oauth2

Documentation

Index

• Constants
• func AddAddressClaims(claims map[string]any, user User)
• func AddEmailClaims(claims map[string]any, user User)
• func AddExtraClaims(claims map[string]any, extraClaims map[string]string, user User)
• func AddPhoneClaims(claims map[string]any, user User)
• func AddProfileClaims(claims map[string]any, user User)
• func AuthorizeHandler(basePath string, tokenService TokenCreator, peopleStore people.Store, ...) http.Handler
• func DiscoveryDocumentHandler(issuer, scope string) http.Handler
• func Error(w http.ResponseWriter, error string, description string, code int)
• func GeneratePrivateKey(keySize int) (*rsa.PrivateKey, []byte, error)
• func IntersectScope(availableScope, requestedScope string) string
• func JwksHandler(publicKeys map[string]*rsa.PublicKey) http.Handler
• func LoadPublicKeys(basePath string, keys []string) (map[string]*rsa.PublicKey, error)
• func ToJwks(publicKeys map[string]*rsa.PublicKey) []jose.JSONWebKey
• func TokenHandler(tokenService TokenCreator, peopleStore people.Store, clients Clients, ...) http.Handler
• func UserInfoHandler(peopleStore people.Store, tokenVerifier TokenVerifier, ...) http.Handler
• type Client
• type Clients
  • func (c Clients) ClientsMatchingRedirectURI(uri string) []string
• type DiscoveryDocument
• type ErrorResponse
• type TokenCreator
  • func NewTokenService(privateKey *rsa.PrivateKey, keyID, issuer, scope string, ...) (TokenCreator, error)
• type TokenResponse
• type TokenVerifier
• type User

Constants

const (
	ClaimClientID        = "client_id"
	ClaimExpirationTime  = "exp"
	ClaimIssuer          = "iss"
	ClaimIssuedAtTime    = "iat"
	ClaimNotBeforeTime   = "nbf"
	ClaimUserID          = "user_id"
	ClaimScope           = "scope"
	ClaimSubject         = "sub"
	ClaimType            = "typ"
	ClaimAudience        = "aud"
	ClaimAccessTokenHash = "at_hash"
	ClaimNonce           = "nonce"
)

const (
	// ErrorInvalidRequest - The request is missing a parameter so the server
	// can't proceed with the request. This may also be returned if the
	// request includes an unsupported parameter or repeats a parameter.
	ErrorInvalidRequest = "invalid_request"

	// ErrorInvalidClient – Client authentication failed, such as if the
	// request contains an invalid client ID or secret. Send an HTTP 401
	// response in this case.
	ErrorInvalidClient = "invalid_client"

	// ErrorInvalidGrant – The authorization code (or user's password for the
	// password grant type) is invalid or expired. This is also the error you
	// would return if the redirect URL given in the authorization grant does
	// not match the URL provided in this access token request.
	ErrorInvalidGrant = "invalid_grant"

	// ErrorRedirectURIMismatch - The redirect URI is invalid for the
	// requested client id
	ErrorRedirectURIMismatch = "redirect_uri_mismatch"

	// ErrorUnsupportedGrantType – If a grant type is requested that the
	// authorization server doesn't recognize, use this code. Note that
	// unknown grant types also use this specific error code rather than using
	// the ErrorInvalidRequest above.
	ErrorUnsupportedGrantType = "unsupported_grant_type"

	ErrorInternal = "internal_server_error"
	ErrorNotFound = "not_found"
)

const (
	GrantTypeAuthorizationCode = "authorization_code"
	GrantTypeClientCredentials = "client_credentials"
	GrantTypeRefreshToken      = "refresh_token"

	TokenTypeCode         = "code"
	TokenTypeRefreshToken = "refresh"
	TokenTypeAccessToken  = "at"
	TokenTypeIDToken      = "id"
	ResponseTypeCode      = "code"
	ResponseTypeToken     = "token"
)

const OIDCDefaultScope = "openid profile email phone address offline_access"

