dex

Documentation

Index

• Constants
• Variables
• type CodeVerifier
  • func NewCodeVerifier() *CodeVerifier
  • func NewCodeVerifierWithLen(len int) *CodeVerifier
  • func (c *CodeVerifier) ChallengeS256() string
• type Config
  • func NewConfig(issuer, clientID string) (Config, error)
  • func NewConfigFromSecretData(clientID string, secretData map[string][]byte) (Config, error)
• type Group
• type OIDCProvider
  • func NewOIDCProvider(ctx context.Context, issuer, clientID string) (*OIDCProvider, error)
  • func NewOIDCProviderWithConfig(ctx context.Context, config Config) (*OIDCProvider, error)
  • func (pc *OIDCProvider) AddScopes(scopes ...string)
  • func (pc *OIDCProvider) AuthCodeURLWithPKCE() (string, string)
  • func (pc *OIDCProvider) ExchangeWithPKCE(ctx context.Context, authCode, codeVerifier string) (*oauth2.Token, error)
  • func (pc *OIDCProvider) GetProviderGroups(providerID string) (*ProviderGroups, error)
  • func (pc *OIDCProvider) Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error)
• type ProviderGroups
  • func (pg *ProviderGroups) GetRolesFromGroups(groupIDs ...string) []string

Constants

const (
	// https://dexidp.io/docs/custom-scopes-claims-clients/#public-clients
	OutOfBrowserURN = "urn:ietf:wg:oauth:2.0:oob"
)

Variables

var (
	// "openid" is a required scope for OpenID Connect flows.
	// Other scopes, such as "groups" can be requested.
	DefaultScopes = []string{oidc.ScopeOpenID, oidc.ScopeOfflineAccess, "profile", "email", "groups", "federated:id"}
)

Types

type CodeVerifier

type CodeVerifier struct {
	Value string
}

CodeVerifier is an helper struct used to create a code_challenge for the PKCE Ref: https://www.oauth.com/oauth2-servers/pkce/

func NewCodeVerifier

func NewCodeVerifier() *CodeVerifier

NewCodeVerifier returns a cryptographic secure random CodeVerifier of a fixed length (32)

func NewCodeVerifierWithLen

func NewCodeVerifierWithLen(len int) *CodeVerifier

NewCodeVerifier returns a cryptographic secure random CodeVerifier of the specified length

func (*CodeVerifier) ChallengeS256

func (c *CodeVerifier) ChallengeS256() string

ChallengeS256 returns an encoded SHA256 code_challenge of the code_verifier

type Config

type Config struct {
	Issuer          string
	ClientID        string
	Endpoint        *url.URL
	ProvidersGroups []ProviderGroups

	Oauth2 *oauth2.Config
}

func NewConfig

func NewConfig(issuer, clientID string) (Config, error)

func NewConfigFromSecretData

func NewConfigFromSecretData(clientID string, secretData map[string][]byte) (Config, error)

type Group

type Group struct {
	ID    string   `yaml:"id"`
	Role  string   `yaml:"role"`
	Roles []string `yaml:"roles"`
}

type OIDCProvider

type OIDCProvider struct {
	Config Config

	Provider *oidc.Provider
}

OIDCProvider wraps an oidc.Provider and its Configuration

func NewOIDCProvider

func NewOIDCProvider(ctx context.Context, issuer, clientID string) (*OIDCProvider, error)

NewOIDCProvider construct an OIDCProvider loading the configuration from the issuer URL

func NewOIDCProviderWithConfig

func NewOIDCProviderWithConfig(ctx context.Context, config Config) (*OIDCProvider, error)

NewOIDCProviderWithConfig construct an OIDCProvider with the provided configuration

func (*OIDCProvider) AddScopes

func (pc *OIDCProvider) AddScopes(scopes ...string)

AddScopes will add scopes to the OIDCProvider.Config.Scopes, extending the DefaultScopes

func (*OIDCProvider) AuthCodeURLWithPKCE

func (pc *OIDCProvider) AuthCodeURLWithPKCE() (string, string)

AuthCodeURLWithPKCE will return an URL that can be used to obtain an auth code, and a code_verifier string. The code_verifier is needed to implement the PKCE auth flow, since this is going to be used by our CLI Ref: https://www.oauth.com/oauth2-servers/pkce/

func (*OIDCProvider) ExchangeWithPKCE

func (pc *OIDCProvider) ExchangeWithPKCE(ctx context.Context, authCode, codeVerifier string) (*oauth2.Token, error)

ExchangeWithPKCE will exchange the authCode with a token, checking if the codeVerifier is valid

func (*OIDCProvider) GetProviderGroups

func (pc *OIDCProvider) GetProviderGroups(providerID string) (*ProviderGroups, error)

GetProviderGroups returns the ProviderGroups of the specified provider

func (*OIDCProvider) Verify

func (pc *OIDCProvider) Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error)

Verify will verify the token, and it will return an oidc.IDToken

type ProviderGroups

type ProviderGroups struct {
	ConnectorID string  `yaml:"connectorId"`
	Groups      []Group `yaml:"groups"`
}

func (*ProviderGroups) GetRolesFromGroups

func (pg *ProviderGroups) GetRolesFromGroups(groupIDs ...string) []string

GetRoleFromGroups returns the roles matching the provided groups