singpass

README

Singpass

Add Singpass Login support to your Go HTTP application

http.HandleFunc("/mysingpass/start", singpass.RedirectToSingpass(cfg, singpass.NonceStateToCookie, errHandler))
http.HandleFunc("/mysingpass/callback", singpassCallbackHandler)

After some configuration, see internal/example.go

Documentation

Index

• Variables
• func CallbackFromSingpass(singpassBaseURL string, provider *oidc.Provider, ...) (http.HandlerFunc, error)
• func RedirectToSingpass(oauth2Config oauth2.Config, ...) http.HandlerFunc
• type NRICAndUUID
  • func ExtractNRICAndUUIDFromPayload(sub string) (NRICAndUUID, error)
• type NonceState
  • func NonceStateFromCookie(r *http.Request) (NonceState, error)
  • func NonceStateToCookie(w http.ResponseWriter, r *http.Request) (NonceState, error)

Variables

var (
	ErrNoEncKeyFound        = errors.New("no enc key found")
	ErrNoSigKeyFound        = errors.New("no sig key found")
	ErrUnsupportedAlgorithm = errors.New("invalid alg")
	ErrStateInvalid         = errors.New("state invalid")
	ErrStateMismatch        = errors.New("state mismatch")
	ErrNonceMismatch        = errors.New("nonce mismatch")
	ErrMissingCode          = errors.New("missing code")
	ErrCreateClaims         = errors.New("jwt.NewWithClaims")
	ErrExchange             = errors.New("exchange failed")
	ErrNoIDToken            = errors.New("no id_token")
	ErrParseEncrypted       = errors.New("jose.ParseEncrypted failed")
	ErrJWEDecrypt           = errors.New("jwe.Decrypt failed")
	ErrVerify               = errors.New("verify failed")
	ErrExtractNRIC          = errors.New("cannot extract nric and uuid")
	ErrInvalidSubPayload    = errors.New("token payload sub property is invalid, does not contain valid NRIC and uuid string")
)

Functions

func CallbackFromSingpass

func CallbackFromSingpass(
	singpassBaseURL string,
	provider *oidc.Provider,
	secretKeySet jose.JSONWebKeySet,
	oauth2Config oauth2.Config,
	getNonceState func(r *http.Request) (NonceState, error),
	errHandler httpErrorHandler,
	okHandler func(w http.ResponseWriter, r *http.Request, payload NRICAndUUID),
) (http.HandlerFunc, error)

CallbackFromSingpass returns a http.HandlerFunc that can be used as a callback for OAuth2 flow. singpassBaseURL is `provider.issuer`, see https://stg-id.singpass.gov.sg/docs/authorization/api#_jwt_claims

func RedirectToSingpass

func RedirectToSingpass(
	oauth2Config oauth2.Config,
	generateNonceState func(w http.ResponseWriter, r *http.Request) (NonceState, error),
	errHandler httpErrorHandler,
) http.HandlerFunc

RedirectToSingpass returns a http.HandlerFunc that redirects the user to singpass.

Types

type NRICAndUUID

type NRICAndUUID struct {
	NRIC string
	UUID string
}

NRICAndUUID is a pair of NRIC and UUID.

func ExtractNRICAndUUIDFromPayload

func ExtractNRICAndUUIDFromPayload(sub string) (NRICAndUUID, error)

ExtractNRICAndUUIDFromPayload extracts NRIC and UUID from the given payload's 'sub' property. converted from `extractNricAndUuidFromPayload` in https://github.com/GovTechSG/singpass-myinfo-oidc-helper

type NonceState

type NonceState struct {
	Nonce string `json:"n"`
	State string `json:"s"`
}

NonceState is a pair of nonce and state; things we keep track of before sending the user to singpass.

func NonceStateFromCookie

func NonceStateFromCookie(r *http.Request) (NonceState, error)

NonceStateFromCookie returns the state from the given request's cookie, previously set by NonceStateToCookie.

func NonceStateToCookie

func NonceStateToCookie(w http.ResponseWriter, r *http.Request) (NonceState, error)

NonceStateToCookie sets a cookie with the given NonceState.