op

package
v0.13.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 27, 2020 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	InvalidRequest      errorType = "invalid_request"
	InvalidRequestURI   errorType = "invalid_request_uri"
	InteractionRequired errorType = "interaction_required"
	ServerError         errorType = "server_error"
)
View Source 
const OidcDevMode = "CAOS_OIDC_DEV"

Variables

View Source 
var (
	ErrInvalidRequest = func(description string) *OAuthError {
		return &OAuthError{
			ErrorType:   InvalidRequest,
			Description: description,
		}
	}
	ErrInvalidRequestRedirectURI = func(description string) *OAuthError {
		return &OAuthError{
			ErrorType:        InvalidRequestURI,
			Description:      description,
			redirectDisabled: true,
		}
	}
	ErrInteractionRequired = func(description string) *OAuthError {
		return &OAuthError{
			ErrorType:   InteractionRequired,
			Description: description,
		}
	}
	ErrServerError = func(description string) *OAuthError {
		return &OAuthError{
			ErrorType:   ServerError,
			Description: description,
		}
	}
)
View Source 
var (
	DefaultEndpoints = &endpoints{
		Authorization: NewEndpoint(defaultAuthorizationEndpoint),
		Token:         NewEndpoint(defaulTokenEndpoint),
		Introspection: NewEndpoint(defaultIntrospectEndpoint),
		Userinfo:      NewEndpoint(defaultUserinfoEndpoint),
		EndSession:    NewEndpoint(defaultEndSessionEndpoint),
		JwksURI:       NewEndpoint(defaultKeysEndpoint),
	}
)
View Source 
var DefaultSupportedScopes = []string{
	oidc.ScopeOpenID,
	oidc.ScopeProfile,
	oidc.ScopeEmail,
	oidc.ScopePhone,
	oidc.ScopeAddress,
}

Functions

func AuthMethods 

func AuthMethods(c Configuration) []string

func AuthRequestError 

func AuthRequestError(w http.ResponseWriter, r *http.Request, authReq ErrAuthRequest, err error, encoder utils.Encoder)

func AuthResponse 

func AuthResponse(authReq AuthRequest, authorizer Authorizer, w http.ResponseWriter, r *http.Request)

AuthResponse creates the successful authentication response (either code or tokens)

func AuthResponseCode 

func AuthResponseCode(w http.ResponseWriter, r *http.Request, authReq AuthRequest, authorizer Authorizer)

AuthResponseCode creates the successful code authentication response

func AuthResponseToken 

func AuthResponseToken(w http.ResponseWriter, r *http.Request, authReq AuthRequest, authorizer Authorizer, client Client)

AuthResponseToken creates the successful token(s) authentication response

func Authorize 

func Authorize(w http.ResponseWriter, r *http.Request, authorizer Authorizer)

Authorize handles the authorization request, including parsing, validating, storing and finally redirecting to the login handler

func AuthorizeCallback 

func AuthorizeCallback(w http.ResponseWriter, r *http.Request, authorizer Authorizer)

AuthorizeCallback handles the callback after authentication in the Login UI

func AuthorizeClient 

func AuthorizeClient(ctx context.Context, tokenReq *oidc.AccessTokenRequest, exchanger Exchanger) (AuthRequest, Client, error)

func AuthorizeClientIDSecret 

func AuthorizeClientIDSecret(ctx context.Context, clientID, clientSecret string, storage OPStorage) error

func BuildAuthRequestCode 

func BuildAuthRequestCode(authReq AuthRequest, crypto Crypto) (string, error)

func CodeChallengeMethods added in v0.7.1 

func CodeChallengeMethods(c Configuration) []string

func CodeExchange 

func CodeExchange(w http.ResponseWriter, r *http.Request, exchanger Exchanger)

func ContainsResponseType added in v0.7.0 

func ContainsResponseType(types []oidc.ResponseType, responseType oidc.ResponseType) bool

func CreateAccessToken 

func CreateAccessToken(ctx context.Context, tokenRequest TokenRequest, accessTokenType AccessTokenType, creator TokenCreator, client Client) (token string, validity time.Duration, err error)

func CreateAuthRequestCode added in v0.6.2 

func CreateAuthRequestCode(ctx context.Context, authReq AuthRequest, storage Storage, crypto Crypto) (string, error)

