Documentation

Index

Constants

View Source
const (
	LoginPath    = "/oauth2/auth/requests/login"
	ConsentPath  = "/oauth2/auth/requests/consent"
	LogoutPath   = "/oauth2/auth/requests/logout"
	SessionsPath = "/oauth2/auth/sessions"
)
View Source
const (
	CookieAuthenticationName    = "oauth2_authentication_session"
	CookieAuthenticationSIDName = "sid"
)

Variables

View Source
var ErrAbortOAuth2Request = errors.New("the OAuth 2.0 Authorization request must be aborted")
View Source
var ErrHintDoesNotMatchAuthentication = errors.New("subject from hint does not match subject from session")
View Source
var ErrNoAuthenticationSessionFound = errors.New("no previous login session was found")
View Source
var ErrNoPreviousConsentFound = errors.New("no previous OAuth 2.0 Consent could be found for this access request")

Functions

func CookieName

func CookieName(secure bool, name string) string

func ManagerTests

func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.FositeStorer) func(t *testing.T)

func MockAuthRequest

func MockAuthRequest(key string, authAt bool) (c *LoginRequest, h *HandledLoginRequest)

func MockConsentRequest

func MockConsentRequest(key string, remember bool, rememberFor int, hasError bool, skip bool, authAt bool) (c *ConsentRequest, h *HandledConsentRequest)

Types

type ConsentRequest

type ConsentRequest struct {
	// ID is the identifier ("authorization challenge") of the consent authorization request. It is used to
	// identify the session.
	//
	// required: true
	ID string `json:"challenge" db:"challenge"`

	// RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
	RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`

	// RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
	RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`

	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
	// If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the
	// consent request using the usual API call.
	Skip bool `json:"skip" db:"skip"`

	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
	// requested by the OAuth 2.0 client.
	Subject string `json:"subject" db:"subject"`

	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`

	// Client is the OAuth 2.0 Client that initiated the request.
	Client   *client.Client `json:"client" db:"-"`
	ClientID string         `json:"-" db:"client_id"`

	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
	// might come in handy if you want to deal with additional request parameters.
	RequestURL string `json:"request_url" db:"request_url"`

	// LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate
	// a login and consent request in the login & consent app.
	LoginChallenge sqlxx.NullString `json:"login_challenge" db:"login_challenge"`

	// LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
	// this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
	// this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
	// channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
	LoginSessionID sqlxx.NullString `json:"login_session_id" db:"login_session_id"`

	// ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
	// to express that, for example, a user authenticated using two factor authentication.
	ACR string `json:"acr" db:"acr"`

	// Context contains arbitrary information set by the login endpoint or is empty if not set.
	Context sqlxx.JSONRawMessage `json:"context,omitempty" db:"context"`

	// ForceSubjectIdentifier is the value from authentication (if set).
	ForceSubjectIdentifier string         `json:"-" db:"forced_subject_identifier"`
	SubjectIdentifier      string         `json:"-" db:"-"`
	Verifier               string         `json:"-" db:"verifier"`
	CSRF                   string         `json:"-" db:"csrf"`
	AuthenticatedAt        sqlxx.NullTime `json:"-" db:"authenticated_at"`
	RequestedAt            time.Time      `json:"-" db:"requested_at"`
	WasHandled             bool           `json:"-" db:"was_handled,r"`
}

    Contains information on an ongoing consent request.

    swagger:model consentRequest

    func SaneMockConsentRequest

    func SaneMockConsentRequest(t *testing.T, m Manager, ar *LoginRequest, skip bool) (c *ConsentRequest)

      SaneMockConsentRequest does the same thing as MockConsentRequest but uses less insanity and implicit dependencies.

      func (*ConsentRequest) AfterFind

      func (r *ConsentRequest) AfterFind(c *pop.Connection) error

      func (*ConsentRequest) BeforeSave

      func (r *ConsentRequest) BeforeSave(_ *pop.Connection) error

      func (*ConsentRequest) FindInDB

      func (r *ConsentRequest) FindInDB(c *pop.Connection, id string) error

      func (ConsentRequest) TableName

      func (_ ConsentRequest) TableName() string

      type ConsentRequestSessionData

      type ConsentRequestSessionData struct {
      	// AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the
      	// refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.
      	// If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties
      	// can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
      	AccessToken map[string]interface{} `json:"access_token"`
      
