oauth2

Documentation

Index

• Variables
• type Client
  • func New(ctx context.Context, logger *slog.Logger, conf config.Config, ...) (*Client, error)
  • func (c Client) ClientDisconnect(ctx context.Context, logger *slog.Logger, client connection.Client)
  • func (c Client) OAuth2Callback() http.Handler
  • func (c Client) OAuth2Start() http.Handler
  • func (c Client) OAuthConfig() *oauth2.Config
  • func (c Client) RefreshClientAuth(ctx context.Context, logger *slog.Logger, client connection.Client) (bool, error)
• type Provider

Variables

var (
	ErrMismatch                     = errors.New("mismatch")
	ErrMissingClaim                 = errors.New("missing claim")
	ErrMissingRequiredRole          = errors.New("missing required role")
	ErrMissingRequiredGroup         = errors.New("missing required group")
	ErrMissingToken                 = errors.New("no tokens provided")
	ErrAuthAndTokenEndpointRequired = errors.New("both oauth2.endpoints.tokenUrl and oauth2.endpoints.authUrl are required")
	ErrNoRefreshToken               = errors.New("no refresh token received from provider")

	ErrClientRejected = errors.New("client rejected")
)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, logger *slog.Logger, conf config.Config, httpClient *http.Client, tokenStorage tokenstorage.Storage,
	provider Provider, openvpn openvpnManagementClient,
) (*Client, error)

New returns a Client instance.

func (Client) ClientDisconnect

func (c Client) ClientDisconnect(ctx context.Context, logger *slog.Logger, client connection.Client)

ClientDisconnect purges the refresh token from the tokenstorage.Storage.

func (Client) OAuth2Callback

func (c Client) OAuth2Callback() http.Handler

OAuth2Callback returns a http.Handler that handles the OAuth2 callback.

func (Client) OAuth2Start

func (c Client) OAuth2Start() http.Handler

OAuth2Start returns a http.Handler that starts the OAuth2 authorization flow. It checks if the request has a valid state GET parameter generated by state.New. Optionally, it checks the HTTP client IP address against the VPN IP address. After the checks, the request is delegated to rp.AuthURLHandler.

func (Client) OAuthConfig

func (c Client) OAuthConfig() *oauth2.Config

OAuthConfig returns the underlying oauth2.Config used by the relying party. It is primarily exposed for tests that need direct access to the client configuration.

func (Client) RefreshClientAuth

func (c Client) RefreshClientAuth(ctx context.Context, logger *slog.Logger, client connection.Client) (bool, error)

RefreshClientAuth initiate a non-interactive authentication against the sso provider.

type Provider

type Provider interface {
	CheckUser(ctx context.Context, session state.State, user types.UserData, tokens *oidc.Tokens[*idtoken.Claims]) error
	GetProviderConfig() (types.ProviderConfig, error)
	GetName() string
	GetRefreshToken(tokens *oidc.Tokens[*idtoken.Claims]) (string, error)
	GetUser(ctx context.Context, logger *slog.Logger, tokens *oidc.Tokens[*idtoken.Claims]) (types.UserData, error)

	// Refresh initiates a non-interactive authentication against the sso provider.
	Refresh(ctx context.Context, logger *slog.Logger, relyingParty rp.RelyingParty, refreshToken string) (*oidc.Tokens[*idtoken.Claims], error)
	RevokeRefreshToken(ctx context.Context, logger *slog.Logger, relyingParty rp.RelyingParty, refreshToken string) error
}