oidc

Documentation

Index

• type Claims
• type GoogleAuth
  • func NewGoogleAuth(ctx context.Context, cfg GoogleAuthConfig) (*GoogleAuth, error)
  • func (g *GoogleAuth) Verify(ctx context.Context, rawIDToken string) (*Claims, error)
• type GoogleAuthConfig
• type Verifier

Types

type Claims

type Claims struct {
	// Provider is the login method these claims came from, e.g. "google".
	Provider string
	// Subject is the provider's stable, unique identifier for the user (sub).
	Subject string
	Email   string
	// EmailVerified reports whether the provider vouches for the email.
	EmailVerified bool
	Name          string
	Picture       string
}

Claims are the normalized identity claims extracted from a verified ID token.

type GoogleAuth

type GoogleAuth struct {
	// contains filtered or unexported fields
}

GoogleAuth verifies Google-issued ID tokens against Google's JWKS.

func NewGoogleAuth

func NewGoogleAuth(ctx context.Context, cfg GoogleAuthConfig) (*GoogleAuth, error)

NewGoogleAuth builds a GoogleAuth for Google ID tokens. The config's ClientIDs are the OAuth clients whose tokens are accepted — a token is valid if its audience matches any of them (e.g. the Desktop client for the CLI and the Web client for the site). Audience is checked manually because go-oidc only supports a single ClientID. It performs OIDC discovery against Google, so it needs network at construction time.

func (*GoogleAuth) Verify

func (g *GoogleAuth) Verify(ctx context.Context, rawIDToken string) (*Claims, error)

type GoogleAuthConfig

type GoogleAuthConfig struct {
	Issuer    string   `envconfig:"GOOGLE_ISSUER" default:"https://accounts.google.com"`
	ClientIDs []string `envconfig:"GOOGLE_CLIENT_ID"`
}

GoogleAuthConfig holds the configuration for Google OIDC verification.

type Verifier

type Verifier interface {
	Verify(ctx context.Context, rawIDToken string) (*Claims, error)
}

Verifier validates a raw ID token and returns its normalized claims.