oidc_auth

Aug 4, 2023

Changes in this version

+ const AuthMethodCert

+ const AuthMethodExtJwt

+ const AuthMethodPassword

+ const AuthMethodSecondaryExtJwt

+ const AuthMethodSecondaryTotp

+ const ClaimAudienceOpenZiti

+ const CustomClaimApiSessionId

+ const CustomClaimExternalId

+ const CustomClaimIsAdmin

+ const CustomClaimsCertFingerprints

+ const CustomClaimsConfigTypes

+ const DefaultAccessTokenDuration

+ const DefaultIdTokenDuration

+ const DefaultNativeClientId

+ const DefaultRefreshTokenDuration

+ const JwtTokenPrefix

+ const ScopeApiSessionId

+ const ScopeTokenId

+ const SourceTypeOidc

+ const TokenTypeAccess

+ const TokenTypeRefresh

+ const WellKnownOidcConfiguration

+ func HttpRequestFromContext(ctx context.Context) (*http.Request, error)

+ func NewChangeCtx() *change.Context

+ func NewHttpChangeCtx(r *http.Request) *change.Context

+ func NewNativeOnlyOP(ctx context.Context, env model.Env, config Config) (http.Handler, error)

+ func NewRevocation(tokenId string, expiresAt time.Time) *model.Revocation

+ type AccessClaims struct

+ func (c *AccessClaims) TotpComplete() bool

+ func (r *AccessClaims) GetAudience() (jwt.ClaimStrings, error)

+ func (r *AccessClaims) GetExpirationTime() (*jwt.NumericDate, error)

+ func (r *AccessClaims) GetIssuedAt() (*jwt.NumericDate, error)

+ func (r *AccessClaims) GetIssuer() (string, error)

+ func (r *AccessClaims) GetNotBefore() (*jwt.NumericDate, error)

+ func (r *AccessClaims) GetSubject() (string, error)

+ type AuthRequest struct

+ Amr map[string]struct{}

+ ApiSessionId string

+ AuthTime time.Time

+ BearerTokenDetected bool

+ ConfigTypes []string

+ CreationDate time.Time

+ Id string

+ IdentityId string

+ PeerCerts []*x509.Certificate

+ RequestedMethod string

+ SecondaryExtJwtId string

+ SecondaryExtJwtRequired bool

+ SecondaryTotpRequired bool

+ func (a *AuthRequest) AddAmr(amr string)

+ func (a *AuthRequest) Done() bool

+ func (a *AuthRequest) GetACR() string

+ func (a *AuthRequest) GetAMR() []string

+ func (a *AuthRequest) GetAudience() []string

+ func (a *AuthRequest) GetAuthTime() time.Time

+ func (a *AuthRequest) GetCertFingerprints() []string

+ func (a *AuthRequest) GetClientID() string

+ func (a *AuthRequest) GetCodeChallenge() *oidc.CodeChallenge

+ func (a *AuthRequest) GetID() string

+ func (a *AuthRequest) GetNonce() string

+ func (a *AuthRequest) GetRedirectURI() string

+ func (a *AuthRequest) GetResponseMode() oidc.ResponseMode

+ func (a *AuthRequest) GetResponseType() oidc.ResponseType

+ func (a *AuthRequest) GetScopes() []string

+ func (a *AuthRequest) GetState() string

+ func (a *AuthRequest) GetSubject() string

+ func (a *AuthRequest) HasAmr(amr string) bool

+ func (a *AuthRequest) HasFullAuth() bool

+ func (a *AuthRequest) HasPrimaryAuth() bool

+ func (a *AuthRequest) HasSecondaryAuth() bool

+ type Client struct

+ func NativeClient(id string, redirectURIs, postlogoutURIs []string) *Client

+ func (c *Client) AccessTokenType() op.AccessTokenType

+ func (c *Client) ApplicationType() op.ApplicationType

+ func (c *Client) AuthMethod() oidc.AuthMethod

+ func (c *Client) ClockSkew() time.Duration

+ func (c *Client) DevMode() bool

+ func (c *Client) GetID() string

+ func (c *Client) GrantTypes() []oidc.GrantType

+ func (c *Client) IDTokenLifetime() time.Duration

+ func (c *Client) IDTokenUserinfoClaimsAssertion() bool

+ func (c *Client) IsScopeAllowed(_ string) bool

+ func (c *Client) LoginURL(id string) string

+ func (c *Client) PostLogoutRedirectURIs() []string

+ func (c *Client) RedirectURIs() []string

+ func (c *Client) ResponseTypes() []oidc.ResponseType

+ func (c *Client) RestrictAdditionalAccessTokenScopes() func(scopes []string) []string

