oidcresolver

Documentation

Index

• type ClaimNames
  • func DefaultClaimNames() ClaimNames
• type Option
  • func WithClaimNames(names ClaimNames) Option
  • func WithProfileSource(source ProfileSource) Option
• type ProfileSource
• type Resolver
  • func NewResolver(verifier *oidcauth.Verifier, usersClient usersv1.UsersServiceClient, ...) (*Resolver, error)
  • func (r *Resolver) ResolveFromToken(ctx context.Context, accessToken string) (identity.ResolvedIdentity, error)

Types

type ClaimNames

type ClaimNames struct {
	Name              string
	Email             string
	Picture           string
	PreferredUsername string
}

ClaimNames maps profile fields onto the claims that carry them. Applies to both sources, so a provider using non-standard names is configured the same way regardless of where claims are read from.

func DefaultClaimNames

func DefaultClaimNames() ClaimNames

DefaultClaimNames are the standard OIDC claim names.

type Option

type Option func(*Resolver)

Option customizes how a Resolver obtains profile claims.

func WithClaimNames

func WithClaimNames(names ClaimNames) Option

WithClaimNames overrides the claim names. Empty fields keep their defaults.

func WithProfileSource

func WithProfileSource(source ProfileSource) Option

WithProfileSource selects the claim source. Defaults to ProfileSourceUserInfo.

type ProfileSource

type ProfileSource string

ProfileSource selects where provisioning-time profile claims are read from.

const (
	// ProfileSourceUserInfo fetches claims from the IdP's UserInfo endpoint.
	ProfileSourceUserInfo ProfileSource = "userinfo"
	// ProfileSourceToken reads claims from the validated access token itself.
	// Required for IdPs that issue audience-restricted access tokens: the OIDC
	// UserInfo endpoint rejects any token carrying an `aud` claim, so a Gateway
	// that needs a verifiable JWT cannot also call UserInfo with it.
	ProfileSourceToken ProfileSource = "token"
)

type Resolver

type Resolver struct {
	// contains filtered or unexported fields
}

func NewResolver

func NewResolver(verifier *oidcauth.Verifier, usersClient usersv1.UsersServiceClient, httpClient *http.Client, opts ...Option) (*Resolver, error)

func (*Resolver) ResolveFromToken

func (r *Resolver) ResolveFromToken(ctx context.Context, accessToken string) (identity.ResolvedIdentity, error)