returns the content encryption algorithm used for client assertions at the introspection endpoint.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionKeyID added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthEncryptionKeyID(client AuthenticationMethodClient) string

GetAuthEncryptionKeyID returns the encryption key id used for client assertions at the introspection endpoint.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthMethod added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthMethod(client AuthenticationMethodClient) string

GetAuthMethod returns the client's registered 'introspection_endpoint_auth_method'.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthSigningAlg added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthSigningAlg(client AuthenticationMethodClient) string

GetAuthSigningAlg returns the client's registered 'introspection_endpoint_auth_signing_alg'.

func (*IntrospectionEndpointClientAuthStrategy) GetAuthSigningKeyID added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) GetAuthSigningKeyID(client AuthenticationMethodClient) string

GetAuthSigningKeyID returns the signing key id used to verify client assertions at the introspection endpoint.

func (*IntrospectionEndpointClientAuthStrategy) Name added in v0.2.37 

func (s *IntrospectionEndpointClientAuthStrategy) Name() string

Name returns 'introspection', the name of the endpoint this strategy represents.

type IntrospectionEndpointClientAuthStrategyProvider added in v0.2.37 

type IntrospectionEndpointClientAuthStrategyProvider interface {
	// GetIntrospectionEndpointClientAuthStrategy returns the EndpointClientAuthStrategy used to authenticate clients at
	// the introspection endpoint. This endpoint does not permit public clients to authenticate using the 'none' method.
	GetIntrospectionEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)
}

IntrospectionEndpointClientAuthStrategyProvider returns the provider for the client authentication strategy used at the introspection endpoint.

type IntrospectionIssuerProvider added in v0.1.4 

type IntrospectionIssuerProvider interface {
	// GetIntrospectionIssuer returns the Introspection token issuer.
	GetIntrospectionIssuer(ctx context.Context) (issuer string)
}

IntrospectionIssuerProvider returns the provider for configuring the Introspection issuer.

type IntrospectionJWTResponseClient added in v0.1.4 

type IntrospectionJWTResponseClient interface {
	// GetIntrospectionSignedResponseKeyID returns the specific key identifier used to satisfy JWS requirements for
	// OAuth 2.0 JWT introspection response specifications. If unspecified the other available parameters will be
	// utilized to select an appropriate key.
	GetIntrospectionSignedResponseKeyID() (kid string)

	// GetIntrospectionSignedResponseAlg is equivalent to the 'introspection_signed_response_alg' client metadata
	// value which determines the JWS [RFC7515] algorithm (alg value) as defined in JWA [RFC7518] for signing
	// introspection responses. If this is specified, the response will be signed using JWS and the configured
	// algorithm. The default, if omitted, is RS256.
	GetIntrospectionSignedResponseAlg() (alg string)

	// GetIntrospectionEncryptedResponseKeyID returns the specific key identifier used to satisfy JWE requirements for
	// OAuth 2.0 JWT introspection response specifications. If unspecified the other available parameters will be
	// utilized to select an appropriate key.
	GetIntrospectionEncryptedResponseKeyID() (kid string)

	// GetIntrospectionEncryptedResponseAlg is equivalent to the 'introspection_encrypted_response_alg' client metadata
	// value which determines the JWE [RFC7516] algorithm (alg value) as defined in JWA [RFC7518] for content key
	// encryption. If this is specified, the response will be encrypted using JWE and the configured content encryption
	// algorithm (introspection_encrypted_response_enc). The default, if omitted, is that no encryption is performed.
	// If both signing and encryption are requested, the response will be signed then encrypted, with the result being
	// a Nested JWT, as defined in JWT [RFC7519].
	GetIntrospectionEncryptedResponseAlg() (alg string)

	// GetIntrospectionEncryptedResponseEnc is equivalent to the 'introspection_encrypted_response_enc' client metadata
	// value which determines the  JWE [RFC7516] algorithm (enc value) as defined in JWA [RFC7518] for content
	// encryption of introspection responses. The default, if omitted, is A128CBC-HS256. Note: This parameter MUST NOT
	// be specified without setting introspection_encrypted_response_alg.
	GetIntrospectionEncryptedResponseEnc() (enc string)

	Client
}

IntrospectionJWTResponseClient is a client which can potentially sign Introspection responses.

See: https://www.ietf.org/id/draft-ietf-oauth-jwt-introspection-response-12.html

type IntrospectionJWTResponseStrategyProvider added in v0.2.0 

type IntrospectionJWTResponseStrategyProvider interface {
	// GetIntrospectionJWTResponseStrategy returns the Introspection JWT Strategy.
	GetIntrospectionJWTResponseStrategy(ctx context.Context) jwt.Strategy
}

IntrospectionJWTResponseStrategyProvider returns the provider for configuring the Introspection jwt.Strategy.

type IntrospectionResponder 

type IntrospectionResponder interface {
	// IsActive returns true if the introspected token is active and false otherwise.
	IsActive() (active bool)

	// GetAccessRequester returns the AccessRequester which returns nil when IsActive() is false and the original access request object otherwise.
	GetAccessRequester() (requester AccessRequester)

	// GetTokenUse optionally returns the type of the token that was introspected. This could be "access_token", "refresh_token",
	// or if the type can not be determined an empty string.
	GetTokenUse() (tokenUse TokenUse)

	// GetAccessTokenType optionally returns the type of the access token that was introspected. This could be "bearer", "mac",
	// or empty string if the type of the token is refresh token.
	GetAccessTokenType() (tokenType string)

	// ToMap returns the audience values for this introspection for use with signed introspection responses, and map
	// values for this introspection regardless of what kind of introspection response.
	ToMap() (audience []string, introspection map[string]any)
}

IntrospectionResponder is the response object that will be returned when token introspection was successful, for example when the client is allowed to perform token introspection. Refer to https://datatracker.ietf.org/doc/html/rfc7662#section-2.2 for more details.

type IntrospectionResponderClient added in v0.3.0 

type IntrospectionResponderClient interface {
	IntrospectionResponder

	// GetClient returns the client the introspection response is sent to.
	GetClient() (client Client)
}

IntrospectionResponderClient is an IntrospectionResponder which reports the client the introspection response is sent to, being the caller rather than the client the introspected token was issued to. RFC 9701 Section 6 bases the response signing and encryption parameters on that client's registered metadata, and Section 5 requires 'aud' to identify it.

A responder which does not implement this is written as plain JSON: the parameters cannot be resolved from any other party without keying the response to one that is not receiving it.

type IntrospectionResponse 

type IntrospectionResponse struct {
	Client          Client          `json:"-"`
	Active          bool            `json:"active"`
	AccessRequester AccessRequester `json:"extra"`
	TokenUse        TokenUse        `json:"token_use,omitempty"`
	AccessTokenType string          `json:"token_type,omitempty"`
	Lang            language.Tag    `json:"-"`
}

func (*IntrospectionResponse) GetAccessRequester 

func (r *IntrospectionResponse) GetAccessRequester() AccessRequester

GetAccessRequester returns the AccessRequester reconstituted from the introspected token, including its session, client, scopes, and audience.

func (*IntrospectionResponse) GetAccessTokenType 

func (r *IntrospectionResponse) GetAccessTokenType() string

GetAccessTokenType returns the token_type value of the introspected token, where applicable.

func (*IntrospectionResponse) GetClient 

func (r *IntrospectionResponse) GetClient() Client

GetClient returns the client related to the introspected token.

func (*IntrospectionResponse) GetTokenUse 

func (r *IntrospectionResponse) GetTokenUse() TokenUse

GetTokenUse returns the kind of token that was introspected (access, refresh, etc.).

func (*IntrospectionResponse) IsActive 

func (r *IntrospectionResponse) IsActive() bool

IsActive returns whether the introspected token is currently active per RFC 7662 section 2.2.

func (*IntrospectionResponse) ToMap 

func (r *IntrospectionResponse) ToMap() (audience []string, introspection map[string]any)

ToMap returns the RFC 7662 introspection response as a map alongside the token's audience. When the token is inactive or the receiver is nil, only the 'active' claim is populated.

type JARClient added in v0.1.15 

type JARClient interface {
	// GetRequireSignedRequestObject is equivalent to the 'require_signed_request_object' client metadata value which
	// indicates where authorization request needs to be protected as a Request Object and provided through either the
	// 'request' or 'request_uri' parameter. When true a request which does not include one of these parameters MUST be
	// rejected, and the Request Object MUST be signed; i.e. a 'request_object_signing_alg' value of 'none' is not
	// sufficient to satisfy this requirement.
	//
	// See: https://www.rfc-editor.org/rfc/rfc9101#section-9.3
	GetRequireSignedRequestObject() (require bool)

	// GetRequestObjectSigningKeyID returns the specific key identifier used to satisfy JWS requirements of the request
	// object specifications. If unspecified the other available parameters will be utilized to select an appropriate
	// key.
	GetRequestObjectSigningKeyID() (kid string)

	// GetRequestObjectSigningAlg is equivalent to the 'request_object_signing_alg' client metadata
	// value which determines the JWS alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP.
	// All Request Objects from this Client MUST be rejected, if not signed with this algorithm. Request Objects are
	// described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. This algorithm MUST be used both when the
	// Request Object is passed by value (using the request parameter) and when it is passed by reference (using the
	// request_uri parameter). Servers SHOULD support RS256. The value none MAY be used. The default, if omitted, is
	// that any algorithm supported by the OP and the RP MAY be used.
	GetRequestObjectSigningAlg() (alg string)

	// GetRequestObjectEncryptionKeyID returns the specific key identifier used to satisfy JWE requirements of the
	// request object specifications. If unspecified the other available parameters will be utilized to select an
	// appropriate key.
	GetRequestObjectEncryptionKeyID() (kid string)

	// GetRequestObjectEncryptionAlg is equivalent to the 'request_object_encryption_alg' client metadata value which
	// determines the JWE alg algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to
	// the OP. This parameter SHOULD be included when symmetric encryption will be used, since this signals to the OP
	// that a client_secret value needs to be returned from which the symmetric key will be derived, that might not
	// otherwise be returned. The RP MAY still use other supported encryption algorithms or send unencrypted Request
	// Objects, even when this parameter is present. If both signing and encryption are requested, the Request Object
	// will be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. The default, if omitted,
	// is that the RP is not declaring whether it might encrypt any Request Objects.
	GetRequestObjectEncryptionAlg() (alg string)

	// GetRequestObjectEncryptionEnc is equivalent to the 'request_object_encryption_enc' client metadata value which
	// determines the JWE enc algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to
	// the OP. If request_object_encryption_alg is specified, the default request_object_encryption_enc value is
	// A128CBC-HS256. When request_object_encryption_enc is included, request_object_encryption_alg MUST also be
	// provided.
	GetRequestObjectEncryptionEnc() (enc string)

	// GetRequestURIs is an array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY
	// cache the contents of the files referenced by these URIs and not retrieve them at the time they are used in a request.
	// OPs can require that request_uri values used be pre-registered with the require_request_uri_registration
	// discovery parameter.
	GetRequestURIs() (requestURIs []string)

	JSONWebKeysClient
}

JARClient represents a client capable of performing OpenID Connect requests.

See: https://www.rfc-editor.org/rfc/rfc9101

type JARMClient 

type JARMClient interface {
	// GetAuthorizationSignedResponseKeyID returns the specific key identifier used to satisfy JWS requirements of the
	// JWT-secured Authorization Response Method (JARM) specifications. If unspecified the other available parameters
	// will be utilized to select an appropriate key.
	GetAuthorizationSignedResponseKeyID() (kid string)

	// GetAuthorizationSignedResponseAlg is equivalent to the 'authorization_signed_response_alg' client metadata
	// value which determines the JWS [RFC7515] alg algorithm JWA [RFC7518] REQUIRED for signing authorization
	// responses. If this is specified, the response will be signed using JWS and the configured algorithm. The
	// algorithm none is not allowed. The default, if omitted, is RS256.
	GetAuthorizationSignedResponseAlg() (alg string)

	// GetAuthorizationEncryptedResponseKeyID returns the specific key identifier used to satisfy JWE requirements of
	// the JWT-secured Authorization Response Method (JARM) specifications. If unspecified the other available parameters will be
	// utilized to select an appropriate key.
	GetAuthorizationEncryptedResponseKeyID() (kid string)

	// GetAuthorizationEncryptedResponseAlg is equivalent to the 'authorization_encrypted_response_alg' client metadata
	// value which determines the JWE [RFC7516] alg algorithm JWA [RFC7518] REQUIRED for encrypting authorization
	// responses. If both signing and encryption are requested, the response will be signed then encrypted, with the
	// result being a Nested JWT, as defined in JWT [RFC7519]. The default, if omitted, is that no encryption is
	// performed.
	GetAuthorizationEncryptedResponseAlg() (alg string)

	// GetAuthorizationEncryptedResponseEnc is equivalent to the 'authorization_encrypted_response_enc' client
	// metadata value which determines the JWE [RFC7516] enc algorithm JWA [RFC7518] REQUIRED for encrypting
	// authorization responses. If authorization_encrypted_response_alg is specified, the default for this value is
	// A128CBC-HS256. When authorization_encrypted_response_enc is included, authorization_encrypted_response_alg MUST
	// also be provided.
	GetAuthorizationEncryptedResponseEnc() (alg string)

	Client
}

JARMClient is a client which supports JARM.