CreateAuthRequestCode creates and stores a code for the auth code response

func CreateBearerToken 

func CreateBearerToken(tokenID, subject string, crypto Crypto) (string, error)

func CreateDiscoveryConfig 

func CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfiguration

func CreateIDToken 

func CreateIDToken(ctx context.Context, issuer string, authReq AuthRequest, validity time.Duration, accessToken, code string, storage Storage, signer Signer, client Client) (string, error)

func CreateJWT 

func CreateJWT(ctx context.Context, issuer string, tokenRequest TokenRequest, exp time.Time, id string, signer Signer, client Client, storage Storage) (string, error)

func CreateJWTTokenResponse added in v0.9.0 

func CreateJWTTokenResponse(ctx context.Context, tokenRequest TokenRequest, creator TokenCreator) (*oidc.AccessTokenResponse, error)

func CreateRouter 

func CreateRouter(o OpenIDProvider, interceptors ...HttpInterceptor) *mux.Router

func CreateTokenResponse 

func CreateTokenResponse(ctx context.Context, authReq AuthRequest, client Client, creator TokenCreator, createAccessToken bool, code string) (*oidc.AccessTokenResponse, error)

func Discover 

func Discover(w http.ResponseWriter, config *oidc.DiscoveryConfiguration)

func EndSession added in v0.4.0 

func EndSession(w http.ResponseWriter, r *http.Request, ender SessionEnder)

func EnsureKey added in v0.9.0 

func EnsureKey(ctx context.Context, storage Storage, keyCh chan<- jose.SigningKey, timer <-chan time.Time, retry func(int) (bool, int))

func GrantTypes 

func GrantTypes(c Configuration) []string

func IsConfidentialType 

func IsConfidentialType(c Client) bool

func JWTProfile added in v0.9.0 

func JWTProfile(w http.ResponseWriter, r *http.Request, exchanger JWTAuthorizationGrantExchanger)

func Keys 

func Keys(w http.ResponseWriter, r *http.Request, k KeyProvider)

func NeedsExistingSession 

func NeedsExistingSession(authRequest *oidc.AuthRequest) bool

func ParseAccessTokenRequest 

func ParseAccessTokenRequest(r *http.Request, decoder utils.Decoder) (*oidc.AccessTokenRequest, error)

func ParseAuthorizeRequest added in v0.7.5 

func ParseAuthorizeRequest(r *http.Request, decoder utils.Decoder) (*oidc.AuthRequest, error)

ParseAuthorizeRequest parsed the http request into a AuthRequest

func ParseEndSessionRequest added in v0.4.0 

func ParseEndSessionRequest(r *http.Request, decoder utils.Decoder) (*oidc.EndSessionRequest, error)

func ParseJWTProfileRequest added in v0.9.0 

func ParseJWTProfileRequest(r *http.Request, decoder utils.Decoder) (*tokenexchange.JWTProfileRequest, error)

func ParseTokenExchangeRequest 

func ParseTokenExchangeRequest(w http.ResponseWriter, r *http.Request) (oidc.TokenRequest, error)

func Readiness added in v0.2.1 

func Readiness(w http.ResponseWriter, r *http.Request, probes ...ProbesFn)

func RedirectToLogin 

func RedirectToLogin(authReqID string, client Client, w http.ResponseWriter, r *http.Request)

RedirectToLogin redirects the end user to the Login UI for authentication

func RequestError added in v0.4.0 

func RequestError(w http.ResponseWriter, r *http.Request, err error)

func ResponseTypes 

func ResponseTypes(c Configuration) []string

func Scopes 

func Scopes(c Configuration) []string

func SigAlgorithms 

func SigAlgorithms(s Signer) []string

func SubjectTypes 

func SubjectTypes(c Configuration) []string

func SupportedClaims 

func SupportedClaims(c Configuration) []string

func TokenExchange 

func TokenExchange(w http.ResponseWriter, r *http.Request, exchanger Exchanger)

func Userinfo 

func Userinfo(w http.ResponseWriter, r *http.Request, userinfoProvider UserinfoProvider)

func ValidateAccessTokenRequest 

func ValidateAccessTokenRequest(ctx context.Context, tokenReq *oidc.AccessTokenRequest, exchanger Exchanger) (AuthRequest, Client, error)

func ValidateAuthReqIDTokenHint added in v0.5.0 

func ValidateAuthReqIDTokenHint(ctx context.Context, idTokenHint string, verifier IDTokenHintVerifier) (string, error)

ValidateAuthReqIDTokenHint validates the id_token_hint (if passed as parameter in the request) and returns the `sub` claim

func ValidateAuthReqRedirectURI 

func ValidateAuthReqRedirectURI(client Client, uri string, responseType oidc.ResponseType) error

