caddy_logingov

README

Caddy LoginGov

LoginGov OAuth plugin for Login.Gov, as per these specifications.

NOTE: This is not a registered plugin with Caddy, so you need to fork Caddy and build it manually in another project. Add something like this to your project's go.mod:

module github.com/<your.username>/<your.project>

go 1.13

// for prod
replace github.com/caddyserver/caddy => github.com/<your.username>/caddy master

// for local development
replace github.com/caddyserver/caddy => ../caddy

This plugin is for Caddy v1, NOT v2.

Example

https://your.website.local {
  tls self_signed

  logingov {
    auth_required /
    auth_required /private
    whitelist /public
    whitelist /public2

    client_id <your id registered with Login.Gov>
    redirect_url https://your.website.local/oauth-callback
    scope email
    acr_values http://idmanagement.gov/ns/assurance/loa/1
    login_url /login
  }
}

License

MIT

Contributors

• Maintainer - Andrew Zah andrew.zah@ossys.com

Sponsor

This project was funded by OSSYS - Open Source Systems.

Documentation

Index

• Constants
• type Config
• type Endpoint
• type LoginGovHandler
  • func (h LoginGovHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
• type TokenResponse
• type UserInfo
• type UserStore

Constants

const COOKIE_CODE = "LoginGovOAuthCode"

const COOKIE_STATE = "LoginGovOAuthState"

const COOKIE_USER_STORE = "LoginGovOAuthUserStore"

Types

type Config

type Config struct {
	OauthConf      *oauth2.Config
	CallbackPath   string
	Scopes         string
	ClientID       string
	Endpoint       Endpoint
	AcrValues      string
	LoginURL       string
	LogoutURL      string
	RedirectURL    string
	SuccessURL     string
	Emails         map[string]bool
	AuthPaths      []string
	WhitelistPaths []string
	Next           httpserver.Handler
	// contains filtered or unexported fields
}

type Endpoint

type Endpoint struct {
	AuthURL     string
	TokenURL    string
	UserInfoURL string
}

type LoginGovHandler

type LoginGovHandler struct {
	Next httpserver.Handler
	// contains filtered or unexported fields
}

func (LoginGovHandler) ServeHTTP

func (h LoginGovHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)

type TokenResponse

type TokenResponse struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	ExpiresIn   int64  `json:"expires_in"`
	IdToken     string `json:"id_token"`
}

response from token endpoint

type UserInfo

type UserInfo struct {
	Sub           string `json:"sub"`
	Iss           string `json:"iss"`
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
}

response from userinfo endpoint

type UserStore

type UserStore struct {
	Sub       string `json:"sub"`
	Iss       string `json:"iss"`
	Email     string `json:"email"`
	Token     string `json:"id_token"`
	ExpiresIn int64  `json:"expires_in"`
}