generic

Documentation

Overview

Package generic Tellstone Generic OIDC Provider File: generic.go Description: Reference internal provider implementing the OAuth2/OIDC flow on stdlib only. It discovers the identity provider's configuration, caches its JWKS, and verifies RS256 / ES256 JWTs at AUTH time. Built-in providers follow this shape: a constructor that fetches what it needs eagerly (so misconfiguration fails fast at startup, not at first AUTH) and a Verify that stays local and allocation-light.

Authors:

Maximilian Hagen

Index

• type Provider
  • func New(cfg oauth.Config, logger log.Logger) (*Provider, error)
  • func (p *Provider) Config() oauth.Config
  • func (p *Provider) Verify(ctx context.Context, token []byte) (oauth.Claims, error)

Types

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider verifies JWTs for a single OIDC identity provider.

It is safe for concurrent use: jwks is the only mutable state and sits behind an RWMutex. Config and jwksURI are written once during New and read-only afterward.

func New

func New(cfg oauth.Config, logger log.Logger) (*Provider, error)

New builds a provider and, in the same call, discovers the IdP and fetches its keys. Doing the network round-trip here keeps the fail-fast property: a wrong issuer or unreachable IdP is reported at startup, before the first AUTH can ever fail on it.

func (*Provider) Config

func (p *Provider) Config() oauth.Config

Config returns the provider's static parameters.

func (*Provider) Verify

func (p *Provider) Verify(ctx context.Context, token []byte) (oauth.Claims, error)

Verify authenticates a JWT and returns its claims.

Authentication failures all surface as oauth.ErrInvalidToken. The single exception is a failed JWKS refresh, returned unwrapped: it means the IdP is unreachable, which is a transient condition the caller may want to treat differently from a rejected credential.