      	// IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable
      	// by anyone that has access to the ID Challenge. Use with care!
      	IDToken map[string]interface{} `json:"id_token"`
      }

        Used to pass session data to a consent request.

        swagger:model consentRequestSession

        func NewConsentRequestSessionData

        func NewConsentRequestSessionData() *ConsentRequestSessionData

        type DefaultStrategy

        type DefaultStrategy struct {
        	// contains filtered or unexported fields
        }

        func NewStrategy

        func NewStrategy(
        	r InternalRegistry,
        	c *config.Provider,
        ) *DefaultStrategy

        func (*DefaultStrategy) HandleOAuth2AuthorizationRequest

        func (s *DefaultStrategy) HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)

        func (*DefaultStrategy) HandleOpenIDConnectLogout

        func (s *DefaultStrategy) HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)

        type ForcedObfuscatedLoginSession

        type ForcedObfuscatedLoginSession struct {
        	ClientID          string `db:"client_id"`
        	Subject           string `db:"subject"`
        	SubjectObfuscated string `db:"subject_obfuscated"`
        }

        func (*ForcedObfuscatedLoginSession) TableName

        func (_ *ForcedObfuscatedLoginSession) TableName() string

        type HandledConsentRequest

        type HandledConsentRequest struct {
        	// ID instead of Challenge because of pop
        	ID string `json:"-" db:"challenge"`
        
        	// GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
        	GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`
        
        	// GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
        	GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`
        
        	// Session allows you to set (optional) session data for access and ID tokens.
        	Session *ConsentRequestSessionData `json:"session" db:"-"`
        
        	// Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
        	// client asks the same user for the same, or a subset of, scope.
        	Remember bool `json:"remember" db:"remember"`
        
        	// RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
        	// authorization will be remembered indefinitely.
        	RememberFor int `json:"remember_for" db:"remember_for"`
        
        	// HandledAt contains the timestamp the consent request was handled.
        	HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`
        
        	ConsentRequest  *ConsentRequest     `json:"-" db:"-"`
        	Error           *RequestDeniedError `json:"-" db:"error"`
        	RequestedAt     time.Time           `json:"-" db:"requested_at"`
        	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
        	WasUsed         bool                `json:"-" db:"was_used"`
        
        	SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
        	SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
        }

          The request payload used to accept a consent request.

          swagger:model acceptConsentRequest

          func SaneMockHandleConsentRequest

          func SaneMockHandleConsentRequest(t *testing.T, m Manager, c *ConsentRequest, authAt time.Time, rememberFor int, remember bool, hasError bool) *HandledConsentRequest

          func (*HandledConsentRequest) AfterFind

          func (r *HandledConsentRequest) AfterFind(c *pop.Connection) error

          func (*HandledConsentRequest) AfterSave

          func (r *HandledConsentRequest) AfterSave(c *pop.Connection) error

          func (*HandledConsentRequest) BeforeSave

          func (r *HandledConsentRequest) BeforeSave(_ *pop.Connection) error

          func (*HandledConsentRequest) HasError

          func (r *HandledConsentRequest) HasError() bool

          func (HandledConsentRequest) TableName

          func (_ HandledConsentRequest) TableName() string

          type HandledLoginRequest

          type HandledLoginRequest struct {
          	// ID instead of challenge for pop
          	ID string `json:"-" db:"challenge"`
          
          	// Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store
          	// a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she
          	// will not be asked to log in again.
          	Remember bool `json:"remember" db:"remember"`
          
          	// RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the
          	// authorization will be remembered for the duration of the browser session (using a session cookie).
          	RememberFor int `json:"remember_for" db:"remember_for"`
          
          	// ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
          	// to express that, for example, a user authenticated using two factor authentication.
          	ACR string `json:"acr" db:"acr"`
          
          	// Subject is the user ID of the end-user that authenticated.
          	//
          	// required: true
          	Subject string `json:"subject" db:"subject"`
          