+ func (c *Client) RestrictAdditionalIdTokenScopes() func(scopes []string) []string

+ type Config struct

+ AccessTokenDuration time.Duration

+ Certificate *x509.Certificate

+ IdTokenDuration time.Duration

+ Issuer string

+ PostLogoutURIs []string

+ PrivateKey crypto.PrivateKey

+ RedirectURIs []string

+ RefreshTokenDuration time.Duration

+ Storage Storage

+ TokenSecret string

+ func NewConfig(issuer string, cert *x509.Certificate, key crypto.PrivateKey) Config

+ func (c *Config) MaxTokenDuration() time.Duration

+ func (c *Config) Secret() [32]byte

+ type CustomClaims struct

+ ApiSessionId string

+ ApplicationId string

+ CertFingerprints []string

+ ConfigTypes []string

+ ExternalId string

+ IsAdmin bool

+ Scopes []string

+ Type string

+ type HybridStorage struct

+ func NewStorage(kid string, publicKey crypto.PublicKey, privateKey crypto.PrivateKey, ...) *HybridStorage

+ func (s *HybridStorage) AddClient(client *Client)

+ func (s *HybridStorage) AuthRequestByCode(ctx context.Context, code string) (op.AuthRequest, error)

+ func (s *HybridStorage) AuthRequestByID(_ context.Context, id string) (op.AuthRequest, error)

+ func (s *HybridStorage) AuthRequestDone(id string) error

+ func (s *HybridStorage) Authenticate(authCtx model.AuthContext, id string, configTypes []string) (*AuthRequest, error)

+ func (s *HybridStorage) AuthorizeClientIDSecret(_ context.Context, clientID, clientSecret string) error

+ func (s *HybridStorage) Clean()

+ func (s *HybridStorage) ClientCredentials(_ context.Context, clientID, clientSecret string) (op.Client, error)

+ func (s *HybridStorage) ClientCredentialsTokenRequest(_ context.Context, clientID string, scopes []string) (op.TokenRequest, error)

+ func (s *HybridStorage) CompleteDeviceAuthorization(_ context.Context, userCode, subject string) error

+ func (s *HybridStorage) CreateAccessAndRefreshTokens(_ context.Context, request op.TokenRequest, currentRefreshToken string) (accessTokenID string, newRefreshToken string, expiration time.Time, err error)

+ func (s *HybridStorage) CreateAccessToken(_ context.Context, request op.TokenRequest) (string, time.Time, error)

+ func (s *HybridStorage) CreateAuthRequest(ctx context.Context, authReq *oidc.AuthRequest, identityId string) (op.AuthRequest, error)

+ func (s *HybridStorage) CreateTokenExchangeRequest(_ context.Context, _ op.TokenExchangeRequest) error

+ func (s *HybridStorage) DeleteAuthRequest(_ context.Context, id string) error

+ func (s *HybridStorage) DenyDeviceAuthorization(_ context.Context, userCode string) error

+ func (s *HybridStorage) GetAuthRequest(id string) (*AuthRequest, error)

+ func (s *HybridStorage) GetClientByClientID(_ context.Context, clientID string) (op.Client, error)

+ func (s *HybridStorage) GetDeviceAuthorizationByUserCode(_ context.Context, userCode string) (*op.DeviceAuthorizationState, error)

+ func (s *HybridStorage) GetDeviceAuthorizatonState(ctx context.Context, clientID, deviceCode string) (*op.DeviceAuthorizationState, error)

+ func (s *HybridStorage) GetKeyByIDAndClientID(_ context.Context, keyID, _ string) (*jose.JSONWebKey, error)

+ func (s *HybridStorage) GetPrivateClaimsFromScopes(ctx context.Context, identityId, clientID string, scopes []string) (claims map[string]interface{}, err error)

+ func (s *HybridStorage) GetPrivateClaimsFromTokenExchangeRequest(ctx context.Context, request op.TokenExchangeRequest) (claims map[string]interface{}, err error)