ValidateAuthReqRedirectURI validates the passed redirect_uri and response_type to the registered uris and client type

func ValidateAuthReqResponseType 

func ValidateAuthReqResponseType(client Client, responseType oidc.ResponseType) error

ValidateAuthReqResponseType validates the passed response_type to the registered response types

func ValidateAuthReqScopes 

func ValidateAuthReqScopes(client Client, scopes []string) ([]string, error)

ValidateAuthReqScopes validates the passed scopes

func ValidateAuthRequest 

func ValidateAuthRequest(ctx context.Context, authReq *oidc.AuthRequest, storage Storage, verifier IDTokenHintVerifier) (string, error)

ValidateAuthRequest validates the authorize parameters and returns the userID of the id_token_hint if passed

func ValidateIssuer 

func ValidateIssuer(issuer string) error

func ValidateTokenExchangeRequest 

func ValidateTokenExchangeRequest(tokenReq oidc.TokenRequest, storage Storage) error

func VerifyAccessToken added in v0.12.0 

func VerifyAccessToken(ctx context.Context, token string, v AccessTokenVerifier) (oidc.AccessTokenClaims, error)

VerifyAccessToken validates the access token (issuer, signature and expiration)

func VerifyIDTokenHint added in v0.9.0 

func VerifyIDTokenHint(ctx context.Context, token string, v IDTokenHintVerifier) (oidc.IDTokenClaims, error)

VerifyIDTokenHint validates the id token according to https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation

func VerifyJWTAssertion added in v0.9.0 

func VerifyJWTAssertion(ctx context.Context, profileRequest *tokenexchange.JWTProfileRequest, v JWTProfileVerifier) (*oidc.JWTTokenRequest, error)

Types

type AccessTokenType 

type AccessTokenType int
const (
	AccessTokenTypeBearer AccessTokenType = iota
	AccessTokenTypeJWT
)

type AccessTokenVerifier added in v0.12.0 

type AccessTokenVerifier interface {
	oidc.Verifier
	SupportedSignAlgs() []string
	KeySet() oidc.KeySet
}

func NewAccessTokenVerifier added in v0.12.0 

func NewAccessTokenVerifier(issuer string, keySet oidc.KeySet) AccessTokenVerifier

type ApplicationType 

type ApplicationType int
const (
	ApplicationTypeWeb ApplicationType = iota
	ApplicationTypeUserAgent
	ApplicationTypeNative
)

type AuthMethod 

type AuthMethod string
const (
	AuthMethodBasic AuthMethod = "client_secret_basic"
	AuthMethodPost  AuthMethod = "client_secret_post"
	AuthMethodNone  AuthMethod = "none"

	CodeMethodS256 = "S256"
)

type AuthRequest 

type AuthRequest interface {
	GetID() string
	GetACR() string
	GetAMR() []string
	GetAudience() []string
	GetAuthTime() time.Time
	GetClientID() string
	GetCodeChallenge() *oidc.CodeChallenge
	GetNonce() string
	GetRedirectURI() string
	GetResponseType() oidc.ResponseType
	GetScopes() []string
	GetState() string
	GetSubject() string
	Done() bool
}

func AuthorizeCodeChallenge 

func AuthorizeCodeChallenge(ctx context.Context, tokenReq *oidc.AccessTokenRequest, exchanger Exchanger) (AuthRequest, error)

type AuthStorage 

type AuthStorage interface {
	CreateAuthRequest(context.Context, *oidc.AuthRequest, string) (AuthRequest, error)
	AuthRequestByID(context.Context, string) (AuthRequest, error)
	AuthRequestByCode(context.Context, string) (AuthRequest, error)
	SaveAuthCode(context.Context, string, string) error
	DeleteAuthRequest(context.Context, string) error

	CreateToken(context.Context, TokenRequest) (string, time.Time, error)

	TerminateSession(context.Context, string, string) error

	GetSigningKey(context.Context, chan<- jose.SigningKey, chan<- error, <-chan time.Time)
	GetKeySet(context.Context) (*jose.JSONWebKeySet, error)
	SaveNewKeyPair(context.Context) error
}

type AuthorizeValidator added in v0.7.5 

type AuthorizeValidator interface {
	Authorizer
	ValidateAuthRequest(context.Context, *oidc.AuthRequest, Storage, IDTokenHintVerifier) (string, error)
}

