oauth2

Documentation

Overview

Package oauth2 provides OAuth2/OIDC authentication using the golang.org/x/oauth2 and coreos/go-oidc libraries.

It implements the usermgmt.OAuth2Provider interface via structural typing — no import of the core usermgmt package is required. Consumers inject a *Provider into usermgmt.ServiceConfig.OAuth2 to enable OAuth2/OIDC login with external identity providers (Google, GitHub, Microsoft, etc.).

Index

• type Config
• type Provider
  • func New(ctx context.Context, config Config) (*Provider, error)
  • func (p *Provider) BeginLogin(_ context.Context, providerName, state string) (string, string, error)
  • func (p *Provider) FinishLogin(ctx context.Context, providerName, code, pkceVerifier string) ([]byte, error)
  • func (p *Provider) Names() []string
• type ProviderConfig
  • func (c ProviderConfig) Validate() error

Types

type Config

type Config struct {
	Providers map[string]ProviderConfig
}

Config configures multi-provider OAuth2/OIDC authentication.

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider manages multiple OAuth2/OIDC providers and implements the usermgmt.OAuth2Provider interface via structural typing.

func New

func New(ctx context.Context, config Config) (*Provider, error)

New initializes all configured providers (performing OIDC discovery if needed) and returns a Provider ready for use.

func (*Provider) BeginLogin

func (p *Provider) BeginLogin(_ context.Context, providerName, state string) (string, string, error)

BeginLogin generates PKCE and builds the authorization URL for the given provider. state is the CSRF state token (generated by the Service). Returns the redirect URL and PKCE verifier (stored by the Service).

func (*Provider) FinishLogin

func (p *Provider) FinishLogin(ctx context.Context, providerName, code, pkceVerifier string) ([]byte, error)

FinishLogin exchanges the authorization code for tokens and extracts user info. Returns the user info as JSON (subject, email, email_verified, display_name).

func (*Provider) Names

func (p *Provider) Names() []string

Names returns the sorted names of all configured providers. Used by consumers to auto-discover which OAuth2/OIDC providers are available (e.g. to auto-populate sign-in buttons).

type ProviderConfig

type ProviderConfig struct {
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string
	IssuerURL    string
	AuthURL      string
	TokenURL     string
	UserInfoURL  string
}

ProviderConfig configures a single OAuth2/OIDC identity provider.

For OIDC providers (Google, Microsoft, etc.), set IssuerURL — the provider's discovery endpoint will be queried at startup to fill in endpoints automatically.

For pure OAuth2 providers (GitHub without OIDC), set AuthURL, TokenURL, and UserInfoURL explicitly.

func (ProviderConfig) Validate

func (c ProviderConfig) Validate() error

Validate returns an error if the configuration is incomplete or inconsistent.