Functions

func AddAddressClaims

func AddAddressClaims(claims map[string]any, user User)

func AddEmailClaims

func AddEmailClaims(claims map[string]any, user User)

func AddExtraClaims

func AddExtraClaims(claims map[string]any, extraClaims map[string]string, user User)

func AddPhoneClaims

func AddPhoneClaims(claims map[string]any, user User)

func AddProfileClaims

func AddProfileClaims(claims map[string]any, user User)

func AuthorizeHandler

func AuthorizeHandler(basePath string, tokenService TokenCreator, peopleStore people.Store, clients Clients, scope, sessionName string) http.Handler

func DiscoveryDocumentHandler

func DiscoveryDocumentHandler(issuer, scope string) http.Handler

func Error

func Error(w http.ResponseWriter, error string, description string, code int)

func GeneratePrivateKey

func GeneratePrivateKey(keySize int) (*rsa.PrivateKey, []byte, error)

func IntersectScope

func IntersectScope(availableScope, requestedScope string) string

func JwksHandler

func JwksHandler(publicKeys map[string]*rsa.PublicKey) http.Handler

func LoadPublicKeys

func LoadPublicKeys(basePath string, keys []string) (map[string]*rsa.PublicKey, error)

func ToJwks

func ToJwks(publicKeys map[string]*rsa.PublicKey) []jose.JSONWebKey

ToJwks creates JSON Web Keys from multiple RSA public keys

func TokenHandler

func TokenHandler(tokenService TokenCreator, peopleStore people.Store, clients Clients, refreshTokenRotation bool) http.Handler

func UserInfoHandler

func UserInfoHandler(peopleStore people.Store, tokenVerifier TokenVerifier, extraClaims map[string]string) http.Handler

Types

type Client

type Client struct {
	RedirectURIPattern string `json:"redirect_uri_pattern,omitempty"`
	Secret             string `json:"secret,omitempty"`
	SessionName        string `json:"session_name,omitempty"`
}

type Clients

type Clients map[string]Client

func (Clients) ClientsMatchingRedirectURI

func (c Clients) ClientsMatchingRedirectURI(uri string) []string

type DiscoveryDocument

type DiscoveryDocument struct {
	Issuer                                     string   `json:"issuer"`
	AuthorizationEndpoint                      string   `json:"authorization_endpoint"`
	JwksURI                                    string   `json:"jwks_uri"`
	ResponseTypesSupported                     []string `json:"response_types_supported"`
	GrantTypesSupported                        []string `json:"grant_types_supported"`
	TokenEndpoint                              string   `json:"token_endpoint"`
	UserinfoEndpoint                           string   `json:"userinfo_endpoint"`
	EndSessionEndpoint                         string   `json:"end_session_endpoint"`
	ScopesSupported                            []string `json:"scopes_supported"`
	TokenEndpointAuthMethodsSupported          []string `json:"token_endpoint_auth_methods_supported"`
	TokenEndpointAuthSigningAlgValuesSupported []string `json:"token_endpoint_auth_signing_alg_values_supported"`
	CodeChallengeMethodsSupported              []string `json:"code_challenge_methods_supported,omitempty"`
	IDTokenSigningAlgValuesSupported           []string `json:"id_token_signing_alg_values_supported"`
}

type ErrorResponse

type ErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
}

type TokenCreator

type TokenCreator interface {
	TokenVerifier
	GenerateAccessToken(user User, clientID, scope string) (string, error)
	GenerateIDToken(user User, clientID, scope, accessTokenHash, nonce string) (string, error)
	GenerateAuthCode(userID, clientID, scope, challenge, nonce string) (string, error)
	GenerateRefreshToken(userID, clientID, scope, nonce string) (string, error)
	VerifyAuthCode(rawToken string) (userID, scope, challenge, nonce string, valid bool)
	VerifyRefreshToken(rawToken string) (userID, scope, nonce string, valid bool)
	AccessTokenTTL() int64
	Issuer() string
}

func NewTokenService

func NewTokenService(privateKey *rsa.PrivateKey, keyID, issuer, scope string,
	accessTokenTTL, refreshTokenTTL, idTokenTTL int64,
	accessTokenExtraClaims, idTokenExtraClaims map[string]string) (TokenCreator, error)

type TokenResponse

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int64  `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
}

type TokenVerifier

type TokenVerifier interface {
	VerifyAccessToken(rawToken string) (string, error)
}

type User

type User struct {
	people.Person
	UserID string `json:"user_id"`
}