providers

package
v4.2.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 11, 2020 License: MIT Imports: 29 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AzureProvider

type AzureProvider struct {
	*ProviderData
	Tenant string
}

AzureProvider represents an Azure based Identity Provider

func NewAzureProvider

func NewAzureProvider(p *ProviderData) *AzureProvider

NewAzureProvider initiates a new AzureProvider

func (*AzureProvider) Configure

func (p *AzureProvider) Configure(tenant string)

Configure defaults the AzureProvider configuration options

func (*AzureProvider) GetEmailAddress

func (p *AzureProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*AzureProvider) GetLoginURL

func (p *AzureProvider) GetLoginURL(redirectURI, state string) string

GetLoginURL with Azure specific OAuth2 parameters

func (*AzureProvider) Redeem

func (p *AzureProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem an Azure OAuth2 token

func (*AzureProvider) RefreshSessionIfNeeded

func (p *AzureProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error)

RefreshSessionIfNeeded checks if the session has expired and uses the RefreshToken to fetch a new ID token if required

type BitbucketProvider

type BitbucketProvider struct {
	*ProviderData
	Team       string
	Repository string
}

BitbucketProvider represents an Bitbucket based Identity Provider

func NewBitbucketProvider

func NewBitbucketProvider(p *ProviderData) *BitbucketProvider

NewBitbucketProvider initiates a new BitbucketProvider

func (*BitbucketProvider) GetEmailAddress

func (p *BitbucketProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the email of the authenticated user

func (*BitbucketProvider) SetRepository

func (p *BitbucketProvider) SetRepository(repository string)

SetRepository defines the repository the user must have access to

func (*BitbucketProvider) SetTeam

func (p *BitbucketProvider) SetTeam(team string)

SetTeam defines the Bitbucket team the user must be part of

type FacebookProvider

type FacebookProvider struct {
	*ProviderData
}

FacebookProvider represents an Facebook based Identity Provider

func NewFacebookProvider

func NewFacebookProvider(p *ProviderData) *FacebookProvider

NewFacebookProvider initiates a new FacebookProvider

func (*FacebookProvider) GetEmailAddress

func (p *FacebookProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*FacebookProvider) ValidateSessionState

func (p *FacebookProvider) ValidateSessionState(s *sessions.SessionState) bool

ValidateSessionState validates the AccessToken

type GitHubProvider

type GitHubProvider struct {
	*ProviderData
	Org  string
	Team string
}

GitHubProvider represents an GitHub based Identity Provider

func NewGitHubProvider

func NewGitHubProvider(p *ProviderData) *GitHubProvider

NewGitHubProvider initiates a new GitHubProvider

func (*GitHubProvider) GetEmailAddress

func (p *GitHubProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*GitHubProvider) GetUserName

func (p *GitHubProvider) GetUserName(s *sessions.SessionState) (string, error)

GetUserName returns the Account user name

func (*GitHubProvider) SetOrgTeam

func (p *GitHubProvider) SetOrgTeam(org, team string)

SetOrgTeam adds GitHub org reading parameters to the OAuth2 scope

type GitLabProvider

type GitLabProvider struct {
	*ProviderData

	Group        string
	EmailDomains []string

	Verifier             *oidc.IDTokenVerifier
	AllowUnverifiedEmail bool
}

GitLabProvider represents a GitLab based Identity Provider

func NewGitLabProvider

func NewGitLabProvider(p *ProviderData) *GitLabProvider

NewGitLabProvider initiates a new GitLabProvider

func (*GitLabProvider) GetEmailAddress

func (p *GitLabProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*GitLabProvider) GetUserName

func (p *GitLabProvider) GetUserName(s *sessions.SessionState) (string, error)

GetUserName returns the Account user name

func (*GitLabProvider) Redeem

func (p *GitLabProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem exchanges the OAuth2 authentication token for an ID token

func (*GitLabProvider) RefreshSessionIfNeeded

func (p *GitLabProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error)

RefreshSessionIfNeeded checks if the session has expired and uses the RefreshToken to fetch a new ID token if required

func (*GitLabProvider) ValidateSessionState

func (p *GitLabProvider) ValidateSessionState(s *sessions.SessionState) bool

ValidateSessionState checks that the session's IDToken is still valid

type GoogleProvider

type GoogleProvider struct {
	*ProviderData
	RedeemRefreshURL *url.URL
	// GroupValidator is a function that determines if the passed email is in
	// the configured Google group.
	GroupValidator func(string) bool
}

GoogleProvider represents an Google based Identity Provider

func NewGoogleProvider

func NewGoogleProvider(p *ProviderData) *GoogleProvider

NewGoogleProvider initiates a new GoogleProvider

func (*GoogleProvider) Redeem

func (p *GoogleProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem exchanges the OAuth2 authentication token for an ID token

func (*GoogleProvider) RefreshSessionIfNeeded

func (p *GoogleProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error)

RefreshSessionIfNeeded checks if the session has expired and uses the RefreshToken to fetch a new ID token if required

func (*GoogleProvider) SetGroupRestriction

func (p *GoogleProvider) SetGroupRestriction(groups []string, adminEmail string, credentialsReader io.Reader)

SetGroupRestriction configures the GoogleProvider to restrict access to the specified group(s). AdminEmail has to be an administrative email on the domain that is checked. CredentialsFile is the path to a json file containing a Google service account credentials.

