gsa

Documentation

Index

• func NewOIDCTokenSource(ctx context.Context, logger *log.Logger, googleServiceAccountJSON []byte, ...) (src oidc.TokenSource, clearIDToken func() error, err error)
• type OIDCConfig
• type OIDCTokenSource
  • func (s *OIDCTokenSource) OIDCToken() (*oidc.Token, error)
  • func (s *OIDCTokenSource) Verifier() oidc.Verifier

Functions

func NewOIDCTokenSource

func NewOIDCTokenSource(ctx context.Context, logger *log.Logger, googleServiceAccountJSON []byte, provider string, cfg OIDCConfig) (src oidc.TokenSource, clearIDToken func() error, err error)

NewOIDCTokenSource constructs OIDCTokenSource. Only JSON files are supported as ServiceAccount files.

Types

type OIDCConfig

type OIDCConfig struct {
	Provider     string   `json:"provider"`
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"secret"`
	Scopes       []string `json:"scopes"`
}

type OIDCTokenSource

type OIDCTokenSource struct {
	// contains filtered or unexported fields
}

OIDCTokenSource implements `oidc.TokenSource` interface to perform oidc-browser-dance. Strictly for Google Service Accounts.

func (*OIDCTokenSource) OIDCToken

func (s *OIDCTokenSource) OIDCToken() (*oidc.Token, error)

OIDCToken is used to obtain new OIDC Token (which includes e.g access token and id token). No refresh token will be returned, because this is token source is only service Accounts and we don't need login for that anyway. No caching is in place. We base for reuse token source to cache valid tokens in memory.

func (*OIDCTokenSource) Verifier

func (s *OIDCTokenSource) Verifier() oidc.Verifier

Verifier returns verifier for tokens.