See: https://openid.net/specs/oauth-v2-jarm.html

type JSONAuthorizeErrorFieldResponseStrategy added in v0.2.11 

type JSONAuthorizeErrorFieldResponseStrategy struct {
	Config SendDebugMessagesToClientsProvider
}

func (*JSONAuthorizeErrorFieldResponseStrategy) WriteErrorFieldResponse added in v0.2.11 

func (s *JSONAuthorizeErrorFieldResponseStrategy) WriteErrorFieldResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, rfc *RFC6749Error)

WriteErrorFieldResponse serializes the given RFC 6749 error as a JSON body and writes it to rw using the error's status code. This is the default strategy used by Fosite.WriteAuthorizeError when no response_mode handler matches.

type JSONWebKeysClient added in v0.1.11 

type JSONWebKeysClient interface {
	// GetJSONWebKeys returns the JSON Web Key Set containing the public key used by the client to authenticate.
	GetJSONWebKeys() (jwks *jose.JSONWebKeySet)

	// GetJSONWebKeysURI returns the URL for lookup of JSON Web Key Set containing the
	// public key used by the client to authenticate.
	GetJSONWebKeysURI() (uri string)

	Client
}

JSONWebKeysClient is a client base which includes a JSON Web Key Set registration.

type JWKSFetcherStrategyProvider 

type JWKSFetcherStrategyProvider interface {
	// GetJWKSFetcherStrategy returns the JWKS fetcher strategy.
	GetJWKSFetcherStrategy(ctx context.Context) (strategy jwt.JWKSFetcherStrategy)
}

JWKSFetcherStrategyProvider returns the provider for configuring the JWKS fetcher strategy.

type JWTClockSkewProvider added in v0.3.3 

type JWTClockSkewProvider interface {
	// GetJWTClockSkew returns how far into the future an 'iat' or 'nbf' claim may be in a JWT received from a client,
	// such as a client assertion, a request object, or an RFC 7523 authorization grant.
	GetJWTClockSkew(ctx context.Context) (skew time.Duration)
}

JWTClockSkewProvider returns the provider for configuring the clock skew permitted when validating a JWT.

type JWTProfileAccessTokensProvider 

type JWTProfileAccessTokensProvider interface {
	// GetEnforceJWTProfileAccessTokens when returning true will disregard the registered client capabilities for
	// Access Token generation and produce only JWT Profile Access Tokens.
	GetEnforceJWTProfileAccessTokens(ctx context.Context) (enable bool)
}

JWTProfileAccessTokensProvider provides configuration options to the JWT Profile strategies.

type JWTProfileClient 

type JWTProfileClient interface {
	// GetAccessTokenSignedResponseKeyID returns the specific key identifier used to satisfy JWS requirements for
	// JWT Profile for OAuth 2.0 Access Tokens specifications. If unspecified the other available parameters will be
	// utilized to select an appropriate key.
	GetAccessTokenSignedResponseKeyID() (kid string)

	// GetAccessTokenSignedResponseAlg determines the JWS [RFC7515] algorithm (alg value) as defined in JWA [RFC7518]
	// for signing JWT Profile Access Token responses. If this is specified, the response will be signed using JWS and
	// the configured algorithm. The default, if omitted, is none; i.e. unsigned responses unless the
	// GetEnableJWTProfileOAuthAccessTokens receiver returns true in which case the default is RS256.
	GetAccessTokenSignedResponseAlg() (alg string)

	// GetAccessTokenEncryptedResponseKeyID returns the specific key identifier used to satisfy JWE requirements for
	// JWT Profile for OAuth 2.0 Access Tokens specifications. If unspecified the other available parameters will be
	// utilized to select an appropriate key.
	GetAccessTokenEncryptedResponseKeyID() (kid string)

	// GetAccessTokenEncryptedResponseAlg determines the JWE [RFC7516] algorithm (alg value) as defined in JWA [RFC7518]
	// for content key encryption. If this is specified, the response will be encrypted using JWE and the configured
	// content encryption algorithm (access_token_encrypted_response_enc). The default, if omitted, is that no
	// encryption is performed. If both signing and encryption are requested, the response will be signed then
	// encrypted, with the result being a Nested JWT, as defined in JWT [RFC7519].
	GetAccessTokenEncryptedResponseAlg() (alg string)

	// GetAccessTokenEncryptedResponseEnc determines the JWE [RFC7516] algorithm (enc value) as defined in JWA [RFC7518]
	// for content encryption of access token responses. The default, if omitted, is A128CBC-HS256. Note: This parameter
	// MUST NOT be specified without setting access_token_encrypted_response_alg.
	GetAccessTokenEncryptedResponseEnc() (alg string)

	// GetEnableJWTProfileOAuthAccessTokens indicates this client should or should not issue JWT Profile Access Tokens.
	GetEnableJWTProfileOAuthAccessTokens() (enforce bool)

	Client
}

JWTProfileClient represents a client with can handle RFC9068 responses; i.e. the JWT Profile for OAuth 2.0 Access Tokens.

type JWTScopeFieldProvider 

type JWTScopeFieldProvider interface {
	// GetJWTScopeField returns the JWT scope field.
	GetJWTScopeField(ctx context.Context) jwt.JWTScopeFieldEnum
}

JWTScopeFieldProvider returns the provider for configuring the JWT scope field.

type JWTSecuredAuthorizationRequestConfigProvider added in v0.3.0 

type JWTSecuredAuthorizationRequestConfigProvider interface {
	// GetRequireSignedRequestObject is equivalent to the 'require_signed_request_object' authorization server metadata
	// value which indicates if the use of JWT-Secured Authorization Requests is globally required. In this mode a
	// client cannot pass authorization parameters via the OAuth 2.0 request syntax alone; the request must be
	// protected as a signed Request Object provided by either the 'request' or 'request_uri' parameter.
	GetRequireSignedRequestObject(ctx context.Context) (require bool)

	// GetRequireSignedRequestObjectSkipPushedAuthorizationRequests indicates if the requirement enforced by
	// GetRequireSignedRequestObject, or by the client metadata value of the same name, is skipped for requests made
	// directly to the Pushed Authorization Request endpoint. A Pushed Authorization Request is submitted via an
	// authenticated back-channel request which provides similar integrity guarantees to a Request Object, so some
	// deployments may consider it a sufficient substitute. This does not affect requests made to the authorization
	// endpoint.
	GetRequireSignedRequestObjectSkipPushedAuthorizationRequests(ctx context.Context) (skip bool)

	// GetRequireRequestObjectAudienceAndLifetime indicates if a Request Object must contain the 'aud', 'nbf' and 'exp'
	// claims, with an 'nbf' claim no more than GetRequestObjectMaximumLifetime in the past and an 'exp' claim no more
	// than GetRequestObjectMaximumLifetime after it. RFC 9101 requires none of these claims.
	//
	// See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1
	GetRequireRequestObjectAudienceAndLifetime(ctx context.Context) (require bool)

	// GetRequestObjectMaximumLifetime returns the bound applied to a Request Object's 'nbf' and 'exp' claims when
	// GetRequireRequestObjectAudienceAndLifetime is enabled. A zero or negative value disables the bound.
	//
	// See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1
	GetRequestObjectMaximumLifetime(ctx context.Context) (lifetime time.Duration)
}

JWTSecuredAuthorizationRequestConfigProvider is the configuration provider for JWT-Secured Authorization Requests (JAR).

See: https://www.rfc-editor.org/rfc/rfc9101#section-9.2

type JWTSecuredAuthorizationRequestJWTValidationOptionsClient added in v0.2.18 

type JWTSecuredAuthorizationRequestJWTValidationOptionsClient interface {
	GetJWTSecuredAuthorizationRequestJWTValidationHeaderAllowEmptyType() (allow bool)
	GetJWTSecuredAuthorizationRequestJWTValidationHeaderAllowTypes() (algs []string)

	Client
}

JWTSecuredAuthorizationRequestJWTValidationOptionsClient allows extending the JWT-Secured Authorization Request (JAR) validation and strengthening the security posture of JAR through strict typing.

type JWTSecuredAuthorizeResponseModeIssuerProvider 

type JWTSecuredAuthorizeResponseModeIssuerProvider interface {
	// GetJWTSecuredAuthorizeResponseModeIssuer returns the JARM issuer.
	GetJWTSecuredAuthorizeResponseModeIssuer(ctx context.Context) string
}

JWTSecuredAuthorizeResponseModeIssuerProvider returns the provider for configuring the JARM issuer.

type JWTSecuredAuthorizeResponseModeLifespanProvider 

type JWTSecuredAuthorizeResponseModeLifespanProvider interface {
	GetJWTSecuredAuthorizeResponseModeLifespan(ctx context.Context) time.Duration
}

JWTSecuredAuthorizeResponseModeLifespanProvider returns the provider for configuring the JWT Secured Authorize Response Mode token lifespan.

type JWTSecuredAuthorizeResponseModeStrategyProvider added in v0.2.0 

type JWTSecuredAuthorizeResponseModeStrategyProvider interface {
	// GetJWTSecuredAuthorizeResponseModeStrategy returns the JARM Strategy.
	GetJWTSecuredAuthorizeResponseModeStrategy(ctx context.Context) jwt.Strategy
}

JWTSecuredAuthorizeResponseModeStrategyProvider returns the provider for configuring the JARM jwt.Strategy.

type JWTStrategyProvider added in v0.2.0 

type JWTStrategyProvider interface {
	GetJWTStrategy(ctx context.Context) jwt.Strategy
}

JWTStrategyProvider returns the provider for configuring the jwt.Strategy.

type MTLSBoundSession added in v0.3.0 

type MTLSBoundSession interface {
	// SetClientCertificateSHA256Thumbprint records the certificate thumbprint (x5t#S256) the token is bound to.
	SetClientCertificateSHA256Thumbprint(x5t string)

	// GetClientCertificateSHA256Thumbprint returns the bound certificate thumbprint, or an empty string when the
	// session is not certificate bound.
	GetClientCertificateSHA256Thumbprint() (x5t string)
}

MTLSBoundSession is implemented by sessions that can be bound to a mutual-TLS client certificate per RFC 8705 Section 3. The binding is the base64url SHA-256 thumbprint of the certificate's DER encoding, the same value used for 'x5t#S256' in the 'cnf' claim.

Both accessors are required. The setter is what RestoreConfirmation uses to recover the binding from a stateless token, whose own claims are the only record of what it is bound to; a session implementing only the getter reports such a token as unbound.

type MTLSClient added in v0.3.0 

type MTLSClient interface {
	// GetEnableTLSClientAuthBoundAccessTokens returns the 'tls_client_certificate_bound_access_tokens' client
	// metadata value. When true, tokens issued to this client are bound to the certificate it presents.
	GetEnableTLSClientAuthBoundAccessTokens() (enable bool)

	Client
}

MTLSClient represents a client that can advertise the 'tls_client_certificate_bound_access_tokens' metadata value per RFC 8705 Section 3.4.

type MTLSConfigProvider added in v0.3.0 

type MTLSConfigProvider interface {
	// GetMTLSEnabled returns true if RFC 8705 handling is enabled.
	GetMTLSEnabled(ctx context.Context) (enabled bool)

	// GetMTLSEnforce returns true if certificate-bound access tokens are required for all clients regardless of
	// client metadata.
	GetMTLSEnforce(ctx context.Context) (enforce bool)

	// GetMTLSClientCertificateHeader returns the name of the header carrying the client certificate forwarded by a
	// trusted TLS terminating proxy, or an empty string to never read one.
	GetMTLSClientCertificateHeader(ctx context.Context) (header string)
}

MTLSConfigProvider is the configuration provider for RFC 8705 Mutual-TLS.

type MessageCatalogProvider 

type MessageCatalogProvider interface {
	// GetMessageCatalog returns the message catalog.
	GetMessageCatalog(ctx context.Context) (catalog i18n.MessageCatalog)
}

MessageCatalogProvider returns the provider for configuring the message catalog.

type MinParameterEntropyProvider 

type MinParameterEntropyProvider interface {
	// GetMinParameterEntropy returns the minimum parameter entropy.
	GetMinParameterEntropy(_ context.Context) (min int)
}

MinParameterEntropyProvider returns the provider for configuring the minimum parameter entropy.

type OIDCKeyBindingConfigProvider added in v0.3.1 

type OIDCKeyBindingConfigProvider interface {
	// GetOIDCKeyBindingEnabled returns true if OpenID Connect Key Binding 1.0 handling is enabled.
	GetOIDCKeyBindingEnabled(ctx context.Context) (enabled bool)
}

OIDCKeyBindingConfigProvider is the configuration provider for OpenID Connect Key Binding 1.0.

type OmitRedirectScopeParamProvider 

type OmitRedirectScopeParamProvider interface {
	// GetOmitRedirectScopeParam must be set to true if the scope query param is to be omitted
	// in the authorization's redirect URI
	GetOmitRedirectScopeParam(ctx context.Context) (omit bool)
}

OmitRedirectScopeParamProvider returns the provider for configuring the omit redirect scope param.

type OriginURIComparisonStrategy added in v0.2.18 

type OriginURIComparisonStrategy struct{}

OriginURIComparisonStrategy is used to compare URIs. When the registered URI is a Origin URI (only scheme and host), the comparison is truthy when the scheme and host parts are the same.

func (OriginURIComparisonStrategy) Compare added in v0.2.18 

func (OriginURIComparisonStrategy) Compare(pair *uriPair) bool

func (OriginURIComparisonStrategy) UseSimpleStringComparison added in v0.2.18 

func (OriginURIComparisonStrategy) UseSimpleStringComparison() bool

type PARStorage 

type PARStorage interface {
	// CreatePARSession stores the pushed authorization request context. The requestURI is used to derive the key.
	CreatePARSession(ctx context.Context, requestURI string, request AuthorizeRequester) (err error)

	// GetPARSession gets the push authorization request context. The caller is expected to merge the AuthorizeRequest.
	GetPARSession(ctx context.Context, requestURI string) (requester AuthorizeRequester, err error)

	// DeletePARSession deletes the context.
	DeletePARSession(ctx context.Context, requestURI string) (err error)
}

PARStorage holds information needed to store and retrieve PAR context.

type PlainTextClientSecret added in v0.2.0 

type PlainTextClientSecret struct {
	// contains filtered or unexported fields
}

func NewPlainTextClientSecret added in v0.2.0 

func NewPlainTextClientSecret(value string) *PlainTextClientSecret

NewPlainTextClientSecret returns a new PlainTextClientSecret given a value.

func (*PlainTextClientSecret) Compare added in v0.2.0 

func (s *PlainTextClientSecret) Compare(ctx context.Context, secret []byte) (err error)

func (*PlainTextClientSecret) GetPlainTextValue added in v0.2.0 

func (s *PlainTextClientSecret) GetPlainTextValue() (secret []byte, err error)

func (*PlainTextClientSecret) IsPlainText added in v0.2.0 

func (s *PlainTextClientSecret) IsPlainText() (is bool)

func (*PlainTextClientSecret) Valid added in v0.2.0 

func (s *PlainTextClientSecret) Valid() (valid bool)

type PrivateKey 

type PrivateKey interface {
	Public() crypto.PublicKey
	Equal(x crypto.PrivateKey) bool
}

PrivateKey properly describes crypto.PrivateKey.

type ProofKeyCodeExchangeClient 

type ProofKeyCodeExchangeClient interface {
	GetEnforcePKCE() (enforce bool)
	GetEnforcePKCEChallengeMethod() (enforce bool)
	GetPKCEChallengeMethod() (method string)

	Client
}

ProofKeyCodeExchangeClient is a Client implementation which provides PKCE client policy values.

type Provider 

type Provider interface {
	// NewAuthorizeRequest returns an AuthorizeRequest.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1
	//	 Extension response types MAY contain a space-delimited (%x20) list of
	//	 values, where the order of values does not matter (e.g., response
	//	 type "a b" is the same as "b a").  The meaning of such composite
	//	 response types is defined by their respective specifications.
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2
	//   The redirection endpoint URI MUST be an absolute URI as defined by
	//   [RFC3986] Section 4.3.  The endpoint URI MAY include an
	//   "application/x-www-form-urlencoded" formatted (per Appendix B) query
	//   component ([RFC3986] Section 3.4), which MUST be retained when adding
	//   additional query parameters.  The endpoint URI MUST NOT include a
	//   fragment component.
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.2 (everything MUST be implemented)
	NewAuthorizeRequest(ctx context.Context, r *http.Request) (requester AuthorizeRequester, err error)

	// NewAuthorizeResponse iterates through all response type handlers and returns their result or
	// ErrUnsupportedResponseType if none of the handlers were able to handle it.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.1
	//	 Extension response types MAY contain a space-delimited (%x20) list of
	//	 values, where the order of values does not matter (e.g., response
	//	 type "a b" is the same as "b a").  The meaning of such composite
	//	 response types is defined by their respective specifications.
	//	 If an authorization request is missing the "response_type" parameter,
	//	 or if the response type is not understood, the authorization server
	//	 MUST return an error response as described in Section 4.1.2.1.
	NewAuthorizeResponse(ctx context.Context, request AuthorizeRequester, session Session) (responder AuthorizeResponder, err error)