func (*GoogleProvider) ValidateGroup

func (p *GoogleProvider) ValidateGroup(email string) bool

ValidateGroup validates that the provided email exists in the configured Google group(s).

type LinkedInProvider

type LinkedInProvider struct {
	*ProviderData
}

LinkedInProvider represents an LinkedIn based Identity Provider

func NewLinkedInProvider

func NewLinkedInProvider(p *ProviderData) *LinkedInProvider

NewLinkedInProvider initiates a new LinkedInProvider

func (*LinkedInProvider) GetEmailAddress

func (p *LinkedInProvider) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*LinkedInProvider) ValidateSessionState

func (p *LinkedInProvider) ValidateSessionState(s *sessions.SessionState) bool

ValidateSessionState validates the AccessToken

type LoginGovProvider

type LoginGovProvider struct {
	*ProviderData

	// TODO (@timothy-spencer): Ideally, the nonce would be in the session state, but the session state
	// is created only upon code redemption, not during the auth, when this must be supplied.
	Nonce     string
	AcrValues string
	JWTKey    *rsa.PrivateKey
	PubJWKURL *url.URL
}

LoginGovProvider represents an OIDC based Identity Provider

func NewLoginGovProvider

func NewLoginGovProvider(p *ProviderData) *LoginGovProvider

NewLoginGovProvider initiates a new LoginGovProvider

func (*LoginGovProvider) GetLoginURL

func (p *LoginGovProvider) GetLoginURL(redirectURI, state string) string

GetLoginURL overrides GetLoginURL to add login.gov parameters

func (*LoginGovProvider) Redeem

func (p *LoginGovProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem exchanges the OAuth2 authentication token for an ID token

type OIDCProvider

type OIDCProvider struct {
	*ProviderData

	Verifier             *oidc.IDTokenVerifier
	AllowUnverifiedEmail bool
}

OIDCProvider represents an OIDC based Identity Provider

func NewOIDCProvider

func NewOIDCProvider(p *ProviderData) *OIDCProvider

NewOIDCProvider initiates a new OIDCProvider

func (*OIDCProvider) Redeem

func (p *OIDCProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem exchanges the OAuth2 authentication token for an ID token

func (*OIDCProvider) RefreshSessionIfNeeded

func (p *OIDCProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error)

RefreshSessionIfNeeded checks if the session has expired and uses the RefreshToken to fetch a new ID token if required

func (*OIDCProvider) ValidateSessionState

func (p *OIDCProvider) ValidateSessionState(s *sessions.SessionState) bool

ValidateSessionState checks that the session's IDToken is still valid

type Provider

type Provider interface {
	Data() *ProviderData
	GetEmailAddress(*sessions.SessionState) (string, error)
	GetUserName(*sessions.SessionState) (string, error)
	Redeem(string, string) (*sessions.SessionState, error)
	ValidateGroup(string) bool
	ValidateSessionState(*sessions.SessionState) bool
	GetLoginURL(redirectURI, finalRedirect string) string
	RefreshSessionIfNeeded(*sessions.SessionState) (bool, error)
	SessionFromCookie(string, *encryption.Cipher) (*sessions.SessionState, error)
	CookieForSession(*sessions.SessionState, *encryption.Cipher) (string, error)
}

Provider represents an upstream identity provider implementation

func New

func New(provider string, p *ProviderData) Provider

New provides a new Provider based on the configured provider string

type ProviderData

type ProviderData struct {
	ProviderName      string
	ClientID          string
	ClientSecret      string
	LoginURL          *url.URL
	RedeemURL         *url.URL
	ProfileURL        *url.URL
	ProtectedResource *url.URL
	ValidateURL       *url.URL
	Scope             string
	ApprovalPrompt    string
}

ProviderData contains information required to configure all implementations of OAuth2 providers

func (*ProviderData) CookieForSession

func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error)

CookieForSession serializes a session state for storage in a cookie

func (*ProviderData) Data

func (p *ProviderData) Data() *ProviderData

Data returns the ProviderData

func (*ProviderData) GetEmailAddress

func (p *ProviderData) GetEmailAddress(s *sessions.SessionState) (string, error)

GetEmailAddress returns the Account email address

func (*ProviderData) GetLoginURL

func (p *ProviderData) GetLoginURL(redirectURI, state string) string

GetLoginURL with typical oauth parameters

func (*ProviderData) GetUserName

func (p *ProviderData) GetUserName(s *sessions.SessionState) (string, error)

GetUserName returns the Account username

func (*ProviderData) Redeem

func (p *ProviderData) Redeem(redirectURL, code string) (s *sessions.SessionState, err error)

Redeem provides a default implementation of the OAuth2 token redemption process

func (*ProviderData) RefreshSessionIfNeeded

func (p *ProviderData) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error)

RefreshSessionIfNeeded should refresh the user's session if required and do nothing if a refresh is not required

func (*ProviderData) SessionFromCookie

func (p *ProviderData) SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error)

SessionFromCookie deserializes a session from a cookie value

func (*ProviderData) ValidateGroup

func (p *ProviderData) ValidateGroup(email string) bool

ValidateGroup validates that the provided email exists in the configured provider email group(s).

func (*ProviderData) ValidateSessionState

func (p *ProviderData) ValidateSessionState(s *sessions.SessionState) bool

ValidateSessionState validates the AccessToken

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL