oidc

Documentation

Overview

Package oidc provides a production-oriented OpenID Connect authentication component. It authenticates an upstream subject into an explicitly provisioned Modary principal; product scope, roles, and permissions are never accepted from identity-provider claims.

Stability: alpha. Consumers should pin an exact pre-v1 Modary version.

Index

• Constants
• func Module(options Options) (module.Registration, error)
• type Options
• type SubjectMapping

Constants

const (
	// ModuleID is the stable module manifest identifier.
	ModuleID = "oidc"
	// DefaultFlowTTL bounds one browser redirect ceremony.
	DefaultFlowTTL = 10 * time.Minute
	// DefaultMaxPendingFlows bounds in-process state retained by one instance.
	DefaultMaxPendingFlows = 4096
	// MaximumPendingFlows is the hard configuration limit.
	MaximumPendingFlows = 65536
)

Functions

func Module

func Module(options Options) (module.Registration, error)

Module validates and copies configuration without network or database side effects. Provider discovery and principal checks occur during lifecycle startup, before the browser-authentication capability is published.

Types

type Options

type Options struct {
	IssuerURL       string
	ClientID        string
	ClientSecret    string
	RedirectURL     string
	Scopes          []string
	SubjectMappings []SubjectMapping
	FlowTTL         time.Duration
	MaxPendingFlows int
	// AllowInsecureHTTP permits HTTP issuer and redirect URLs for an explicitly
	// isolated local/test environment. Production should always leave it false.
	AllowInsecureHTTP bool
	// HTTPClient optionally supplies trusted proxy/TLS behavior. The component
	// clones it and still enforces bounded upstream response bodies.
	HTTPClient *http.Client
}

Options is one explicit OIDC trust configuration. Issuer discovery, signature verification, audience verification, nonce, state, and PKCE S256 are mandatory. ClientSecret may be empty for a public client.

type SubjectMapping

type SubjectMapping struct {
	Subject   string
	ActorID   string
	ActorType string
}

SubjectMapping binds one exact provider subject to one already-provisioned Modary principal. ActorType is checked again on every completed login so a principal type change cannot silently inherit the old mapping.