          	// ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the
          	// (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID
          	// Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.
          	//
          	// Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the
          	// sub claim in the OAuth 2.0 Introspection.
          	//
          	// Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself
          	// you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in
          	// ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's
          	// configuration).
          	//
          	// Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies
          	// that you have to compute this value on every authentication process (probably depending on the client ID or some
          	// other unique value).
          	//
          	// If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.
          	ForceSubjectIdentifier string `json:"force_subject_identifier" db:"forced_subject_identifier"`
          
          	// Context is an optional object which can hold arbitrary data. The data will be made available when fetching the
          	// consent request under the "context" field. This is useful in scenarios where login and consent endpoints share
          	// data.
          	Context sqlxx.JSONRawMessage `json:"context" db:"context"`
          
          	LoginRequest    *LoginRequest       `json:"-" db:"-"`
          	Error           *RequestDeniedError `json:"-" db:"error"`
          	RequestedAt     time.Time           `json:"-" db:"requested_at"`
          	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
          	WasUsed         bool                `json:"-" db:"was_used"`
          }

            HandledLoginRequest is the request payload used to accept a login request.

            swagger:model acceptLoginRequest

            func (*HandledLoginRequest) AfterUpdate

            func (r *HandledLoginRequest) AfterUpdate(c *pop.Connection) error

            func (*HandledLoginRequest) BeforeSave

            func (r *HandledLoginRequest) BeforeSave(_ *pop.Connection) error

            func (*HandledLoginRequest) HasError

            func (r *HandledLoginRequest) HasError() bool

            func (HandledLoginRequest) TableName

            func (_ HandledLoginRequest) TableName() string

            type Handler

            type Handler struct {
            	// contains filtered or unexported fields
            }

            func NewHandler

            func NewHandler(
            	r InternalRegistry,
            	c *config.Provider,
            ) *Handler

            func (*Handler) AcceptConsentRequest

            func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/consent/accept admin acceptConsentRequest

            When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

            The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

            The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

            This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests.

            The response contains a redirect URL which the consent provider should redirect the user-agent to.

            Consumes:
            - application/json
            
            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              404: genericError
              500: genericError
            

            func (*Handler) AcceptLoginRequest

            func (h *Handler) AcceptLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/login/accept admin acceptLoginRequest

            Accept a Login Request

            When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

            The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

            This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting a cookie.

            The response contains a redirect URL which the login provider should redirect the user-agent to.

            Consumes:
            - application/json
            
            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              400: genericError
              404: genericError
              401: genericError
              500: genericError
            

            func (*Handler) AcceptLogoutRequest

            func (h *Handler) AcceptLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/logout/accept admin acceptLogoutRequest

            Accept a Logout Request

            When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request. No body is required.

            The response contains a redirect URL which the consent provider should redirect the user-agent to.

            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              404: genericError
              500: genericError
            

            func (*Handler) DeleteConsentSession

            func (h *Handler) DeleteConsentSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route DELETE /oauth2/auth/sessions/consent admin revokeConsentSessions

              Revokes Consent Sessions of a Subject for a Specific OAuth 2.0 Client

              This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all associated OAuth 2.0 Access Tokens.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                204: emptyResponse
                400: genericError
                404: genericError
                500: genericError
              

              func (*Handler) DeleteLoginSession

              func (h *Handler) DeleteLoginSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route DELETE /oauth2/auth/sessions/login admin revokeAuthenticationSession

                Invalidates All Login Sessions of a Certain User Invalidates a Subject's Authentication Session

                This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect Front- or Back-channel logout.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  204: emptyResponse
                  400: genericError
                  404: genericError
                  500: genericError
                

                func (*Handler) GetConsentRequest

                func (h *Handler) GetConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route GET /oauth2/auth/requests/consent admin getConsentRequest

                When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

                The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

                The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: consentRequest
                  404: genericError
                  409: genericError
                  500: genericError
                

                func (*Handler) GetConsentSessions

                func (h *Handler) GetConsentSessions(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route GET /oauth2/auth/sessions/consent admin listSubjectConsentSessions

                This endpoint lists all subject's granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK.

                The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'. Multiple links can be included in this header, and will be separated by a comma.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: handledConsentRequestList
                  400: genericError
                  500: genericError
                

                func (*Handler) GetLoginRequest

                func (h *Handler) GetLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route GET /oauth2/auth/requests/login admin getLoginRequest

                Get a Login Request

                When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

                The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: loginRequest
                  400: genericError
                  404: genericError
                  409: genericError
                  500: genericError
                

                func (*Handler) GetLogoutRequest

                func (h *Handler) GetLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route GET /oauth2/auth/requests/logout admin getLogoutRequest

                Get a Logout Request

                Use this endpoint to fetch a logout request.