	// WriteAuthorizeError returns the error codes to the redirection endpoint or shows the error to the user, if no valid
	// redirect uri was given. Implements rfc6749#section-4.1.2.1
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2
	//   The redirection endpoint URI MUST be an absolute URI as defined by
	//   [RFC3986] Section 4.3.  The endpoint URI MAY include an
	//   "application/x-www-form-urlencoded" formatted (per Appendix B) query
	//   component ([RFC3986] Section 3.4), which MUST be retained when adding
	//   additional query parameters.  The endpoint URI MUST NOT include a
	//   fragment component.
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 (everything)
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.2 (everything MUST be implemented)
	WriteAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, err error)

	// WriteAuthorizeResponse persists the AuthorizeSession in the store and redirects the user agent to the provided
	// redirect url or returns an error if storage failed.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#rfc6749#section-4.1.2.1
	//   After completing its interaction with the resource owner, the
	//   authorization server directs the resource owner's user-agent back to
	//   the client.  The authorization server redirects the user-agent to the
	//   client's redirection endpoint previously established with the
	//   authorization server during the client registration process or when
	//   making the authorization request.
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.2 (everything MUST be implemented)
	WriteAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, response AuthorizeResponder)

	// NewAccessRequest creates a new access request object and validates
	// various parameters.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.2 (everything)
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1 (everything)
	//
	// Furthermore the registered handlers should implement their specs accordingly.
	NewAccessRequest(ctx context.Context, r *http.Request, session Session) (requester AccessRequester, err error)

	// NewAccessResponse creates a new access response and validates that access_token and token_type are set.
	//
	// The following specs must be considered in any implementation of this method:
	// https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
	NewAccessResponse(ctx context.Context, request AccessRequester) (responder AccessResponder, err error)

	// WriteAccessError writes an access request error response.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 (everything)
	WriteAccessError(ctx context.Context, rw http.ResponseWriter, request AccessRequester, err error)

	// WriteAccessResponse writes the access response.
	//
	// The following specs must be considered in any implementation of this method:
	// https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
	WriteAccessResponse(ctx context.Context, rw http.ResponseWriter, request AccessRequester, response AccessResponder)

	// NewRevocationRequest handles incoming token revocation requests and validates various parameters.
	//
	// The following specs must be considered in any implementation of this method:
	// https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
	NewRevocationRequest(ctx context.Context, r *http.Request) (err error)

	// WriteRevocationResponse writes the revoke response.
	//
	// The following specs must be considered in any implementation of this method:
	// https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
	WriteRevocationResponse(ctx context.Context, rw http.ResponseWriter, err error)

	// IntrospectToken returns token metadata, if the token is valid. Tokens generated by the authorization endpoint,
	// such as the authorization code, can not be introspected.
	IntrospectToken(ctx context.Context, token string, tokenUse TokenUse, session Session, scope ...string) (actualTokenUse TokenUse, requester AccessRequester, err error)

	// NewIntrospectionRequest initiates token introspection as defined in
	//https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
	NewIntrospectionRequest(ctx context.Context, r *http.Request, session Session) (responder IntrospectionResponder, err error)

	// WriteIntrospectionError responds with an error if token introspection failed as defined in
	//https://datatracker.ietf.org/doc/html/rfc7662#section-2.3
	WriteIntrospectionError(ctx context.Context, rw http.ResponseWriter, err error)

	// WriteIntrospectionResponse responds with token metadata discovered by token introspection as defined in
	//https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
	WriteIntrospectionResponse(ctx context.Context, rw http.ResponseWriter, response IntrospectionResponder)

	// NewPushedAuthorizeRequest validates the request and produces an AuthorizeRequester object that can be stored
	NewPushedAuthorizeRequest(ctx context.Context, r *http.Request) (requester AuthorizeRequester, err error)

	// NewPushedAuthorizeResponse executes the handlers and builds the response
	NewPushedAuthorizeResponse(ctx context.Context, request AuthorizeRequester, session Session) (responder PushedAuthorizeResponder, err error)

	// WritePushedAuthorizeResponse writes the PAR response
	WritePushedAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, responder PushedAuthorizeResponder)

	// WritePushedAuthorizeError writes the PAR error
	WritePushedAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, err error)

	// NewRFC862DeviceAuthorizeRequest validate the OAuth 2.0 Device Authorization Flow Request
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.1 (everything MUST be implemented)
	// Parameters sent without a value MUST be treated as if they were
	// omitted from the request.  The authorization server MUST ignore
	// unrecognized request parameters.  Request and response parameters
	// MUST NOT be included more than once.
	NewRFC862DeviceAuthorizeRequest(ctx context.Context, r *http.Request) (requester DeviceAuthorizeRequester, err error)

	// NewRFC862DeviceAuthorizeResponse persists the DeviceCodeSession and UserCodeSession in the store
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.2 (everything MUST be implemented)
	// In response, the authorization server generates a unique device
	// verification code and an end-user code that are valid for a limited
	// time
	NewRFC862DeviceAuthorizeResponse(ctx context.Context, request DeviceAuthorizeRequester, session Session) (responder DeviceAuthorizeResponder, err error)

	// WriteRFC862DeviceAuthorizeResponse return to the user both codes and
	// some configuration information in a JSON formatted manner
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.2 (everything MUST be implemented)
	// Response is a HTTP response body using the
	// "application/json" format [RFC8259] with a 200 (OK) status code.
	WriteRFC862DeviceAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request DeviceAuthorizeRequester, response DeviceAuthorizeResponder)

	// WriteRFC8628UserAuthorizeResponse returns the device grant user verification result in a JSON formatted manner.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.3 (everything MUST be implemented)
	// Response is a HTTP response body using the
	// "application/json" format [RFC8259] with a 200 (OK) status code.
	WriteRFC8628UserAuthorizeResponse(cxt context.Context, rw http.ResponseWriter, request DeviceAuthorizeRequester, response DeviceUserAuthorizeResponder)

	// WriteRFC8628UserAuthorizeError returns the device grant user verification error in a JSON formatted manner.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.3 (everything MUST be implemented)
	// Response is a HTTP response body using the
	// "application/json" format [RFC8259] with a 200 (OK) status code.
	WriteRFC8628UserAuthorizeError(_ context.Context, rw http.ResponseWriter, request DeviceAuthorizeRequester, err error)

	// NewRFC8628UserAuthorizeRequest validate the OAuth 2.0 Device Authorization Flow - User interaction Request
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.3 (everything MUST be implemented)
	// Parameters sent without a value MUST be treated as if they were
	// omitted from the request. The authorization server MUST ignore
	// unrecognized request parameters. Request and response parameters
	// MUST NOT be included more than once.
	NewRFC8628UserAuthorizeRequest(ctx context.Context, r *http.Request) (requester DeviceAuthorizeRequester, err error)

	// NewRFC8628UserAuthorizeResponse persists the DeviceCodeSession and UserCodeSession in the store
	//
	// The following specs must be considered in any implementation of this method:
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.2 (everything MUST be implemented)
	// In response, the authorization server generates a unique device
	// verification code and an end-user code that are valid for a limited
	// time
	NewRFC8628UserAuthorizeResponse(ctx context.Context, request DeviceAuthorizeRequester, session Session) (responder DeviceUserAuthorizeResponder, err error)

	// NewRFC7591ClientRegistrationRequest validates the request and produces a ClientRegistrationRequester.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7591#section-3.1 (everything MUST be implemented)
	NewRFC7591ClientRegistrationRequest(ctx context.Context, r *http.Request) (requester ClientRegistrationRequester, err error)

	// NewRFC7591ClientRegistrationResponse executes the configured client registration endpoint handlers and builds
	// the response.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1 (everything MUST be implemented)
	NewRFC7591ClientRegistrationResponse(ctx context.Context, requester ClientRegistrationRequester) (responder ClientRegistrationResponder, err error)

	// WriteRFC7591ClientRegistrationResponse writes the client registration response with a 201 (Created) status.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1 (everything MUST be implemented)
	WriteRFC7591ClientRegistrationResponse(ctx context.Context, rw http.ResponseWriter, requester ClientRegistrationRequester, responder ClientRegistrationResponder)

	// WriteRFC7591ClientRegistrationError writes a client registration endpoint error response.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 (everything MUST be implemented)
	WriteRFC7591ClientRegistrationError(ctx context.Context, rw http.ResponseWriter, requester ClientRegistrationRequester, err error)

	// NewRFC7592ClientConfigurationRequest validates the request and produces a ClientConfigurationRequester.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7592#section-2 (everything MUST be implemented)
	NewRFC7592ClientConfigurationRequest(ctx context.Context, r *http.Request) (requester ClientConfigurationRequester, err error)

	// NewRFC7592ClientConfigurationResponse executes the configured client configuration endpoint handlers and
	// builds the response.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7592#section-2 (everything MUST be implemented)
	NewRFC7592ClientConfigurationResponse(ctx context.Context, requester ClientConfigurationRequester) (responder ClientConfigurationResponder, err error)

	// WriteRFC7592ClientConfigurationResponse writes the client configuration response. A 204 (No Content) status,
	// written for a successful DELETE, carries no body.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7592#section-2.3 (everything MUST be implemented)
	WriteRFC7592ClientConfigurationResponse(ctx context.Context, rw http.ResponseWriter, requester ClientConfigurationRequester, responder ClientConfigurationResponder)

	// WriteRFC7592ClientConfigurationError writes a client configuration endpoint error response, mapping to the
	// status codes described in RFC 7592 Section 3: 401 (with a 'WWW-Authenticate: Bearer' header) for a missing or
	// invalid registration access token, 404 for an unknown client_id, and 405 for an unsupported method.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://datatracker.ietf.org/doc/html/rfc7592#section-3 (everything MUST be implemented)
	WriteRFC7592ClientConfigurationError(ctx context.Context, rw http.ResponseWriter, requester ClientConfigurationRequester, err error)

	// NewRPInitiatedLogoutRequest parses and validates a request to the OpenID Connect end session endpoint. It does
	// not authenticate the client, end any session, or write a response; on error the returned requester carries no
	// post logout redirect URI.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout (everything MUST be implemented)
	// * https://openid.net/specs/openid-connect-rpinitiated-1_0.html#ValidationAndErrorHandling (everything MUST be implemented)
	NewRPInitiatedLogoutRequest(ctx context.Context, r *http.Request) (requester RPInitiatedLogoutRequester, err error)

	// SendBackChannelLogout delivers a Logout Token to each client supplied by the requester. Delivery is best effort:
	// a result is returned for every client, in the order supplied, and only whole-operation failures are returned as
	// err.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken (everything MUST be implemented)
	// * https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRequest (everything MUST be implemented)
	SendBackChannelLogout(ctx context.Context, requester BackChannelLogoutRequester) (results []BackChannelLogoutResult, err error)

	// RequireRedirectURIPushedAuthorizationRequest determines if the 'redirect_uri' parameter is required in a Pushed
	// Authorization Request, being when either the provider-wide option or the client's own policy is set.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.2
	RequireRedirectURIPushedAuthorizationRequest(ctx context.Context, client Client) (require bool)

	// RequestObjectAudienceAndLifetime determines if a Request Object must contain the 'aud', 'nbf' and 'exp' claims,
	// and the lifetime bounding them, from the provider-wide options and the client's own policy.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1
	RequestObjectAudienceAndLifetime(ctx context.Context, client JARClient) (require bool, lifetime time.Duration)

	// DisableRefreshTokenRotation determines if the refresh token grant keeps the presented refresh token, being when
	// either the provider-wide option or the client's own policy is set.
	//
	// The following specs must be considered in any implementation of this method:
	// * https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1
	DisableRefreshTokenRotation(ctx context.Context, client Client) (disable bool)
}

Provider is an interface that enables you to write OAuth2 handlers with only a few lines of code. Check Fosite for an implementation of this interface.

type PushedAuthorizationRequestClient 

type PushedAuthorizationRequestClient interface {
	// GetRequirePushedAuthorizationRequests should return true if this client MUST use a Pushed Authorization Request.
	GetRequirePushedAuthorizationRequests() (require bool)

	// GetPushedAuthorizeContextLifespan should return a custom lifespan or a duration of 0 seconds to utilize the
	// global lifespan.
	GetPushedAuthorizeContextLifespan() (lifespan time.Duration)

	Client
}

PushedAuthorizationRequestClient is a client with custom requirements for Pushed Authorization requests.

type PushedAuthorizationRequestRedirectURIClient added in v0.3.3 

type PushedAuthorizationRequestRedirectURIClient interface {
	// GetRequireRedirectURIPushedAuthorizationRequests should return true if this client MUST include the
	// 'redirect_uri' parameter in a Pushed Authorization Request.
	GetRequireRedirectURIPushedAuthorizationRequests() (require bool)

	Client
}

PushedAuthorizationRequestRedirectURIClient is a client which requires the 'redirect_uri' parameter in its own Pushed Authorization Requests. The requirement applies when either this or the provider-wide option is set.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.2

type PushedAuthorizeEndpointHandler 

type PushedAuthorizeEndpointHandler interface {
	// HandlePushedAuthorizeEndpointRequest handles a pushed authorize endpoint request. To extend the handler's capabilities, the http request
	// is passed along, if further information retrieval is required. If the handler feels that he is not responsible for
	// the pushed authorize request, he must return nil and NOT modify session nor responder neither requester.
	HandlePushedAuthorizeEndpointRequest(ctx context.Context, request AuthorizeRequester, response PushedAuthorizeResponder) (err error)
}

PushedAuthorizeEndpointHandler is the interface that handles PAR (https://datatracker.ietf.org/doc/html/rfc9126)

type PushedAuthorizeEndpointHandlers 

type PushedAuthorizeEndpointHandlers []PushedAuthorizeEndpointHandler

PushedAuthorizeEndpointHandlers is a list of PushedAuthorizeEndpointHandler

func (*PushedAuthorizeEndpointHandlers) Append 

func (a *PushedAuthorizeEndpointHandlers) Append(h PushedAuthorizeEndpointHandler)

Append adds an AuthorizeEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type PushedAuthorizeRequestConfigProvider 

type PushedAuthorizeRequestConfigProvider interface {
	// GetPushedAuthorizeRequestURIPrefix is the request URI prefix. This is
	// usually 'urn:ietf:params:oauth:request_uri:'.
	GetPushedAuthorizeRequestURIPrefix(ctx context.Context) (prefix string)

	// GetPushedAuthorizeContextLifespan is the lifespan of the short-lived PAR context.
	GetPushedAuthorizeContextLifespan(ctx context.Context) (lifespan time.Duration)

	// GetRequirePushedAuthorizationRequests indicates if the use of Pushed Authorization Requests is gobally required.
	// In this mode, a client cannot pass authorize parameters at the 'authorize' endpoint. The 'authorize' endpoint
	// must contain the PAR request_uri.
	GetRequirePushedAuthorizationRequests(ctx context.Context) (enforce bool)

	// GetRequireRedirectURIPushedAuthorizationRequests indicates if the 'redirect_uri' parameter is required in
	// Pushed Authorization Requests, even when the client has a single registered redirect URI which would otherwise
	// be used as the default.
	//
	// See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.2
	GetRequireRedirectURIPushedAuthorizationRequests(ctx context.Context) (require bool)
}

PushedAuthorizeRequestConfigProvider is the configuration provider for pushed authorization requests.