+ func (s *HybridStorage) GetRefreshTokenInfo(_ context.Context, _ string, token string) (identityId string, tokenID string, err error)

+ func (s *HybridStorage) Health(_ context.Context) error

+ func (s *HybridStorage) IsTokenRevoked(tokenId string) bool

+ func (s *HybridStorage) KeySet(_ context.Context) ([]op.Key, error)

+ func (s *HybridStorage) RevokeToken(_ context.Context, tokenIDOrToken string, _ string, _ string) *oidc.Error

+ func (s *HybridStorage) SaveAuthCode(_ context.Context, id string, code string) error

+ func (s *HybridStorage) SetIntrospectionFromToken(_ context.Context, _ *oidc.IntrospectionResponse, _, _, _ string) error

+ func (s *HybridStorage) SetUserinfoFromRequest(_ context.Context, userinfo *oidc.UserInfo, token op.IDTokenRequest, ...) error

+ func (s *HybridStorage) SetUserinfoFromScopes(_ context.Context, _ *oidc.UserInfo, _, _ string, _ []string) error

+ func (s *HybridStorage) SetUserinfoFromToken(ctx context.Context, userinfo *oidc.UserInfo, tokenID, subject, _ string) error

+ func (s *HybridStorage) SetUserinfoFromTokenExchangeRequest(ctx context.Context, userinfo *oidc.UserInfo, request op.TokenExchangeRequest) error

+ func (s *HybridStorage) SignatureAlgorithms(context.Context) ([]jose.SignatureAlgorithm, error)

+ func (s *HybridStorage) SigningKey(_ context.Context) (op.SigningKey, error)

+ func (s *HybridStorage) StoreDeviceAuthorization(_ context.Context, clientID, deviceCode, userCode string, expires time.Time, ...) error

+ func (s *HybridStorage) TerminateSession(_ context.Context, identityId string, clientID string) error

+ func (s *HybridStorage) TokenRequestByRefreshToken(_ context.Context, refreshToken string) (op.RefreshTokenRequest, error)

+ func (s *HybridStorage) ValidateJWTProfileScopes(_ context.Context, _ string, scopes []string) ([]string, error)

+ func (s *HybridStorage) ValidateTokenExchangeRequest(_ context.Context, request op.TokenExchangeRequest) error

+ func (s *HybridStorage) VerifyTotp(ctx *change.Context, code string, id string) (*AuthRequest, error)

+ type IdTokenClaims struct

+ func (c *IdTokenClaims) TotpComplete() bool

+ type RefreshClaims struct

+ func (c *RefreshClaims) MarshalJSON() ([]byte, error)

+ func (c *RefreshClaims) UnmarshalJSON(data []byte) error

+ func (r *RefreshClaims) GetAudience() (jwt.ClaimStrings, error)

+ func (r *RefreshClaims) GetExpirationTime() (*jwt.NumericDate, error)

+ func (r *RefreshClaims) GetIssuedAt() (*jwt.NumericDate, error)

+ func (r *RefreshClaims) GetIssuer() (string, error)

+ func (r *RefreshClaims) GetNotBefore() (*jwt.NumericDate, error)

+ func (r *RefreshClaims) GetSubject() (string, error)

+ type RefreshTokenRequest struct

+ func (r *RefreshTokenRequest) GetAMR() []string

+ func (r *RefreshTokenRequest) GetAudience() []string

+ func (r *RefreshTokenRequest) GetAuthTime() time.Time

+ func (r *RefreshTokenRequest) GetCertFingerprints() []string

+ func (r *RefreshTokenRequest) GetClientID() string

+ func (r *RefreshTokenRequest) GetScopes() []string

+ func (r *RefreshTokenRequest) GetSubject() string

+ func (r *RefreshTokenRequest) SetCurrentScopes(scopes []string)

+ type Storage interface

+ AddClient func(client *Client)

+ Authenticate func(authCtx model.AuthContext, id string, configTypes []string) (*AuthRequest, error)

+ GetAuthRequest func(id string) (*AuthRequest, error)

+ IsTokenRevoked func(tokenId string) bool

+ VerifyTotp func(ctx *change.Context, code string, id string) (*AuthRequest, error)