                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: logoutRequest
                  404: genericError
                  500: genericError
                

                func (*Handler) RejectConsentRequest

                func (h *Handler) RejectConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route PUT /oauth2/auth/requests/consent/reject admin rejectConsentRequest

                When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

                The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

                The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

                This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted.

                The response contains a redirect URL which the consent provider should redirect the user-agent to.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: completedRequest
                  404: genericError
                  500: genericError
                

                func (*Handler) RejectLoginRequest

                func (h *Handler) RejectLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route PUT /oauth2/auth/requests/login/reject admin rejectLoginRequest

                Reject a Login Request

                When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

                The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

                This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication was be denied.

                The response contains a redirect URL which the login provider should redirect the user-agent to.

                Consumes:
                - application/json
                
                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  200: completedRequest
                  400: genericError
                  401: genericError
                  404: genericError
                  500: genericError
                

                func (*Handler) RejectLogoutRequest

                func (h *Handler) RejectLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

                swagger:route PUT /oauth2/auth/requests/logout/reject admin rejectLogoutRequest

                Reject a Logout Request

                When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request. No body is required.

                The response is empty as the logout provider has to chose what action to perform next.

                Produces:
                - application/json
                
                Schemes: http, https
                
                Responses:
                  204: emptyResponse
                  404: genericError
                  500: genericError
                

                func (*Handler) SetRoutes

                func (h *Handler) SetRoutes(admin *x.RouterAdmin)

                type InternalRegistry

                type InternalRegistry interface {
                	x.RegistryWriter
                	x.RegistryCookieStore
                	x.RegistryLogger
                	Registry
                	client.Registry
                
                	OAuth2Storage() x.FositeStorer
                	OpenIDJWTStrategy() jwk.JWTStrategy
                	OpenIDConnectRequestValidator() *openid.OpenIDConnectRequestValidator
                	ScopeStrategy() fosite.ScopeStrategy
                }

                type LoginRequest

                type LoginRequest struct {
                	// ID is the identifier ("login challenge") of the login request. It is used to
                	// identify the session.
                	//
                	// required: true
                	ID string `json:"challenge" db:"challenge"`
                
                	// RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
                	//
                	// required: true
                	RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`
                
                	// RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
                	//
                	// required: true
                	RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`
                
                	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
                	// If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.
                	//
                	// This feature allows you to update / set session information.
                	//
                	// required: true
                	Skip bool `json:"skip" db:"skip"`
                
                	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
                	// requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type
                	// when accepting the login request, or the request will fail.
                	//
                	// required: true
                	Subject string `json:"subject" db:"subject"`
                
                	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
                	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
                	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`
                
                	// Client is the OAuth 2.0 Client that initiated the request.
                	//
                	// required: true
                	Client *client.Client `json:"client" db:"-"`
                
                	ClientID string `json:"-" db:"client_id"`
                
                	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
                	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
                	// might come in handy if you want to deal with additional request parameters.
                	//
                	// required: true
                	RequestURL string `json:"request_url" db:"request_url"`
                
                	// SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
                	// this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
                	// this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
                	// channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
                	SessionID sqlxx.NullString `json:"session_id" db:"login_session_id"`
                
                	ForceSubjectIdentifier string `json:"-" db:"-"` // this is here but has no meaning apart from sql_helper working properly.
                	Verifier               string `json:"-" db:"verifier"`
                	CSRF                   string `json:"-" db:"csrf"`
                
                	AuthenticatedAt sqlxx.NullTime `json:"-" db:"authenticated_at"`
                	RequestedAt     time.Time      `json:"-" db:"requested_at"`
                	WasHandled      bool           `json:"-" db:"was_handled,r"`
                }

                  Contains information on an ongoing login request.

                  swagger:model loginRequest

                  func SaneMockAuthRequest

                  func SaneMockAuthRequest(t *testing.T, m Manager, ls *LoginSession, cl *client.Client) (c *LoginRequest)