type PushedAuthorizeRequestHandlersProvider 

type PushedAuthorizeRequestHandlersProvider interface {
	// GetPushedAuthorizeEndpointHandlers returns the handlers.
	GetPushedAuthorizeEndpointHandlers(ctx context.Context) (handlers PushedAuthorizeEndpointHandlers)
}

PushedAuthorizeRequestHandlersProvider returns the provider for configuring the PAR handlers.

type PushedAuthorizeResponder 

type PushedAuthorizeResponder interface {
	// GetRequestURI returns the request_uri
	GetRequestURI() (uri string)

	// SetRequestURI sets the request_uri.
	SetRequestURI(requestURI string)

	// GetExpiresIn gets the expires_in.
	GetExpiresIn() (expires int)

	// SetExpiresIn sets the expires_in.
	SetExpiresIn(seconds int)

	// GetHeader returns the response's header.
	GetHeader() (header http.Header)

	// AddHeader adds a header key value pair to the response.
	AddHeader(key, value string)

	// SetExtra sets a key value pair for the response.
	SetExtra(key string, value any)

	// GetExtra returns a key's value.
	GetExtra(key string) (extra any)

	// ToMap converts the response to a map.
	ToMap() (values map[string]any)
}

PushedAuthorizeResponder is the response object for PAR.

type PushedAuthorizeResponse 

type PushedAuthorizeResponse struct {
	RequestURI string `json:"request_uri"`
	ExpiresIn  int    `json:"expires_in"`
	Header     http.Header
	Extra      map[string]any
}

PushedAuthorizeResponse is the response object for PAR

func (*PushedAuthorizeResponse) AddHeader 

func (a *PushedAuthorizeResponse) AddHeader(key, value string)

AddHeader adds

func (*PushedAuthorizeResponse) GetExpiresIn 

func (a *PushedAuthorizeResponse) GetExpiresIn() int

GetExpiresIn gets

func (*PushedAuthorizeResponse) GetExtra 

func (a *PushedAuthorizeResponse) GetExtra(key string) any

GetExtra gets

func (*PushedAuthorizeResponse) GetHeader 

func (a *PushedAuthorizeResponse) GetHeader() http.Header

GetHeader gets

func (*PushedAuthorizeResponse) GetRequestURI 

func (a *PushedAuthorizeResponse) GetRequestURI() string

GetRequestURI gets

func (*PushedAuthorizeResponse) SetExpiresIn 

func (a *PushedAuthorizeResponse) SetExpiresIn(seconds int)

SetExpiresIn sets

func (*PushedAuthorizeResponse) SetExtra 

func (a *PushedAuthorizeResponse) SetExtra(key string, value any)

SetExtra sets

func (*PushedAuthorizeResponse) SetRequestURI 

func (a *PushedAuthorizeResponse) SetRequestURI(requestURI string)

SetRequestURI sets

func (*PushedAuthorizeResponse) ToMap 

func (a *PushedAuthorizeResponse) ToMap() map[string]any

ToMap converts to a map

type RFC6749Error 

type RFC6749Error struct {
	ErrorField       string
	DescriptionField string
	HintField        string
	CodeField        int
	DebugField       string
	ScopeField       string `json:"-"`
	// contains filtered or unexported fields
}

func ErrorToRFC6749Error 

func ErrorToRFC6749Error(err error) *RFC6749Error

ErrorToRFC6749Error returns the *RFC6749Error wrapped by err if one is present, otherwise it returns a synthetic RFC6749Error with the 'unknown_error' code and a 500 status, preserving the original err as the cause and debug message.

func ErrorToRFC6749ErrorFallback 

func ErrorToRFC6749ErrorFallback(err error, fallback *RFC6749Error) *RFC6749Error

ErrorToRFC6749ErrorFallback behaves like ErrorToRFC6749Error but returns a copy of fallback (wrapping err) instead of the generic 'unknown_error' when err is not already a known RFC6749Error.

func (*RFC6749Error) Cause 

func (e *RFC6749Error) Cause() error

Cause returns the underlying error that produced this one, equivalent to errors.Unwrap.

func (*RFC6749Error) Debug 

func (e *RFC6749Error) Debug() string

Debug returns the debug message attached to the error. The value is only ever exposed to clients when WithExposeDebug(true) has been set on the error.

func (*RFC6749Error) Details 

func (e *RFC6749Error) Details() map[string]any

Details satisfies the errorsx.DetailsCarrier interface; RFC6749Errors carry no structured details so nil is returned.

func (RFC6749Error) Error 

func (e RFC6749Error) Error() string

Error implements the builtin error interface and returns the RFC 6749 error code (e.g. 'invalid_request').

func (*RFC6749Error) GetDescription 

func (e *RFC6749Error) GetDescription() string

GetDescription returns a more descriptive description, combined with hint and debug (when available).

func (RFC6749Error) Is 

func (e RFC6749Error) Is(err error) bool

Is reports whether err is equivalent to the receiver. Two RFC6749Errors are considered equal when their ErrorField and CodeField match, supporting use with errors.Is.

func (RFC6749Error) IsEmpty 

func (e RFC6749Error) IsEmpty() bool

IsEmpty returns true if the error is an empty error.

func (RFC6749Error) MarshalJSON 

func (e RFC6749Error) MarshalJSON() ([]byte, error)

MarshalJSON encodes the error using either the RFC 6749 short form ('error' and 'error_description') or the legacy long form depending on the receiver's configured format. Debug information is only included when WithExposeDebug has been set.

func (*RFC6749Error) Reason 

func (e *RFC6749Error) Reason() string

Reason satisfies the errorsx.ReasonCarrier interface and returns the hint field as the human readable reason.

func (*RFC6749Error) RequestID 

func (e *RFC6749Error) RequestID() string

RequestID satisfies the errorsx.RequestIDCarrier interface and always returns the empty string for RFC6749Errors.

func (*RFC6749Error) Sanitize deprecated 

func (e *RFC6749Error) Sanitize() *RFC6749Error

Sanitize strips the debug field

Deprecated: Use WithExposeDebug instead.

func (*RFC6749Error) StackTrace 

func (e *RFC6749Error) StackTrace() (trace errors.StackTrace)

StackTrace returns the error's stack trace.

func (*RFC6749Error) Status 

func (e *RFC6749Error) Status() string

Status returns the HTTP status text corresponding to CodeField.

func (*RFC6749Error) StatusCode 

func (e *RFC6749Error) StatusCode() int

StatusCode returns the HTTP status code associated with the error.

func (*RFC6749Error) ToValues 

func (e *RFC6749Error) ToValues() url.Values

ToValues serializes the error into url.Values suitable for use as an authorize endpoint error response in either the 'query' or 'fragment' response mode. Legacy-format errors produce additional 'error_hint' and 'error_debug' fields.

func (*RFC6749Error) UnmarshalJSON 

func (e *RFC6749Error) UnmarshalJSON(b []byte) error

UnmarshalJSON decodes a JSON-encoded error response into the receiver, automatically enabling legacy formatting when the payload contains the legacy 'error_hint' or 'error_debug' fields.

func (RFC6749Error) Unwrap 

func (e RFC6749Error) Unwrap() error

Unwrap returns the underlying cause of the error to support errors.Is and errors.As traversal.

func (*RFC6749Error) WithCode added in v0.3.0 

func (e *RFC6749Error) WithCode(code int) *RFC6749Error

WithCode returns a copy of the receiver with the HTTP status code replaced.

It exists because the same error code carries a different status depending on where it is reported. RFC 9449 uses 'invalid_dpop_proof' and 'use_dpop_nonce' with HTTP 400 at the token endpoint (Section 5) but HTTP 401 at a protected resource (Section 7.1 Figure 16, Section 9 Figure 24). Returning a copy matters: ErrorToRFC6749Error hands back the very pointer the error chain carries, which for a bare errorsx.WithStack(ErrX) is the package-level variable itself, so assigning CodeField on it would corrupt that variable for the whole process.

func (*RFC6749Error) WithDebug 

func (e *RFC6749Error) WithDebug(debug string) *RFC6749Error

WithDebug returns a copy of the receiver with the debug message set. Debug information is only ever sent to clients when WithExposeDebug(true) is configured.

func (*RFC6749Error) WithDebugError 

func (e *RFC6749Error) WithDebugError(debug error) *RFC6749Error

WithDebugError returns a copy of the receiver whose debug message is derived from the given error's debug-rendered description. The receiver is returned unchanged when debug is nil.

func (*RFC6749Error) WithDebugf 

func (e *RFC6749Error) WithDebugf(debug string, args ...any) *RFC6749Error

WithDebugf returns a copy of the receiver with the debug message set to the formatted string.

func (*RFC6749Error) WithDescription 

func (e *RFC6749Error) WithDescription(description string) *RFC6749Error

WithDescription returns a copy of the receiver with its top-level description overwritten. The description is the human-readable text returned in the 'error_description' field of the response payload.

func (*RFC6749Error) WithExposeDebug 

func (e *RFC6749Error) WithExposeDebug(exposeDebug bool) *RFC6749Error

WithExposeDebug if set to true exposes debug messages.

func (*RFC6749Error) WithHint 

func (e *RFC6749Error) WithHint(hint string) *RFC6749Error

WithHint returns a copy of the receiver with the hint set to the supplied static string. The first call also records the hint as the translation ID so future calls to WithLocalizer can localize the message.

func (*RFC6749Error) WithHintIDOrDefaultf 

func (e *RFC6749Error) WithHintIDOrDefaultf(id string, def string, args ...any) *RFC6749Error

WithHintIDOrDefaultf accepts the ID of the hint message

func (*RFC6749Error) WithHintTranslationID 

func (e *RFC6749Error) WithHintTranslationID(id string) *RFC6749Error

WithHintTranslationID accepts the ID of the hint message and should be paired with WithHint and WithHintf to add a default message and vaargs.

func (*RFC6749Error) WithHintf 

func (e *RFC6749Error) WithHintf(hint string, args ...any) *RFC6749Error

WithHintf returns a copy of the receiver with the hint set to the formatted string. The first call also records the unformatted hint as the translation ID so future calls to WithLocalizer can localize the message.

func (RFC6749Error) WithLegacyFormat 

func (e RFC6749Error) WithLegacyFormat(useLegacyFormat bool) *RFC6749Error

WithLegacyFormat returns a copy of the receiver configured to emit the legacy JSON error format (with separate 'error_hint', 'error_debug' and 'status_code' fields) when set to true.

func (*RFC6749Error) WithLocalizer 

func (e *RFC6749Error) WithLocalizer(catalog i18n.MessageCatalog, lang language.Tag) *RFC6749Error

WithLocalizer returns a copy of the receiver bound to the given message catalog and language tag so descriptions and hints are translated when serialized.

func (*RFC6749Error) WithTrace 

func (e *RFC6749Error) WithTrace(err error) *RFC6749Error

WithTrace attaches a stack trace for err to the error chain. If no stack tracer is present in the existing cause, the error is wrapped with one before being recorded.

func (RFC6749Error) WithWrap 

func (e RFC6749Error) WithWrap(cause error) *RFC6749Error

WithWrap returns a copy of the receiver with cause recorded as the underlying error.

func (*RFC6749Error) Wrap 

func (e *RFC6749Error) Wrap(err error)

Wrap records err as the underlying cause of the receiver in place. Use WithWrap to keep the receiver immutable.

type RFC6749ErrorJSON added in v0.2.37 

type RFC6749ErrorJSON struct {
	Name        string `json:"error"`
	Description string `json:"error_description"`
	Hint        string `json:"error_hint,omitempty"`
	Code        int    `json:"status_code,omitempty"`
	Debug       string `json:"error_debug,omitempty"`
}

RFC6749ErrorJSON is a helper struct for JSON encoding/decoding of RFC6749Error.

type RFC7591ClientRegistrationConfigProvider added in v0.3.0 

type RFC7591ClientRegistrationConfigProvider interface {
	RFC7591ClientRegistrationTokenSecretProvider
	RFC7591ClientRegistrationGrantTypesProvider

	// GetRFC7591ClientRegistrationEndpointURL returns the absolute URL of the client registration endpoint. It is
	// used to build 'registration_client_uri' values and to audience initial access tokens.
	GetRFC7591ClientRegistrationEndpointURL(ctx context.Context) (endpoint string)

	// GetRFC7591ClientSecretLifespan returns the lifespan used to derive 'client_secret_expires_at'. A zero
	// duration indicates the secret does not expire.
	GetRFC7591ClientSecretLifespan(ctx context.Context) (lifespan time.Duration)

	// GetRFC7591ClientRegistrationStrategy returns the strategy used to construct and patch clients.
	GetRFC7591ClientRegistrationStrategy(ctx context.Context) (strategy ClientRegistrationStrategy)

	// GetRFC7591ClientRegistrationMetadataStrategy returns the strategy used to filter client metadata before it
	// reaches the client registration strategy and before it is returned to the client. A nil strategy leaves the
	// handlers to apply their default.
	GetRFC7591ClientRegistrationMetadataStrategy(ctx context.Context) (strategy ClientRegistrationMetadataStrategy)

	// GetRFC7591ClientRegistrationEndpointAuthStrategy returns the strategy used to authenticate requests at the
	// client registration and client configuration endpoints.
	GetRFC7591ClientRegistrationEndpointAuthStrategy(ctx context.Context) (strategy ClientRegistrationEndpointAuthStrategy)

	// GetRFC7591ClientRegistrationValidators returns the validators run in order against submitted metadata.
	GetRFC7591ClientRegistrationValidators(ctx context.Context) (validators []ClientRegistrationValidator)

	// GetRFC7591ClientRegistrationEndpointAudiences returns the audiences a client creation token may carry to be
	// accepted at the client registration endpoint. The token must carry at least one of them. An empty value means
	// the configured registration endpoint URL is expected, falling back to the URL the request was made to. A
	// deployment authorises a client to obtain such a token by adding one of these values to that client's
	// registered audience.
	GetRFC7591ClientRegistrationEndpointAudiences(ctx context.Context) (audiences []string)

	// GetRFC7591ClientRegistrationScopes returns the scopes a client creation token may carry to be accepted at the
	// client registration endpoint, defaulting to consts.ScopeClientRegistration. The token must carry at least one
	// of them. They are a second authorization dimension alongside the audience: the audience says a token is for
	// this endpoint, the scope says its holder may register clients. None of these scopes is ever grantable to a
	// registered client - see CheckGrantableScopes.
	GetRFC7591ClientRegistrationScopes(ctx context.Context) (scopes []string)
}

type RFC7591ClientRegistrationEndpointHandler added in v0.3.0 

type RFC7591ClientRegistrationEndpointHandler interface {
	// HandleRFC7591ClientRegistrationEndpointRequest handles a client registration endpoint request. If the handler
	// is not responsible for the request it must return nil and modify neither the requester nor the responder.
	HandleRFC7591ClientRegistrationEndpointRequest(ctx context.Context, requester ClientRegistrationRequester, responder ClientRegistrationResponder) (err error)
}

RFC7591ClientRegistrationEndpointHandler is the interface that handles the client registration endpoint.

See: https://datatracker.ietf.org/doc/html/rfc7591#section-3 and https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration.

type RFC7591ClientRegistrationEndpointHandlers added in v0.3.0 

type RFC7591ClientRegistrationEndpointHandlers []RFC7591ClientRegistrationEndpointHandler

RFC7591ClientRegistrationEndpointHandlers is a list of RFC7591ClientRegistrationEndpointHandler

func (*RFC7591ClientRegistrationEndpointHandlers) Append added in v0.3.0 

func (a *RFC7591ClientRegistrationEndpointHandlers) Append(h RFC7591ClientRegistrationEndpointHandler)

Append adds an RFC7591ClientRegistrationEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RFC7591ClientRegistrationEndpointHandlersProvider added in v0.3.0 

type RFC7591ClientRegistrationEndpointHandlersProvider interface {
	// GetRFC7591ClientRegistrationEndpointHandlers returns the handlers.
	GetRFC7591ClientRegistrationEndpointHandlers(ctx context.Context) (handlers RFC7591ClientRegistrationEndpointHandlers)
}

RFC7591ClientRegistrationEndpointHandlersProvider returns the provider for configuring the client registration endpoint handlers.

type RFC7591ClientRegistrationGrantTypesProvider added in v0.3.0 

type RFC7591ClientRegistrationGrantTypesProvider interface {
	// GetRFC7591ClientRegistrationGrantTypes returns the grant types a client may register for. A registered grant
	// type outside this set is rejected with 'invalid_client_metadata'.
	GetRFC7591ClientRegistrationGrantTypes(ctx context.Context) (grantTypes []string)
}

RFC7591ClientRegistrationConfigProvider is the configuration provider for RFC 7591, RFC 7592, and OpenID Connect Dynamic Client Registration 1.0. RFC7591ClientRegistrationGrantTypesProvider returns the provider for the grant types a client may register for.

type RFC7591ClientRegistrationTokenSecretProvider added in v0.3.0 

type RFC7591ClientRegistrationTokenSecretProvider interface {
	// GetRFC7591ClientRegistrationGlobalSecret returns the secret used to sign client registration tokens. It is
	// deliberately separate from the global secret: a client management token never expires and RFC 7592 provides no
	// way to re-issue one, so signing it with the global secret would mean routine rotation of that secret
	// permanently locked every registered client out of its own registration.
	GetRFC7591ClientRegistrationGlobalSecret(ctx context.Context) (secret []byte, err error)

	// GetRFC7591ClientRegistrationRotatedGlobalSecrets returns the rotated client registration token secrets, which
	// remain valid for verification but are not used for signing.
	GetRFC7591ClientRegistrationRotatedGlobalSecrets(ctx context.Context) (secrets [][]byte, err error)
}

RFC7591ClientRegistrationTokenSecretProvider returns the provider for configuring the secret client registration tokens are signed and verified with. It is declared once here, rather than inline wherever a configurator needs it, because it is embedded by more than one interface across packages (RFC7591ClientRegistrationConfigProvider here; HMACCoreStrategyConfigurator in handler/oauth2 and HMACSHAStrategyConfigurator in compose both need it to build a hmac.HMACStrategy for client registration tokens) and three independently-maintained copies of the same two methods and doc comments would drift.

type RFC7592ClientConfigurationEndpointHandler added in v0.3.0 

type RFC7592ClientConfigurationEndpointHandler interface {
	// HandleRFC7592ClientConfigurationEndpointRequest handles a read, update, or delete request at the client
	// configuration endpoint, dispatching on the requester's method.
	HandleRFC7592ClientConfigurationEndpointRequest(ctx context.Context, requester ClientConfigurationRequester, responder ClientConfigurationResponder) (err error)
}

RFC7592ClientConfigurationEndpointHandler is the interface that handles the client configuration endpoint.

See: https://datatracker.ietf.org/doc/html/rfc7592#section-2.

type RFC7592ClientConfigurationEndpointHandlers added in v0.3.0 

type RFC7592ClientConfigurationEndpointHandlers []RFC7592ClientConfigurationEndpointHandler

RFC7592ClientConfigurationEndpointHandlers is a list of RFC7592ClientConfigurationEndpointHandler

func (*RFC7592ClientConfigurationEndpointHandlers) Append added in v0.3.0 

func (a *RFC7592ClientConfigurationEndpointHandlers) Append(h RFC7592ClientConfigurationEndpointHandler)

Append adds an RFC7592ClientConfigurationEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RFC7592ClientConfigurationEndpointHandlersProvider added in v0.3.0 

type RFC7592ClientConfigurationEndpointHandlersProvider interface {
	// GetRFC7592ClientConfigurationEndpointHandlers returns the handlers.
	GetRFC7592ClientConfigurationEndpointHandlers(ctx context.Context) (handlers RFC7592ClientConfigurationEndpointHandlers)
}

RFC7592ClientConfigurationEndpointHandlersProvider returns the provider for configuring the client configuration endpoint handlers.

type RFC8628DeviceAuthorizeConfigProvider added in v0.3.0 

type RFC8628DeviceAuthorizeConfigProvider interface {
	// GetRFC8628CodeLifespan returns the device and user code lifespan.
	GetRFC8628CodeLifespan(ctx context.Context) (lifespan time.Duration)

	// GetRFC8628UserVerificationURL returns the end-user verification URL returned to the device as the
	// 'verification_uri' where the user enters their user code to authorize the device.
	GetRFC8628UserVerificationURL(ctx context.Context) (url string)

	// GetRFC8628TokenPollingInterval returns the minimum interval the device should wait between polling the token
	// endpoint, returned to the device as the 'interval' value.
	GetRFC8628TokenPollingInterval(ctx context.Context) (interval time.Duration)
}

RFC8628DeviceAuthorizeConfigProvider returns the provider for configuring the device authorization response.

See: https://www.rfc-editor.org/rfc/rfc8628#section-3.2

type RFC8628DeviceAuthorizeEndpointBindingHandler added in v0.3.1 

type RFC8628DeviceAuthorizeEndpointBindingHandler interface {
	// BindRFC8628DeviceAuthorizeRequest records any binding the request asserts. It returns nil both when it
	// records one and when there is nothing to record; any error rejects the request.
	BindRFC8628DeviceAuthorizeRequest(ctx context.Context, request DeviceAuthorizeRequester) (err error)
}

RFC8628DeviceAuthorizeEndpointBindingHandler records a proof-of-possession binding onto the session of a device authorization request before any handler persists that session.

It is a distinct interface from AuthorizeEndpointBindingHandler because DeviceAuthorizeRequester embeds Requester rather than AuthorizeRequester. Handlers in a binding list write disjoint session fields, so their order within the list is not significant.

type RFC8628DeviceAuthorizeEndpointBindingHandlers added in v0.3.1 

type RFC8628DeviceAuthorizeEndpointBindingHandlers []RFC8628DeviceAuthorizeEndpointBindingHandler

RFC8628DeviceAuthorizeEndpointBindingHandlers is a list of RFC8628DeviceAuthorizeEndpointBindingHandler

func (*RFC8628DeviceAuthorizeEndpointBindingHandlers) Append added in v0.3.1 

func (a *RFC8628DeviceAuthorizeEndpointBindingHandlers) Append(h RFC8628DeviceAuthorizeEndpointBindingHandler)

Append adds an RFC8628DeviceAuthorizeEndpointBindingHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RFC8628DeviceAuthorizeEndpointBindingHandlersProvider added in v0.3.1 

type RFC8628DeviceAuthorizeEndpointBindingHandlersProvider interface {
	// GetRFC8628DeviceAuthorizeEndpointBindingHandlers returns the device authorization endpoint binding handlers.
	GetRFC8628DeviceAuthorizeEndpointBindingHandlers(ctx context.Context) (handlers RFC8628DeviceAuthorizeEndpointBindingHandlers)
}

RFC8628DeviceAuthorizeEndpointBindingHandlersProvider returns the provider for configuring the device authorization endpoint binding handlers.

type RFC8628DeviceAuthorizeEndpointHandler 

type RFC8628DeviceAuthorizeEndpointHandler interface {
	// HandleRFC8628DeviceAuthorizeEndpointRequest handles a device authorize endpoint request. To extend the handler's capabilities, the http request
	// is passed along, if further information retrieval is required. If the handler feels that he is not responsible for
	// the device authorize request, he must return nil and NOT modify session nor responder neither requester.
	//
	// The following spec is a good example of what HandleDeviceAuthorizeRequest should do.
	// * https://tools.ietf.org/html/rfc8628#section-3.2
	HandleRFC8628DeviceAuthorizeEndpointRequest(ctx context.Context, request DeviceAuthorizeRequester, response DeviceAuthorizeResponder) (err error)
}

type RFC8628DeviceAuthorizeEndpointHandlers 

type RFC8628DeviceAuthorizeEndpointHandlers []RFC8628DeviceAuthorizeEndpointHandler

RFC8628DeviceAuthorizeEndpointHandlers is a list of RFC8628DeviceAuthorizeEndpointHandler

func (*RFC8628DeviceAuthorizeEndpointHandlers) Append 

func (a *RFC8628DeviceAuthorizeEndpointHandlers) Append(h RFC8628DeviceAuthorizeEndpointHandler)

Append adds an RFC8628DeviceAuthorizeEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RFC8628DeviceAuthorizeEndpointHandlersProvider 

type RFC8628DeviceAuthorizeEndpointHandlersProvider interface {
	// GetRFC8628DeviceAuthorizeEndpointHandlers returns the handlers.
	GetRFC8628DeviceAuthorizeEndpointHandlers(ctx context.Context) (handlers RFC8628DeviceAuthorizeEndpointHandlers)
}

RFC8628DeviceAuthorizeEndpointHandlersProvider returns the provider for setting up the Device authorization handlers.

type RFC8628UserAuthorizeEndpointHandler 

type RFC8628UserAuthorizeEndpointHandler interface {
	// HandleRFC8628UserAuthorizeEndpointRequest validates the request with the given user code.
	//
	// The following spec is a good example of what PopulateRFC8628UserAuthorizeEndpointResponse should do.
	// * https://www.rfc-editor.org/rfc/rfc8628#section-3.3
	HandleRFC8628UserAuthorizeEndpointRequest(ctx context.Context, request DeviceAuthorizeRequester) (err error)

	// PopulateRFC8628UserAuthorizeEndpointResponse populates the response object as an outcome of user authorization during
	// the device authorization grant flow.
	//
	PopulateRFC8628UserAuthorizeEndpointResponse(ctx context.Context, request DeviceAuthorizeRequester, response DeviceUserAuthorizeResponder) (err error)
}

type RFC8628UserAuthorizeEndpointHandlers 

type RFC8628UserAuthorizeEndpointHandlers []RFC8628UserAuthorizeEndpointHandler

RFC8628UserAuthorizeEndpointHandlers is a list of RFC8628UserAuthorizeEndpointHandler

func (*RFC8628UserAuthorizeEndpointHandlers) Append 

func (a *RFC8628UserAuthorizeEndpointHandlers) Append(h RFC8628UserAuthorizeEndpointHandler)

Append adds an RFC8628UserAuthorizeEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RFC8628UserAuthorizeEndpointHandlersProvider 

type RFC8628UserAuthorizeEndpointHandlersProvider interface {
	// GetRFC8628UserAuthorizeEndpointHandlers returns the handlers.
	GetRFC8628UserAuthorizeEndpointHandlers(ctx context.Context) (handlers RFC8628UserAuthorizeEndpointHandlers)
}

RFC8628UserAuthorizeEndpointHandlersProvider returns the provider for setting up the Device grant user interaction handlers.

type RFC8628UserAuthorizeResponse 

type RFC8628UserAuthorizeResponse struct {
	Header     http.Header    `json:"-"`
	Parameters url.Values     `json:"-"`
	Status     string         `json:"status"`
	Extra      map[string]any `json:"-"`
}

RFC8628UserAuthorizeResponse is an implementation of DeviceUserAuthorizeResponder

func NewRFC8628UserAuthorizeResponse 

func NewRFC8628UserAuthorizeResponse() *RFC8628UserAuthorizeResponse

NewRFC8628UserAuthorizeResponse returns an empty RFC8628UserAuthorizeResponse with its header, parameter and extras maps initialized.

func (*RFC8628UserAuthorizeResponse) AddHeader 

func (d *RFC8628UserAuthorizeResponse) AddHeader(key, value string)

AddHeader appends the value to the named response header.

func (*RFC8628UserAuthorizeResponse) AddParameter 

func (d *RFC8628UserAuthorizeResponse) AddParameter(key, value string)

AddParameter appends the value to the named response parameter.

func (*RFC8628UserAuthorizeResponse) FromJSON added in v0.2.37 

func (d *RFC8628UserAuthorizeResponse) FromJSON(r io.Reader) error

FromJSON decodes a JSON-encoded response from r into the receiver.

func (*RFC8628UserAuthorizeResponse) GetExtra 

func (d *RFC8628UserAuthorizeResponse) GetExtra(key string) any

GetExtra returns the value previously stored under key by SetExtra, or nil if none has been set.

func (*RFC8628UserAuthorizeResponse) GetHeader 

func (d *RFC8628UserAuthorizeResponse) GetHeader() http.Header

GetHeader returns the response HTTP headers that will be written to the user.

func (*RFC8628UserAuthorizeResponse) GetParameters 

func (d *RFC8628UserAuthorizeResponse) GetParameters() url.Values

GetParameters returns the query/body parameters that will be returned in the response.

func (*RFC8628UserAuthorizeResponse) GetStatus 

func (d *RFC8628UserAuthorizeResponse) GetStatus() string

GetStatus returns the user's authorization decision as a string.

func (*RFC8628UserAuthorizeResponse) SetExtra 

func (d *RFC8628UserAuthorizeResponse) SetExtra(key string, value any)

SetExtra sets an extension parameter on the response, allowing handlers to inject additional response fields.

func (*RFC8628UserAuthorizeResponse) SetStatus 

func (d *RFC8628UserAuthorizeResponse) SetStatus(status string)

SetStatus records the user's authorization decision as a string. See DeviceAuthorizeStatusToString for the canonical values.

func (*RFC8628UserAuthorizeResponse) ToJSON added in v0.2.37 

func (d *RFC8628UserAuthorizeResponse) ToJSON(rw io.Writer) error

ToJSON encodes the response as JSON and writes it to rw.

func (*RFC8628UserAuthorizeResponse) ToMap 

func (d *RFC8628UserAuthorizeResponse) ToMap() map[string]any

ToMap converts the response to a map.

type RFC8693ConfigProvider 

type RFC8693ConfigProvider interface {
	// GetRFC8693TokenTypes returns the supported token types for Token Exchange keyed by their token type identifier
	// (i.e. the 'subject_token_type', 'actor_token_type', and 'requested_token_type' URN values).
	GetRFC8693TokenTypes(ctx context.Context) (types map[string]RFC8693TokenType)

	// GetDefaultRFC8693RequestedTokenType returns the token type identifier used as the 'requested_token_type' when the
	// Token Exchange request does not explicitly specify one.
	GetDefaultRFC8693RequestedTokenType(ctx context.Context) (tokenType string)

	// GetScopeStrategy returns the scope strategy used to validate scopes during Token Exchange.
	GetScopeStrategy(ctx context.Context) (strategy ScopeStrategy)

	// GetAudienceStrategy returns the audience strategy used to validate audiences during Token Exchange.
	GetAudienceStrategy(ctx context.Context) (strategy AudienceStrategy)

	// GetResourceStrategy returns the RFC 8707 resource indicator strategy used during Token Exchange.
	GetResourceStrategy(ctx context.Context) (strategy ResourceStrategy)
}

RFC8693ConfigProvider is the configuration provider for RFC8693 Token Exchange.

type RFC8693TokenType 

type RFC8693TokenType interface {
	GetName(ctx context.Context) (name string)

	GetType(ctx context.Context) (tokenType string)
}

type RFC9207ResponseModeParameterHandler added in v0.1.3 

type RFC9207ResponseModeParameterHandler struct {
	Config interface {
		AuthorizationServerIssuerIdentificationProvider
	}
}

RFC9207ResponseModeParameterHandler adds the RFC9207

func (*RFC9207ResponseModeParameterHandler) ResponseModes added in v0.1.3 

func (h *RFC9207ResponseModeParameterHandler) ResponseModes() ResponseModeTypes

ResponseModes returns the set of response modes the RFC 9207 issuer identification parameter handler applies to: query, fragment, form_post, and the implicit default mode.

func (*RFC9207ResponseModeParameterHandler) WriteParameters added in v0.1.3 

func (h *RFC9207ResponseModeParameterHandler) WriteParameters(ctx context.Context, request AuthorizeRequester, parameters url.Values)

WriteParameters injects the RFC 9207 'iss' parameter into the authorization response when an authorization server identification issuer is configured.

type RPInitiatedLogoutClient added in v0.3.0 

type RPInitiatedLogoutClient interface {
	Client

	// GetPostLogoutRedirectURIs returns the client's registered post logout redirect URIs. A client with none
	// registered cannot use the 'post_logout_redirect_uri' parameter.
	GetPostLogoutRedirectURIs() (uris []string)
}

RPInitiatedLogoutClient is a Client which has registered post logout redirect URIs for OpenID Connect RP-Initiated Logout.

See: https://openid.net/specs/openid-connect-rpinitiated-1_0.html

type RPInitiatedLogoutRequest added in v0.3.0 

type RPInitiatedLogoutRequest struct {
	IDTokenHint           string
	IDTokenHintClaims     jwt.MapClaims
	LogoutHint            string
	Client                Client
	PostLogoutRedirectURI *url.URL
	State                 string
	UILocales             Arguments
	Form                  url.Values
}

RPInitiatedLogoutRequest is an implementation of RPInitiatedLogoutRequester.

func NewRPInitiatedLogoutRequest added in v0.3.0 

func NewRPInitiatedLogoutRequest() (request *RPInitiatedLogoutRequest)

NewRPInitiatedLogoutRequest returns an RPInitiatedLogoutRequest with its map fields initialized.

func (*RPInitiatedLogoutRequest) GetClient added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetClient() (client Client)

func (*RPInitiatedLogoutRequest) GetIDTokenHint added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetIDTokenHint() (hint string)

func (*RPInitiatedLogoutRequest) GetIDTokenHintClaims added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetIDTokenHintClaims() (claims jwt.MapClaims)

func (*RPInitiatedLogoutRequest) GetLogoutHint added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetLogoutHint() (hint string)

func (*RPInitiatedLogoutRequest) GetPostLogoutRedirectURI added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetPostLogoutRedirectURI() (uri *url.URL)

func (*RPInitiatedLogoutRequest) GetRequestForm added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetRequestForm() (form url.Values)

func (*RPInitiatedLogoutRequest) GetSessionID added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetSessionID() (sid string)

func (*RPInitiatedLogoutRequest) GetState added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetState() (state string)

func (*RPInitiatedLogoutRequest) GetSubject added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetSubject() (subject string)

func (*RPInitiatedLogoutRequest) GetUILocales added in v0.3.0 

func (r *RPInitiatedLogoutRequest) GetUILocales() (locales Arguments)

type RPInitiatedLogoutRequester added in v0.3.0 

type RPInitiatedLogoutRequester interface {
	// GetIDTokenHint returns the raw 'id_token_hint' parameter, empty if absent.
	GetIDTokenHint() (hint string)

	// GetIDTokenHintClaims returns the validated claims from the 'id_token_hint', nil if no hint was supplied.
	GetIDTokenHintClaims() (claims jwt.MapClaims)

	// GetSubject returns the 'sub' claim of the 'id_token_hint', empty if absent.
	GetSubject() (subject string)

	// GetSessionID returns the 'sid' claim of the 'id_token_hint', empty if absent.
	GetSessionID() (sid string)

	// GetLogoutHint returns the raw 'logout_hint' parameter, empty if absent. It is not interpreted.
	GetLogoutHint() (hint string)

	// GetClient returns the resolved client, nil when neither 'client_id' nor 'id_token_hint' was supplied.
	GetClient() (client Client)

	// GetPostLogoutRedirectURI returns the validated, registered redirect URI. It is nil when the parameter was
	// absent and nil on every error path, so an error can never be redirected to an unvalidated URI.
	GetPostLogoutRedirectURI() (uri *url.URL)

	// GetState returns the raw 'state' parameter, to be echoed back on the redirect.
	GetState() (state string)

	// GetUILocales returns the space-delimited 'ui_locales' parameter.
	GetUILocales() (locales Arguments)

	// GetRequestForm returns the raw request parameters.
	GetRequestForm() (form url.Values)
}

RPInitiatedLogoutRequester is a request to the OpenID Connect end session endpoint.

See: https://openid.net/specs/openid-connect-rpinitiated-1_0.html

type RedirectSecureCheckerProvider 

type RedirectSecureCheckerProvider interface {
	// GetRedirectSecureChecker returns the redirect URL security validator.
	GetRedirectSecureChecker(ctx context.Context) func(context.Context, *url.URL) bool
}

RedirectSecureCheckerProvider returns the provider for configuring the redirect URL security validator.

type RedirectURICustomComparisonClient added in v0.2.18 

type RedirectURICustomComparisonClient interface {
	GetRedirectURIComparisonStrategy() URIComparisonStrategy
}

type RefreshFlowScopeClient 

type RefreshFlowScopeClient interface {
	GetRefreshFlowIgnoreOriginalGrantedScopes(ctx context.Context) (ignoreOriginalGrantedScopes bool)

	Client
}

RefreshFlowScopeClient is a client which can be customized to ignore scopes that were not originally granted.

type RefreshTokenAccessRequester 

type RefreshTokenAccessRequester interface {
	// SanitizeRestoreRefreshTokenOriginalRequester returns a sanitized copy of this Requester and mutates the relevant
	// values from the provided Requester which is the original refresh token session Requester.
	SanitizeRestoreRefreshTokenOriginalRequester(requester Requester) (sanitized Requester)

	AccessRequester
}

RefreshTokenAccessRequester is an extended AccessRequester implementation that allows preserving the original Requester.

type RefreshTokenLifespanProvider 

type RefreshTokenLifespanProvider interface {
	// GetRefreshTokenLifespan returns the refresh token lifespan.
	GetRefreshTokenLifespan(ctx context.Context) (lifespan time.Duration)
}

RefreshTokenLifespanProvider returns the provider for configuring the refresh token lifespan.

type RefreshTokenRotationClient added in v0.3.3 

type RefreshTokenRotationClient interface {
	// GetDisableRefreshTokenRotation should return true if the refresh token grant should keep this client's refresh
	// token rather than issue a new one.
	GetDisableRefreshTokenRotation() (disable bool)

	Client
}

RefreshTokenRotationClient is a client which keeps its refresh token during its own refresh token grants. Rotation is disabled when either this or the provider-wide option is set.

See: https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1

type RefreshTokenScopesProvider 

type RefreshTokenScopesProvider interface {
	// GetRefreshTokenScopes returns the refresh token scopes.
	GetRefreshTokenScopes(ctx context.Context) []string
}

RefreshTokenScopesProvider returns the provider for configuring the refresh token scopes.

type Request 

type Request struct {
	ID                string       `json:"id" gorethink:"id"`
	RequestedAt       time.Time    `json:"requestedAt" gorethink:"requestedAt"`
	Client            Client       `json:"-" gorethink:"client"`
	RequestedScope    Arguments    `json:"scopes" gorethink:"scopes"`
	GrantedScope      Arguments    `json:"grantedScopes" gorethink:"grantedScopes"`
	Form              url.Values   `json:"form" gorethink:"form"`
	Session           Session      `json:"session" gorethink:"session"`
	RequestedAudience Arguments    `json:"requestedAudience"`
	GrantedAudience   Arguments    `json:"grantedAudience"`
	RequestedResource Arguments    `json:"requestedResource"`
	GrantedResource   Arguments    `json:"grantedResource"`
	Lang              language.Tag `json:"-"`
}

Request is an implementation of Requester

func NewRequest 

func NewRequest() *Request

NewRequest returns a Request with its slice and map fields initialized, a default empty client, and RequestedAt set to the current time in UTC.

func (*Request) AppendRequestedAudience 

func (a *Request) AppendRequestedAudience(audience string)

AppendRequestedAudience adds the given audience value to the requested audiences if it is not already present.

func (*Request) AppendRequestedResource added in v0.2.32 

func (a *Request) AppendRequestedResource(resource string)

AppendRequestedResource adds the given resource indicator if it is not already present.

func (*Request) AppendRequestedScope 

func (a *Request) AppendRequestedScope(scope string)

AppendRequestedScope adds the given scope to the requested scopes if it is not already present.

func (*Request) GetClient 

func (a *Request) GetClient() Client

GetClient returns the OAuth 2.0 client associated with the request.

func (*Request) GetGrantedAudience 

func (a *Request) GetGrantedAudience() Arguments

GetGrantedAudience returns the audience values that have been granted to the client.

func (*Request) GetGrantedResource added in v0.2.32 

func (a *Request) GetGrantedResource() Arguments

GetGrantedResource returns the RFC 8707 resource indicators that have been granted to the client.

func (*Request) GetGrantedScopes 

func (a *Request) GetGrantedScopes() Arguments

GetGrantedScopes returns the scopes that have been granted to the client.

func (*Request) GetID 

func (a *Request) GetID() string

GetID returns the request identifier, generating a new UUID on first access if one has not been assigned.

func (*Request) GetLang 

func (a *Request) GetLang() language.Tag

GetLang returns the language tag negotiated for the request, used to localize error descriptions.

func (*Request) GetRequestForm 

func (a *Request) GetRequestForm() url.Values

GetRequestForm returns the original HTTP form values associated with the request.

func (*Request) GetRequestedAt 

func (a *Request) GetRequestedAt() time.Time

GetRequestedAt returns the time at which the request was received.

func (*Request) GetRequestedAudience 

func (a *Request) GetRequestedAudience() (audience Arguments)

GetRequestedAudience returns the audience values asked for by the client.

func (*Request) GetRequestedResource added in v0.2.32 

func (a *Request) GetRequestedResource() Arguments

GetRequestedResource returns the RFC 8707 resource indicators asked for by the client.

func (*Request) GetRequestedScopes 

func (a *Request) GetRequestedScopes() Arguments

GetRequestedScopes returns the scopes asked for by the client.

func (*Request) GetSession 

func (a *Request) GetSession() Session

GetSession returns the session associated with the request, or nil if none has been set.

func (*Request) GrantAudience 

func (a *Request) GrantAudience(audience string)

GrantAudience marks the given audience as granted to the client if it is not already present.

func (*Request) GrantResource added in v0.2.32 

func (a *Request) GrantResource(resource string)

GrantResource marks the given RFC 8707 resource indicator as granted if it is not already present.

func (*Request) GrantScope 

func (a *Request) GrantScope(scope string)

GrantScope marks the given scope as granted to the client if it is not already present.

func (*Request) Merge 

func (a *Request) Merge(request Requester)

Merge copies the requested and granted scopes, audiences and resource indicators from the given Requester into this request alongside its ID, RequestedAt timestamp, client, session, and form values.

func (*Request) Sanitize 

func (a *Request) Sanitize(allowedParameters []string) Requester

Sanitize returns a shallow copy of the request with its form values restricted to allowedParameters and a small set of always-allowed parameters (grant_type, response_type, scope, client_id). It is used by handlers to scrub credentials and other sensitive form fields before persisting the request to storage.

func (*Request) SetID 

func (a *Request) SetID(id string)

SetID assigns the request identifier. Callers should ensure the value is unique across requests for storage lookups.

func (*Request) SetRequestedAt added in v0.2.3 

func (a *Request) SetRequestedAt(rat time.Time)

SetRequestedAt overrides the time at which the request was received, typically used when restoring requests from persistent storage.

func (*Request) SetRequestedAudience 

func (a *Request) SetRequestedAudience(s Arguments)

SetRequestedAudience replaces the requested audience, de-duplicating entries.

func (*Request) SetRequestedResource added in v0.2.32 

func (a *Request) SetRequestedResource(s Arguments)

SetRequestedResource replaces the requested RFC 8707 resource indicators, de-duplicating entries.

func (*Request) SetRequestedScopes 

func (a *Request) SetRequestedScopes(s Arguments)

SetRequestedScopes replaces the requested scopes, de-duplicating entries.

func (*Request) SetSession 

func (a *Request) SetSession(session Session)

SetSession sets the session associated with the request.

type RequestObjectLifetimeClient added in v0.3.3 

type RequestObjectLifetimeClient interface {
	// GetRequireRequestObjectAudienceAndLifetime should return true if this client's Request Objects MUST contain the
	// 'aud', 'nbf' and 'exp' claims.
	GetRequireRequestObjectAudienceAndLifetime() (require bool)

	// GetRequestObjectMaximumLifetime should return a custom bound for this client's Request Object 'nbf' and 'exp'
	// claims, or a duration of 0 seconds to utilize the global lifetime.
	GetRequestObjectMaximumLifetime() (lifetime time.Duration)

	JARClient
}

RequestObjectLifetimeClient is a JARClient which requires the 'aud', 'nbf' and 'exp' claims in its own Request Objects. The requirement applies when either this or the provider-wide option is set.