AuthorizeValidator is an extension of Authorizer interface implementing it's own validation mechanism for the auth request

type Authorizer 

type Authorizer interface {
	Storage() Storage
	Decoder() utils.Decoder
	Encoder() utils.Encoder
	Signer() Signer
	IDTokenHintVerifier() IDTokenHintVerifier
	Crypto() Crypto
	Issuer() string
}

type Client 

type Client interface {
	GetID() string
	RedirectURIs() []string
	PostLogoutRedirectURIs() []string
	ApplicationType() ApplicationType
	AuthMethod() AuthMethod
	ResponseTypes() []oidc.ResponseType
	LoginURL(string) string
	AccessTokenType() AccessTokenType
	IDTokenLifetime() time.Duration
	DevMode() bool
	RestrictAdditionalIdTokenScopes() func(scopes []string) []string
	RestrictAdditionalAccessTokenScopes() func(scopes []string) []string
	IsScopeAllowed(scope string) bool
	IDTokenUserinfoClaimsAssertion() bool
	ClockSkew() time.Duration
}

type Config 

type Config struct {
	Issuer                   string
	CryptoKey                [32]byte
	DefaultLogoutRedirectURI string
	CodeMethodS256           bool
}

type Configuration 

type Configuration interface {
	Issuer() string
	AuthorizationEndpoint() Endpoint
	TokenEndpoint() Endpoint
	UserinfoEndpoint() Endpoint
	EndSessionEndpoint() Endpoint
	KeysEndpoint() Endpoint

	AuthMethodPostSupported() bool
	CodeMethodS256Supported() bool
	GrantTypeTokenExchangeSupported() bool
	GrantTypeJWTAuthorizationSupported() bool
}

type Crypto 

type Crypto interface {
	Encrypt(string) (string, error)
	Decrypt(string) (string, error)
}

func NewAESCrypto 

func NewAESCrypto(key [32]byte) Crypto

type EndSessionRequest added in v0.4.0 

type EndSessionRequest struct {
	UserID      string
	Client      Client
	RedirectURI string
}

func ValidateEndSessionRequest added in v0.4.0 

func ValidateEndSessionRequest(ctx context.Context, req *oidc.EndSessionRequest, ender SessionEnder) (*EndSessionRequest, error)

type Endpoint 

type Endpoint struct {
	// contains filtered or unexported fields
}

func NewEndpoint added in v0.2.4 

func NewEndpoint(path string) Endpoint

func NewEndpointWithURL added in v0.2.4 

func NewEndpointWithURL(path, url string) Endpoint

func (Endpoint) Absolute 

func (e Endpoint) Absolute(host string) string

func (Endpoint) Relative 

func (e Endpoint) Relative() string

func (Endpoint) Validate 

func (e Endpoint) Validate() error

type ErrAuthRequest 

type ErrAuthRequest interface {
	GetRedirectURI() string
	GetResponseType() oidc.ResponseType
	GetState() string
}

type Exchanger 

type Exchanger interface {
	Issuer() string
	Storage() Storage
	Decoder() utils.Decoder
	Signer() Signer
	Crypto() Crypto
	AuthMethodPostSupported() bool
	GrantTypeTokenExchangeSupported() bool
	GrantTypeJWTAuthorizationSupported() bool
}

type HttpInterceptor added in v0.2.0 

type HttpInterceptor func(http.Handler) http.Handler

type IDTokenHintVerifier added in v0.9.0 

type IDTokenHintVerifier interface {
	oidc.Verifier
	SupportedSignAlgs() []string
	KeySet() oidc.KeySet
	ACR() oidc.ACRVerifier
	MaxAge() time.Duration
}

func NewIDTokenHintVerifier added in v0.9.0 

func NewIDTokenHintVerifier(issuer string, keySet oidc.KeySet) IDTokenHintVerifier

type JWTAuthorizationGrantExchanger added in v0.12.2 

type JWTAuthorizationGrantExchanger interface {
	Exchanger
	JWTProfileVerifier() JWTProfileVerifier
}

type JWTProfileVerifier added in v0.9.0 

type JWTProfileVerifier interface {
	oidc.Verifier
	Storage() Storage
}

func NewJWTProfileVerifier added in v0.9.0 

func NewJWTProfileVerifier(storage Storage, issuer string, maxAgeIAT, offset time.Duration) JWTProfileVerifier