                    SaneMockAuthRequest does the same thing as MockAuthRequest but uses less insanity and implicit dependencies.

                    func (*LoginRequest) AfterFind

                    func (r *LoginRequest) AfterFind(c *pop.Connection) error

                    func (*LoginRequest) BeforeSave

                    func (r *LoginRequest) BeforeSave(_ *pop.Connection) error

                    func (*LoginRequest) FindInDB

                    func (r *LoginRequest) FindInDB(c *pop.Connection, id string) error

                    func (LoginRequest) TableName

                    func (_ LoginRequest) TableName() string

                    type LoginSession

                    type LoginSession struct {
                    	ID              string         `db:"id"`
                    	AuthenticatedAt sqlxx.NullTime `db:"authenticated_at"`
                    	Subject         string         `db:"subject"`
                    	Remember        bool           `db:"remember"`
                    }

                      swagger:ignore

                      func (LoginSession) TableName

                      func (_ LoginSession) TableName() string

                      type LogoutRequest

                      type LogoutRequest struct {
                      	// Challenge is the identifier ("logout challenge") of the logout authentication request. It is used to
                      	// identify the session.
                      	ID string `json:"-" db:"challenge"`
                      
                      	// Subject is the user for whom the logout was request.
                      	Subject string `json:"subject" db:"subject"`
                      
                      	// SessionID is the login session ID that was requested to log out.
                      	SessionID string `json:"sid,omitempty" db:"sid"`
                      
                      	// RequestURL is the original Logout URL requested.
                      	RequestURL string `json:"request_url" db:"request_url"`
                      
                      	// RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client.
                      	RPInitiated bool `json:"rp_initiated" db:"rp_initiated"`
                      
                      	Verifier              string         `json:"-" db:"verifier"`
                      	PostLogoutRedirectURI string         `json:"-" db:"redir_url"`
                      	WasUsed               bool           `json:"-" db:"was_used"`
                      	Accepted              bool           `json:"-" db:"accepted"`
                      	Rejected              bool           `db:"rejected" json:"-"`
                      	ClientID              sql.NullString `json:"-" db:"client_id"`
                      	Client                *client.Client `json:"-" db:"-"`
                      }

                        Contains information about an ongoing logout request.

                        swagger:model logoutRequest

                        func MockLogoutRequest

                        func MockLogoutRequest(key string, withClient bool) (c *LogoutRequest)

                        func (*LogoutRequest) AfterFind

                        func (r *LogoutRequest) AfterFind(c *pop.Connection) error

                        func (*LogoutRequest) BeforeSave

                        func (r *LogoutRequest) BeforeSave(_ *pop.Connection) error

                        func (LogoutRequest) TableName

                        func (_ LogoutRequest) TableName() string

                        type LogoutResult

                        type LogoutResult struct {
                        	RedirectTo             string
                        	FrontChannelLogoutURLs []string
                        }

                          Returned when the log out request was used.

                          swagger:ignore

                          type Manager

                          type Manager interface {
                          	CreateConsentRequest(ctx context.Context, req *ConsentRequest) error
                          	GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)
                          	HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)
                          	RevokeSubjectConsentSession(ctx context.Context, user string) error
                          	RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error
                          
                          	VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*HandledConsentRequest, error)
                          	FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]HandledConsentRequest, error)
                          	FindSubjectsGrantedConsentRequests(ctx context.Context, user string, limit, offset int) ([]HandledConsentRequest, error)
                          	CountSubjectsGrantedConsentRequests(ctx context.Context, user string) (int, error)
                          
                          	// Cookie management
                          	GetRememberedLoginSession(ctx context.Context, id string) (*LoginSession, error)
                          	CreateLoginSession(ctx context.Context, session *LoginSession) error
                          	DeleteLoginSession(ctx context.Context, id string) error
                          	RevokeSubjectLoginSession(ctx context.Context, user string) error
                          	ConfirmLoginSession(ctx context.Context, id string, authTime time.Time, subject string, remember bool) error
                          
                          	CreateLoginRequest(ctx context.Context, req *LoginRequest) error
                          	GetLoginRequest(ctx context.Context, challenge string) (*LoginRequest, error)
                          	HandleLoginRequest(ctx context.Context, challenge string, r *HandledLoginRequest) (*LoginRequest, error)
                          	VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*HandledLoginRequest, error)
                          