See: https://openid.net/specs/fapi-message-signing-2_0-final.html#section-5.3.1

type RequestedAudienceImplicitClient 

type RequestedAudienceImplicitClient interface {
	// GetRequestedAudienceImplicit is indicative of if a client will implicitly request all audiences it is allowed to
	// request in the absence of requested audience during an Authorization Endpoint Flow or Client Credentials Flow.
	GetRequestedAudienceImplicit() (implicit bool)

	Client
}

RequestedAudienceImplicitClient is a client which can potentially implicitly grant permitted audiences given the absence of a request parameter.

type Requester 

type Requester interface {
	// SetID sets the unique identifier.
	SetID(id string)

	// GetID returns a unique identifier.
	GetID() (id string)

	// GetRequestedAt returns the time the request was created.
	GetRequestedAt() (requestedAt time.Time)

	// SetRequestedAt sets the time the request was created.
	SetRequestedAt(rat time.Time)

	// GetClient returns the request's client.
	GetClient() (client Client)

	// GetRequestedScopes returns the request's scopes.
	GetRequestedScopes() (scopes Arguments)

	// GetRequestedAudience returns the requested audiences for this request.
	GetRequestedAudience() (audience Arguments)

	// SetRequestedScopes sets the request's scopes.
	SetRequestedScopes(scopes Arguments)

	// SetRequestedAudience sets the requested audience.
	SetRequestedAudience(audience Arguments)

	// AppendRequestedScope appends a scope to the request.
	AppendRequestedScope(scope string)

	// GetGrantedScopes returns all granted scopes.
	GetGrantedScopes() (grantedScopes Arguments)

	// GetGrantedAudience returns all granted audiences.
	GetGrantedAudience() (grantedAudience Arguments)

	// GrantScope marks a request's scope as granted.
	GrantScope(scope string)

	// GrantAudience marks a request's audience as granted.
	GrantAudience(audience string)

	// GetRequestedResource returns the requested resource indicators (RFC 8707) for this request.
	GetRequestedResource() (resource Arguments)

	// SetRequestedResource sets the requested resource indicators.
	SetRequestedResource(resource Arguments)

	// GetGrantedResource returns all granted resource indicators.
	GetGrantedResource() (grantedResource Arguments)

	// GrantResource marks a request's resource indicator as granted.
	GrantResource(resource string)

	// GetSession returns a pointer to the request's session or nil if none is set.
	GetSession() (session Session)

	// SetSession sets the request's session pointer.
	SetSession(session Session)

	// GetRequestForm returns the request's form input.
	GetRequestForm() (form url.Values)

	// Merge merges the argument into the method receiver.
	Merge(requester Requester)

	// Sanitize returns a sanitized clone of the request which can be used for storage.
	Sanitize(allowedParameters []string) (sanitized Requester)
}

Requester is an abstract interface for handling requests in Fosite.

type ResourceStrategy added in v0.2.34 

type ResourceStrategy func(haystack, needle []string) (err error)

ResourceStrategy matches requested RFC 8707 resource indicators against the client's allowed audience list. Defaults to DefaultAudienceStrategy (URL-based matching).

func GetResourceStrategy added in v0.2.34 

func GetResourceStrategy(ctx context.Context, config ResourceStrategyProvider, client Client) (strategy ResourceStrategy)

GetResourceStrategy resolves the ResourceStrategy to use for a request. If the client implements ResourceStrategyProvider and returns a non-nil strategy, the client's strategy is preferred over the global configuration. Otherwise the strategy from the provided config is used, falling back to DefaultResourceStrategy when neither source supplies one.

type ResourceStrategyProvider added in v0.2.32 

type ResourceStrategyProvider interface {
	// GetResourceStrategy returns the resource indicator matching strategy.
	GetResourceStrategy(ctx context.Context) (strategy ResourceStrategy)
}

ResourceStrategyProvider returns the provider for configuring the RFC 8707 resource indicator strategy.

type ResponseModeClient 

type ResponseModeClient interface {
	// GetResponseModes returns the response modes that client is allowed to send
	GetResponseModes() (modes []ResponseModeType)

	Client
}

ResponseModeClient represents a client capable of handling response_mode

type ResponseModeHandler 

type ResponseModeHandler interface {
	// ResponseModes returns a set of supported response modes handled
	// by the interface implementation.
	//
	// In an authorize request with any of the provide response modes
	// methods `WriteAuthorizeResponse` and `WriteAuthorizeError` will be
	// invoked to write the successful or error authorization responses respectively.
	ResponseModes() ResponseModeTypes

	// WriteAuthorizeResponse writes successful responses
	//
	// The following headers are expected to be set by implementations of this interface:
	// header.Set(consts.HeaderCacheControl, consts.CacheControlNoStore)
	// header.Set(consts.HeaderPragma, consts.PragmaNoCache)
	WriteAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, response AuthorizeResponder)

	// WriteAuthorizeError writes error responses
	//
	// The following headers are expected to be set by implementations of this interface:
	// header.Set(consts.HeaderCacheControl, consts.CacheControlNoStore)
	// header.Set(consts.HeaderPragma, consts.PragmaNoCache)
	WriteAuthorizeError(ctx context.Context, rw http.ResponseWriter, request AuthorizeRequester, err error)
}

ResponseModeHandler provides a contract for handling response modes.

type ResponseModeHandlerConfigurator 

type ResponseModeHandlerConfigurator interface {
	ResponseModeParameterHandlerProvider
	FormPostHTMLTemplateProvider
	FormPostResponseProvider
	JWTSecuredAuthorizeResponseModeIssuerProvider
	JWTSecuredAuthorizeResponseModeStrategyProvider
	JWTSecuredAuthorizeResponseModeLifespanProvider
	MessageCatalogProvider
	SendDebugMessagesToClientsProvider
	AuthorizeErrorFieldResponseStrategyProvider
	UseLegacyErrorFormatProvider
}

type ResponseModeHandlerProvider 

type ResponseModeHandlerProvider interface {
	// GetResponseModeHandlers returns the response mode handlers in order of execution.
	GetResponseModeHandlers(ctx context.Context) (handlers ResponseModeHandlers)
}

ResponseModeHandlerProvider returns the provider for configuring the response mode handlers.

type ResponseModeHandlers added in v0.1.3 

type ResponseModeHandlers []ResponseModeHandler

ResponseModeHandlers is a list of ResponseModeHandler.

func (*ResponseModeHandlers) Append added in v0.1.3 

func (a *ResponseModeHandlers) Append(h ResponseModeHandler)

Append adds an ResponseModeHandler to this list. Ignores duplicates based on reflect.TypeOf.

type ResponseModeParameterHandler added in v0.1.3 

type ResponseModeParameterHandler interface {
	// ResponseModes returns a set of supported response modes handled
	// by the interface implementation.
	//
	// In an authorize request with any of the provide response modes
	// methods `WriteAuthorizeResponse` and `WriteAuthorizeError` will be
	// invoked to write the successful or error authorization responses respectively.
	ResponseModes() ResponseModeTypes

	// WriteParameters is handed the parameters just before handing of to the response writer.
	WriteParameters(ctx context.Context, request AuthorizeRequester, parameters url.Values)
}

type ResponseModeParameterHandlerProvider added in v0.1.3 

type ResponseModeParameterHandlerProvider interface {
	// GetResponseModeParameterHandlers returns the ResponseModeParameterHandler's to process.
	GetResponseModeParameterHandlers(ctx context.Context) (handlers ResponseModeParameterHandlers)
}

ResponseModeParameterHandlerProvider returns the providers for configuring additional parameters in the response mode phase of an Authorization Request which may not be possible to determine until the final response mode is known.

type ResponseModeParameterHandlers added in v0.1.3 

type ResponseModeParameterHandlers []ResponseModeParameterHandler

ResponseModeParameterHandlers is a list of ResponseModeParameterHandler.

func (*ResponseModeParameterHandlers) Append added in v0.1.3 

func (a *ResponseModeParameterHandlers) Append(h ResponseModeParameterHandler)

Append adds an ResponseModeParameterHandler to this list. Ignores duplicates based on reflect.TypeOf.

type ResponseModeType 

type ResponseModeType string

type ResponseModeTypes 

type ResponseModeTypes []ResponseModeType

func (ResponseModeTypes) Has 

func (rs ResponseModeTypes) Has(item ResponseModeType) bool

Has reports whether the slice contains the given response mode.

type RevocationEndpointClientAuthStrategy added in v0.2.37 

type RevocationEndpointClientAuthStrategy struct{}

RevocationEndpointClientAuthStrategy is the EndpointClientAuthStrategy for the revocation endpoint. It resolves client authentication configuration from the client's 'revocation_endpoint_auth_method' metadata and permits public clients to authenticate using the 'none' method.

func (*RevocationEndpointClientAuthStrategy) AllowAuthMethodAny added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) AllowAuthMethodAny() bool

AllowAuthMethodAny returns true as the revocation endpoint permits any authentication method when the client has not registered a specific 'revocation_endpoint_auth_method'.

func (*RevocationEndpointClientAuthStrategy) AllowMethodNone added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) AllowMethodNone() bool

AllowMethodNone returns true as the revocation endpoint permits public clients to authenticate using the 'none' method.

func (*RevocationEndpointClientAuthStrategy) GetAuthEncryptionAlg added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthEncryptionAlg(client AuthenticationMethodClient) string

GetAuthEncryptionAlg returns the encryption key algorithm used for client assertions at the revocation endpoint.

func (*RevocationEndpointClientAuthStrategy) GetAuthEncryptionEnc added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthEncryptionEnc(client AuthenticationMethodClient) string

GetAuthEncryptionEnc returns the content encryption algorithm used for client assertions at the revocation endpoint.

func (*RevocationEndpointClientAuthStrategy) GetAuthEncryptionKeyID added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthEncryptionKeyID(client AuthenticationMethodClient) string

GetAuthEncryptionKeyID returns the encryption key id used for client assertions at the revocation endpoint.

func (*RevocationEndpointClientAuthStrategy) GetAuthMethod added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthMethod(client AuthenticationMethodClient) string

GetAuthMethod returns the client's registered 'revocation_endpoint_auth_method'.

func (*RevocationEndpointClientAuthStrategy) GetAuthSigningAlg added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthSigningAlg(client AuthenticationMethodClient) string

GetAuthSigningAlg returns the client's registered 'revocation_endpoint_auth_signing_alg'.

func (*RevocationEndpointClientAuthStrategy) GetAuthSigningKeyID added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) GetAuthSigningKeyID(client AuthenticationMethodClient) string

GetAuthSigningKeyID returns the signing key id used to verify client assertions at the revocation endpoint.

func (*RevocationEndpointClientAuthStrategy) Name added in v0.2.37 

func (s *RevocationEndpointClientAuthStrategy) Name() string

Name returns 'revocation', the name of the endpoint this strategy represents.

type RevocationEndpointClientAuthStrategyProvider added in v0.2.37 

type RevocationEndpointClientAuthStrategyProvider interface {
	// GetRevocationEndpointClientAuthStrategy returns the EndpointClientAuthStrategy used to authenticate clients at the
	// revocation endpoint. This endpoint permits public clients to authenticate using the 'none' method.
	GetRevocationEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)
}

RevocationEndpointClientAuthStrategyProvider returns the provider for the client authentication strategy used at the revocation endpoint.

type RevocationHandler 

type RevocationHandler interface {
	// RevokeToken handles access and refresh token revocation.
	RevokeToken(ctx context.Context, token string, tokenType TokenType, client Client) (err error)
}

RevocationHandler is the interface that allows token revocation for an OAuth2.0 provider. https://datatracker.ietf.org/doc/html/rfc7009

RevokeToken is invoked after a new token revocation request is parsed.

https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 If the particular token is a refresh token and the authorization server supports the revocation of access tokens, then the authorization server SHOULD also invalidate all access tokens based on the same authorization grant (see Implementation Note). If the token passed to the request is an access token, the server MAY revoke the respective refresh token as well.

type RevocationHandlers 

type RevocationHandlers []RevocationHandler

RevocationHandlers is a list of RevocationHandler

func (*RevocationHandlers) Append 

func (t *RevocationHandlers) Append(h RevocationHandler)

Append adds an RevocationHandler to this list. Ignores duplicates based on reflect.TypeOf.

type RevocationHandlersProvider 

type RevocationHandlersProvider interface {
	// GetRevocationHandlers returns the revocation handlers.
	GetRevocationHandlers(ctx context.Context) (handlers RevocationHandlers)
}

RevocationHandlersProvider returns the provider for configuring the revocation handlers.

type RevokeFlowRevokeRefreshTokensExplicitClient 

type RevokeFlowRevokeRefreshTokensExplicitClient interface {
	// GetRevokeRefreshTokensExplicit returns true if this client will only revoke refresh tokens explicitly.
	GetRevokeRefreshTokensExplicit(ctx context.Context) (explicit bool)

	Client
}

RevokeFlowRevokeRefreshTokensExplicitClient is a client which can be customized to only revoke Refresh Tokens explicitly.

type RevokeRefreshTokensExplicitlyProvider 

type RevokeRefreshTokensExplicitlyProvider interface {
	// GetRevokeRefreshTokensExplicit returns true if a refresh token should only be revoked explicitly.
	GetRevokeRefreshTokensExplicit(ctx context.Context) (explicit bool)

	// GetEnforceRevokeFlowRevokeRefreshTokensExplicitClient returns true if a
	// RevokeFlowRevokeRefreshTokensExplicitClient returning false should be enforced.
	GetEnforceRevokeFlowRevokeRefreshTokensExplicitClient(ctx context.Context) (explicit bool)
}

RevokeRefreshTokensExplicitlyProvider returns the provider for configuring the Refresh Token Explicit Revocation policy.

type RotatedClientSecretsClient 

type RotatedClientSecretsClient interface {
	GetRotatedClientSecrets() (secrets []ClientSecret)

	Client
}

RotatedClientSecretsClient extends Client interface by a method providing a slice of rotated secrets.

type RotatedGlobalSecretsProvider 

type RotatedGlobalSecretsProvider interface {
	// GetRotatedGlobalSecrets returns the rotated global secrets.
	GetRotatedGlobalSecrets(ctx context.Context) (secrets [][]byte, err error)
}

RotatedGlobalSecretsProvider returns the provider for configuring the rotated global secrets.

type SanitationAllowedProvider 

type SanitationAllowedProvider interface {
	// GetSanitationWhiteList is a whitelist of form values that are required by the token endpoint. These values
	// are safe for storage in a database (cleartext).
	GetSanitationWhiteList(ctx context.Context) (whitelist []string)
}

SanitationAllowedProvider returns the provider for configuring the sanitation white list.

type ScopeStrategy 

type ScopeStrategy func(haystack []string, needle string) bool

ScopeStrategy is a strategy for matching scopes.

func GetScopeStrategy added in v0.2.34 

func GetScopeStrategy(ctx context.Context, config ScopeStrategyProvider, client Client) (strategy ScopeStrategy)

GetScopeStrategy resolves the ScopeStrategy to use for a request. If the client implements ScopeStrategyProvider and returns a non-nil strategy, the client's strategy is preferred over the global configuration. Otherwise the strategy from the provided config is used, falling back to ExactScopeStrategy when neither source supplies one.

type ScopeStrategyProvider 

type ScopeStrategyProvider interface {
	// GetScopeStrategy returns the scope strategy.
	GetScopeStrategy(ctx context.Context) (strategy ScopeStrategy)
}

ScopeStrategyProvider returns the provider for configuring the scope strategy.

type SendDebugMessagesToClientsProvider 

type SendDebugMessagesToClientsProvider interface {
	// GetSendDebugMessagesToClients returns the send debug messages to clients.
	GetSendDebugMessagesToClients(ctx context.Context) (send bool)
}

SendDebugMessagesToClientsProvider returns the provider for configuring the send debug messages to clients.

type Session 

type Session interface {
	// SetExpiresAt sets the expiration time of a token.
	//
	//  session.SetExpiresAt(oauth2.AccessToken, time.Now().UTC().Add(time.Hour))
	SetExpiresAt(key TokenType, exp time.Time)

	// GetExpiresAt returns the expiration time of a token if set, or time.IsZero() if not.
	//
	//  session.GetExpiresTimeX(oauth2.AccessToken)
	GetExpiresAt(key TokenType) time.Time

	// GetUsername returns the username, if set. This is optional and only used during token introspection.
	GetUsername() string

	// GetSubject returns the subject, if set. This is optional and only used during token introspection.
	GetSubject() string

	// Clone clones the session.
	Clone() Session
}

Session is an interface that is used to store session data between OAuth2 requests. It can be used to look up when a session expires or what the subject's name was.

type Storage 

type Storage interface {
	ClientManager
}

Storage defines the minimal storage interface.

type TLSClientAuthClient added in v0.3.0 

type TLSClientAuthClient interface {
	// GetTLSClientAuthSubjectDN returns the 'tls_client_auth_subject_dn' client metadata value, being the RFC 4514
	// string representation of the expected certificate subject distinguished name.
	GetTLSClientAuthSubjectDN() (dn string)

	// GetTLSClientAuthSANDNS returns the 'tls_client_auth_san_dns' client metadata value, being the expected dNSName
	// subject alternative name entry.
	GetTLSClientAuthSANDNS() (dns string)

	// GetTLSClientAuthSANURI returns the 'tls_client_auth_san_uri' client metadata value, being the expected
	// uniformResourceIdentifier subject alternative name entry.
	GetTLSClientAuthSANURI() (uri string)

	// GetTLSClientAuthSANIP returns the 'tls_client_auth_san_ip' client metadata value, being the expected iPAddress
	// subject alternative name entry in dotted decimal or colon delimited hexadecimal notation.
	GetTLSClientAuthSANIP() (ip string)

	// GetTLSClientAuthSANEmail returns the 'tls_client_auth_san_email' client metadata value, being the expected
	// rfc822Name subject alternative name entry.
	GetTLSClientAuthSANEmail() (email string)

	Client
}

TLSClientAuthClient represents a client that authenticates using the RFC 8705 Section 2.1 'tls_client_auth' PKI method. A client using that method MUST register exactly one of these subject values, which is the value the certificate presented during the handshake is checked against.

type TokenEndpointBindingHandler added in v0.3.0 

type TokenEndpointBindingHandler interface {
	// BindAccessRequest records the binding presented with this request and enforces any binding the session
	// already carries. It returns nil both when it records one and when there is nothing to record; any error
	// rejects the request.
	BindAccessRequest(ctx context.Context, request AccessRequester) (err error)

	// PopulateBoundTokenEndpointResponse adjusts the response to reflect the binding. It runs after every
	// TokenEndpointHandler has populated the response. Where two binding handlers write the same response field,
	// list order applies and the last write wins.
	PopulateBoundTokenEndpointResponse(ctx context.Context, request AccessRequester, response AccessResponder) (err error)
}

TokenEndpointBindingHandler records and enforces a proof-of-possession binding on an access request that a grant handler has already accepted.