type KeyProvider 

type KeyProvider interface {
	Storage() Storage
}

type OAuthError 

type OAuthError struct {
	ErrorType   errorType `json:"error" schema:"error"`
	Description string    `json:"error_description,omitempty" schema:"error_description,omitempty"`
	State       string    `json:"state,omitempty" schema:"state,omitempty"`
	// contains filtered or unexported fields
}

func (*OAuthError) Error 

func (e *OAuthError) Error() string

type OPStorage 

type OPStorage interface {
	GetClientByClientID(ctx context.Context, clientID string) (Client, error)
	AuthorizeClientIDSecret(ctx context.Context, clientID, clientSecret string) error
	GetUserinfoFromScopes(ctx context.Context, userID, clientID string, scopes []string) (oidc.UserInfo, error)
	GetUserinfoFromToken(ctx context.Context, tokenID, subject, origin string) (oidc.UserInfo, error)
	GetPrivateClaimsFromScopes(ctx context.Context, userID, clientID string, scopes []string) (map[string]interface{}, error)
	GetKeyByIDAndUserID(ctx context.Context, keyID, userID string) (*jose.JSONWebKey, error)
}

type OpenIDProvider 

type OpenIDProvider interface {
	Configuration
	Storage() Storage
	Decoder() utils.Decoder
	Encoder() utils.Encoder
	IDTokenHintVerifier() IDTokenHintVerifier
	AccessTokenVerifier() AccessTokenVerifier
	Crypto() Crypto
	DefaultLogoutRedirectURI() string
	Signer() Signer
	Probes() []ProbesFn
	HttpHandler() http.Handler
}

func NewOpenIDProvider added in v0.9.0 

func NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opOpts ...Option) (OpenIDProvider, error)

type Option added in v0.9.0 

type Option func(o *openidProvider) error

func WithCustomAuthEndpoint 

func WithCustomAuthEndpoint(endpoint Endpoint) Option

func WithCustomEndSessionEndpoint added in v0.4.1 

func WithCustomEndSessionEndpoint(endpoint Endpoint) Option

func WithCustomEndpoints added in v0.9.0 

func WithCustomEndpoints(auth, token, userInfo, endSession, keys Endpoint) Option

func WithCustomKeysEndpoint added in v0.2.3 

func WithCustomKeysEndpoint(endpoint Endpoint) Option

func WithCustomTokenEndpoint 

func WithCustomTokenEndpoint(endpoint Endpoint) Option

func WithCustomUserinfoEndpoint 

func WithCustomUserinfoEndpoint(endpoint Endpoint) Option

func WithHttpInterceptors added in v0.7.4 

func WithHttpInterceptors(interceptors ...HttpInterceptor) Option

func WithRetry added in v0.2.1 

func WithRetry(max int, sleep time.Duration) Option

func WithTimer added in v0.2.2 

func WithTimer(timer <-chan time.Time) Option

type ProbesFn added in v0.2.1 

type ProbesFn func(context.Context) error

func ReadySigner added in v0.2.1 

func ReadySigner(s Signer) ProbesFn

func ReadyStorage added in v0.2.1 

func ReadyStorage(s Storage) ProbesFn

type SessionEnder added in v0.4.0 

type SessionEnder interface {
	Decoder() utils.Decoder
	Storage() Storage
	IDTokenHintVerifier() IDTokenHintVerifier
	DefaultLogoutRedirectURI() string
}

type Signer 

type Signer interface {
	Health(ctx context.Context) error
	Signer() jose.Signer
	SignatureAlgorithm() jose.SignatureAlgorithm
}

func NewSigner added in v0.12.0 

func NewSigner(ctx context.Context, storage AuthStorage, keyCh <-chan jose.SigningKey) Signer

type Storage 

type Storage interface {
	AuthStorage
	OPStorage
	Health(context.Context) error
}

type StorageNotFoundError added in v0.2.1 

type StorageNotFoundError interface {
	IsNotFound()
}

type TokenCreator 

type TokenCreator interface {
	Issuer() string
	Signer() Signer
	Storage() Storage
	Crypto() Crypto
}

type TokenRequest added in v0.9.0 

type TokenRequest interface {
	GetSubject() string
	GetAudience() []string
	GetScopes() []string
}

type UserinfoProvider 

type UserinfoProvider interface {
	Decoder() utils.Decoder
	Crypto() Crypto
	Storage() Storage
	AccessTokenVerifier() AccessTokenVerifier
}

Source Files

View all Source files

Directories

Path Synopsis
Package mock is a generated GoMock package.
 Package mock is a generated GoMock package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.