oidc

Documentation

Overview

Package oidc wraps coreos/go-oidc to provide OIDC/OAuth2 authentication flows with PKCE. It imports the core auth package for types but never the reverse.

Index

• Variables
• func GeneratePKCE() (verifier, challenge string, err error)
• func GenerateState() (string, error)
• func ResolveUser(claims *Claims, existingBySub *auth.User) (user *auth.User, isNew bool)
• func ValidateConfig(cfg Config) error
• type Claims
• type Config
• type Provider
  • func NewProvider(ctx context.Context, cfg Config) (*Provider, error)
  • func (p *Provider) AuthorizationURL(state, nonce, codeChallenge string) string
  • func (p *Provider) Exchange(ctx context.Context, code, codeVerifier, nonce string) (*Claims, *time.Time, error)

Variables

var (
	ErrOIDCDiscovery     = errors.New("oidc: provider discovery failed")
	ErrOIDCExchange      = errors.New("oidc: code exchange failed")
	ErrOIDCTokenInvalid  = errors.New("oidc: ID token verification failed")
	ErrOIDCNonceMismatch = errors.New("oidc: nonce mismatch")
	ErrOIDCConfigInvalid = errors.New("oidc: invalid configuration")
)

Sentinel errors for OIDC operations.

Functions

func GeneratePKCE

func GeneratePKCE() (verifier, challenge string, err error)

GeneratePKCE generates a PKCE code verifier and S256 challenge.

func GenerateState

func GenerateState() (string, error)

GenerateState generates a random state string for OIDC flows.

func ResolveUser

func ResolveUser(claims *Claims, existingBySub *auth.User) (user *auth.User, isNew bool)

ResolveUser maps an OIDC identity to a user by (issuer, sub) only.

func ValidateConfig

func ValidateConfig(cfg Config) error

ValidateConfig checks that the required fields of a Config are set.

Types

type Claims

type Claims struct {
	Subject           string `json:"sub"`
	Issuer            string `json:"iss"`
	Email             string `json:"email"`
	PreferredUsername string `json:"preferred_username"`
	Name              string `json:"name"`
	EmailVerified     bool   `json:"email_verified"`
}

Claims holds the verified claims extracted from an OIDC ID token.

type Config

type Config struct {
	IssuerURL    string `json:"issuer_url" yaml:"issuer_url"`
	ClientID     string `json:"client_id" yaml:"client_id"`
	ClientSecret string `json:"-" yaml:"client_secret"`
	RedirectURI  string `json:"redirect_uri" yaml:"redirect_uri"`
	AutoRedirect bool   `json:"auto_redirect" yaml:"auto_redirect"`
}

Config holds OIDC provider settings.

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider wraps the coreos/go-oidc provider with PKCE support.

func NewProvider

func NewProvider(ctx context.Context, cfg Config) (*Provider, error)

NewProvider creates an OIDC provider from config.

func (*Provider) AuthorizationURL

func (p *Provider) AuthorizationURL(state, nonce, codeChallenge string) string

AuthorizationURL generates the OIDC authorization URL with PKCE and state.

func (*Provider) Exchange

func (p *Provider) Exchange(ctx context.Context, code, codeVerifier, nonce string) (*Claims, *time.Time, error)

Exchange exchanges an authorization code for tokens and validates the ID token.