A binding handler augments a grant another handler owns; it never satisfies one by itself. It is dispatched only for a request some TokenEndpointHandler accepted, so it needs neither a grant type claim nor a client authentication policy of its own. Handlers in a binding list write disjoint session fields, so their order within the list is not significant, with one exception: oidckb.Handler CONSUMES the validated *DPoPProof that rfc9449.Handler PUBLISHES via PublishDPoPProof, so it must be registered after it, or a grant that asked to be key bound fails with a server error on every token request. A handler added to this list that consumes what another one publishes must state its own ordering requirement the same way.

type TokenEndpointBindingHandlers added in v0.3.0 

type TokenEndpointBindingHandlers []TokenEndpointBindingHandler

TokenEndpointBindingHandlers is a list of TokenEndpointBindingHandler

func (*TokenEndpointBindingHandlers) Append added in v0.3.0 

func (t *TokenEndpointBindingHandlers) Append(h TokenEndpointBindingHandler)

Append adds a TokenEndpointBindingHandler to this list. Ignores duplicates based on reflect.TypeOf.

type TokenEndpointBindingHandlersProvider added in v0.3.0 

type TokenEndpointBindingHandlersProvider interface {
	// GetTokenEndpointBindingHandlers returns the token endpoint binding handlers.
	GetTokenEndpointBindingHandlers(ctx context.Context) (handlers TokenEndpointBindingHandlers)
}

TokenEndpointBindingHandlersProvider returns the provider for configuring the token endpoint binding handlers.

type TokenEndpointClientAuthStrategy added in v0.2.37 

type TokenEndpointClientAuthStrategy struct{}

TokenEndpointClientAuthStrategy is the EndpointClientAuthStrategy for the token endpoint. It resolves client authentication configuration from the client's 'token_endpoint_auth_method' metadata and permits public clients to authenticate using the 'none' method.

func (*TokenEndpointClientAuthStrategy) AllowAuthMethodAny added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) AllowAuthMethodAny() bool

AllowAuthMethodAny returns false as the token endpoint requires a client to use its registered authentication method.

func (*TokenEndpointClientAuthStrategy) AllowMethodNone added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) AllowMethodNone() bool

AllowMethodNone returns true as the token endpoint permits clients to authenticate using the 'none' method.

func (*TokenEndpointClientAuthStrategy) GetAuthEncryptionAlg added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthEncryptionAlg(client AuthenticationMethodClient) string

GetAuthEncryptionAlg returns the encryption key algorithm used for client assertions at the token endpoint.

func (*TokenEndpointClientAuthStrategy) GetAuthEncryptionEnc added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthEncryptionEnc(client AuthenticationMethodClient) string

GetAuthEncryptionEnc returns the content encryption algorithm used for client assertions at the token endpoint.

func (*TokenEndpointClientAuthStrategy) GetAuthEncryptionKeyID added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthEncryptionKeyID(client AuthenticationMethodClient) string

GetAuthEncryptionKeyID returns the encryption key id used for client assertions at the token endpoint.

func (*TokenEndpointClientAuthStrategy) GetAuthMethod added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthMethod(client AuthenticationMethodClient) string

GetAuthMethod returns the client's registered 'token_endpoint_auth_method'.

func (*TokenEndpointClientAuthStrategy) GetAuthSigningAlg added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthSigningAlg(client AuthenticationMethodClient) string

GetAuthSigningAlg returns the client's registered 'token_endpoint_auth_signing_alg'.

func (*TokenEndpointClientAuthStrategy) GetAuthSigningKeyID added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) GetAuthSigningKeyID(client AuthenticationMethodClient) string

GetAuthSigningKeyID returns the signing key id used to verify client assertions at the token endpoint.

func (*TokenEndpointClientAuthStrategy) Name added in v0.2.37 

func (s *TokenEndpointClientAuthStrategy) Name() string

Name returns 'token', the name of the endpoint this strategy represents.

type TokenEndpointClientAuthStrategyProvider added in v0.2.37 

type TokenEndpointClientAuthStrategyProvider interface {
	// GetTokenEndpointClientAuthStrategy returns the EndpointClientAuthStrategy used to authenticate clients at the
	// token endpoint. This endpoint permits public clients to authenticate using the 'none' method.
	GetTokenEndpointClientAuthStrategy(ctx context.Context) (strategy EndpointClientAuthStrategy)
}

TokenEndpointClientAuthStrategyProvider returns the provider for the client authentication strategy used at the token endpoint.

type TokenEndpointHandler 

type TokenEndpointHandler interface {
	// PopulateTokenEndpointResponse is responsible for setting return values and should only be executed if
	// the handler's HandleTokenEndpointRequest did not return ErrUnknownRequest.
	PopulateTokenEndpointResponse(ctx context.Context, request AccessRequester, response AccessResponder) (err error)

	// HandleTokenEndpointRequest handles an authorize request. If the handler is not responsible for handling
	// the request, this method should return ErrUnknownRequest and otherwise handle the request.
	HandleTokenEndpointRequest(ctx context.Context, request AccessRequester) (err error)

	// CanSkipClientAuth indicates if client authentication can be skipped. By default it MUST be false, unless you are
	// implementing extension grant type, which allows unauthenticated client. CanSkipClientAuth must be called
	// before HandleTokenEndpointRequest to decide, if AccessRequester will contain authenticated client.
	CanSkipClientAuth(ctx context.Context, request AccessRequester) (skip bool)

	// CanHandleTokenEndpointRequest indicates, if TokenEndpointHandler can handle this request or not. If true,
	// HandleTokenEndpointRequest can be called.
	CanHandleTokenEndpointRequest(ctx context.Context, request AccessRequester) (handle bool)
}

type TokenEndpointHandlers 

type TokenEndpointHandlers []TokenEndpointHandler

TokenEndpointHandlers is a list of TokenEndpointHandler

func (*TokenEndpointHandlers) Append 

func (t *TokenEndpointHandlers) Append(h TokenEndpointHandler)

Append adds an TokenEndpointHandler to this list. Ignores duplicates based on reflect.TypeOf.

type TokenEndpointHandlersProvider 

type TokenEndpointHandlersProvider interface {
	// GetTokenEndpointHandlers returns the token endpoint handlers.
	GetTokenEndpointHandlers(ctx context.Context) (handlers TokenEndpointHandlers)
}

TokenEndpointHandlersProvider returns the provider for configuring the token endpoint handlers.

type TokenEntropyProvider 

type TokenEntropyProvider interface {
	// GetTokenEntropy returns the token entropy.
	GetTokenEntropy(ctx context.Context) (entropy int)
}

TokenEntropyProvider returns the provider for configuring the token entropy.

type TokenIntrospectionHandlers 

type TokenIntrospectionHandlers []TokenIntrospector

TokenIntrospectionHandlers is a list of TokenValidator

func (*TokenIntrospectionHandlers) Append 

func (t *TokenIntrospectionHandlers) Append(h TokenIntrospector)

Append adds an AccessTokenValidator to this list. Ignores duplicates based on reflect.TypeOf.

type TokenIntrospectionHandlersProvider 

type TokenIntrospectionHandlersProvider interface {
	// GetTokenIntrospectionHandlers returns the token introspection handlers.
	GetTokenIntrospectionHandlers(ctx context.Context) (handlers TokenIntrospectionHandlers)
}

TokenIntrospectionHandlersProvider returns the provider for configuring the token introspection handlers.

type TokenIntrospector 

type TokenIntrospector interface {
	IntrospectToken(ctx context.Context, token string, tokenUseHint TokenUse, request AccessRequester, scopes []string) (tokenUse TokenUse, err error)
}

type TokenType 

type TokenType string

type TokenUse 

type TokenUse = TokenType

type TokenValidationStrategy added in v0.3.0 

type TokenValidationStrategy interface {
	// ValidateIDToken decodes and verifies an ID Token, returning its claims. Application-specific claim policy
	// ('iss' and 'aud' in particular) is the caller's responsibility; see DefaultIDTokenValidationStrategy.
	//
	// The request is always supplied, but it may carry no client: a caller which does not yet know the client, such
	// as one decoding a token with WithAllowUnverified in order to discover it, supplies an otherwise empty Requester.
	// Implementations must therefore tolerate Requester.GetClient returning nil.
	ValidateIDToken(ctx context.Context, request Requester, token string, opts ...IDTokenValidationOpt) (claims jwt.MapClaims, err error)
}

TokenValidationStrategy validates tokens presented to the authorization server by a client, as opposed to tokens the authorization server itself issued and stored.

type URIComparisonStrategy added in v0.2.18 

type URIComparisonStrategy interface {
	Compare(pair *uriPair) bool
	UseSimpleStringComparison() bool
}

URIComparisonStrategy is used to compare URIs.

func GetClientRedirectURIComparisonStrategy added in v0.2.18 

func GetClientRedirectURIComparisonStrategy(client Client) (strategy URIComparisonStrategy)

GetClientRedirectURIComparisonStrategy returns the URIComparisonStrategy configured for the given client, falling back to BestPracticeURIComparisonStrategy when the client does not implement RedirectURICustomComparisonClient or returns a nil strategy.

type UseLegacyErrorFormatProvider deprecated 

type UseLegacyErrorFormatProvider interface {
	// GetUseLegacyErrorFormat returns whether to use the legacy error format.
	//
	// Deprecated: Do not use this flag anymore.
	GetUseLegacyErrorFormat(ctx context.Context) (use bool)
}

UseLegacyErrorFormatProvider returns the provider for configuring whether to use the legacy error format.

Deprecated: Do not use this flag anymore.

type UserInfoClient added in v0.1.15 

type UserInfoClient interface {
	// GetUserinfoSignedResponseKeyID returns the specific key identifier used to satisfy JWS requirements of the User
	// Info specifications. If unspecified the other available parameters will be utilized to select an appropriate
	// key.
	GetUserinfoSignedResponseKeyID() (kid string)

	// GetUserinfoSignedResponseAlg is equivalent to the 'userinfo_signed_response_alg' client metadata value which
	// determines the JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the
	// response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo
	// Response to return the Claims as a UTF-8 [RFC3629] encoded JSON object using the application/json content-type.
	GetUserinfoSignedResponseAlg() (alg string)

	// GetUserinfoEncryptedResponseKeyID returns the specific key identifier used to satisfy JWE requirements of the
	// User Info specifications. If unspecified the other available parameters will be utilized to select an appropriate
	// key.
	GetUserinfoEncryptedResponseKeyID() (kid string)

	// GetUserinfoEncryptedResponseAlg is equivalent to the 'userinfo_encrypted_response_alg' client metadata value
	// which determines the JWE alg algorithm [JWA] REQUIRED for encrypting the ID Token issued to this Client. If
	// this is requested, the response will be signed then encrypted, with the result being a Nested JWT, as defined in
	// [JWT]. The default, if omitted, is that no encryption is performed.
	GetUserinfoEncryptedResponseAlg() (alg string)

	// GetUserinfoEncryptedResponseEnc is equivalent to the 'userinfo_encrypted_response_enc' client metadata value
	// which determines the JWE enc algorithm [JWA] REQUIRED for encrypting UserInfo Responses. If
	// userinfo_encrypted_response_alg is specified, the default userinfo_encrypted_response_enc value is A128CBC-HS256.
	// When userinfo_encrypted_response_enc is included, userinfo_encrypted_response_alg MUST also be provided.
	GetUserinfoEncryptedResponseEnc() (enc string)

	JSONWebKeysClient
}

UserInfoClient is a client which can satisfy all JWS and JWE requirements of the User Info responses.

type VerifiableCredentialsNonceLifespanProvider 

type VerifiableCredentialsNonceLifespanProvider interface {
	// GetVerifiableCredentialsNonceLifespan returns the nonce lifespan.
	GetVerifiableCredentialsNonceLifespan(ctx context.Context) (lifespan time.Duration)
}

VerifiableCredentialsNonceLifespanProvider returns the provider for configuring the access token lifespan.

Source Files

View all Source files

Directories

Path Synopsis
handler
oauth2
oidckb
openid
par
pkce
rfc7523
rfc7591
rfc8628
rfc8693
rfc8705
rfc9449
verifiable
clients
clone
Package clone deep copies the JSON-shaped values held by sessions and claims.
 Package clone deep copies the JSON-shaped values held by sessions and claims.
clone/clonetest
Package clonetest asserts that a hand-written Clone is a complete deep copy.
 Package clonetest asserts that a hand-written Clone is a complete deep copy.
consts
gen
mock
Package internal is a generated GoMock package.
 Package internal is a generated GoMock package.
randx
reflection
stringslice
urls
testing
mock
Package mock is a generated GoMock package.
 Package mock is a generated GoMock package.
token
hmac
jarm
jose
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
 Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
jose/cipher
jose/cryptosigner
Package cryptosigner implements an OpaqueSigner that wraps a "crypto".Signer
 Package cryptosigner implements an OpaqueSigner that wraps a "crypto".Signer
jose/jose-util command
jose/jose-util/generator
jose/json
Package json implements encoding and decoding of JSON as defined in RFC 7159.
 Package json implements encoding and decoding of JSON as defined in RFC 7159.
jose/jwt
Package jwt provides an implementation of the JSON Web Token standard.
 Package jwt provides an implementation of the JSON Web Token standard.
jose/testutils/assert
jose/testutils/require
jwt
x
errorsx

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.