                          	CreateForcedObfuscatedLoginSession(ctx context.Context, session *ForcedObfuscatedLoginSession) error
                          	GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)
                          
                          	ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
                          	ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
                          
                          	CreateLogoutRequest(ctx context.Context, request *LogoutRequest) error
                          	GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
                          	AcceptLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
                          	RejectLogoutRequest(ctx context.Context, challenge string) error
                          	VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*LogoutRequest, error)
                          }

                          type OpenIDConnectContext

                          type OpenIDConnectContext struct {
                          	// ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.
                          	// It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.
                          	//
                          	// OpenID Connect defines it as follows:
                          	// > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values
                          	// that the Authorization Server is being requested to use for processing this Authentication Request, with the
                          	// values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication
                          	// performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a
                          	// Voluntary Claim by this parameter.
                          	ACRValues []string `json:"acr_values,omitempty"`
                          
                          	// UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a
                          	// space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value
                          	// "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),
                          	// followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested
                          	// locales are not supported by the OpenID Provider.
                          	UILocales []string `json:"ui_locales,omitempty"`
                          
                          	// Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
                          	// The defined values are:
                          	// - page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
                          	// - popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
                          	// - touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
                          	// - wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
                          	//
                          	// The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.
                          	Display string `json:"display,omitempty"`
                          
                          	// IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the
                          	// End-User's current or past authenticated session with the Client.
                          	IDTokenHintClaims map[string]interface{} `json:"id_token_hint_claims,omitempty"`
                          
                          	// LoginHint hints about the login identifier the End-User might use to log in (if necessary).
                          	// This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)
                          	// and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a
                          	// phone number in the format specified for the phone_number Claim. The use of this parameter is optional.
                          	LoginHint string `json:"login_hint,omitempty"`
                          }

                            Contains optional information about the OpenID Connect request.

                            swagger:model openIDConnectContext

                            func (*OpenIDConnectContext) Scan

                            func (n *OpenIDConnectContext) Scan(value interface{}) error

                            func (*OpenIDConnectContext) Value

                            func (n *OpenIDConnectContext) Value() (driver.Value, error)

                            type PreviousConsentSession

                            type PreviousConsentSession struct {
                            	// Named ID because of pop
                            	ID string `json:"-" db:"challenge"`
                            
                            	// GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
                            	GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`
                            
                            	// GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
                            	GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`
                            
                            	// Session allows you to set (optional) session data for access and ID tokens.
                            	Session *ConsentRequestSessionData `json:"session" db:"-"`
                            
                            	// Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
                            	// client asks the same user for the same, or a subset of, scope.
                            	Remember bool `json:"remember" db:"remember"`
                            
                            	// RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
                            	// authorization will be remembered indefinitely.
                            	RememberFor int `json:"remember_for" db:"remember_for"`
                            
                            	// HandledAt contains the timestamp the consent request was handled.
                            	HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`
                            
                            	ConsentRequest  *ConsentRequest     `json:"consent_request" db:"-"`
                            	Error           *RequestDeniedError `json:"-" db:"error"`
                            	RequestedAt     time.Time           `json:"-" db:"requested_at"`
                            	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
                            	WasUsed         bool                `json:"-" db:"was_used"`
                            
                            	SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
                            	SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
                            }

                              The response used to return used consent requests same as HandledLoginRequest, just with consent_request exposed as json

                              type Registry

                              type Registry interface {
                              	ConsentManager() Manager
                              	ConsentStrategy() Strategy
                              	SubjectIdentifierAlgorithm() map[string]SubjectIdentifierAlgorithm
                              }

                              type RequestDeniedError

                              type RequestDeniedError struct {
                              	// The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`).
                              	//
                              	// Defaults to `request_denied`.
                              	Name string `json:"error"`
                              
                              	// Description of the error in a human readable format.
                              	Description string `json:"error_description"`
                              
                              	// Hint to help resolve the error.
                              	Hint string `json:"error_hint"`
                              
                              	// Represents the HTTP status code of the error (e.g. 401 or 403)
                              	//
                              	// Defaults to 400
                              	Code int `json:"status_code"`
                              
                              	// Debug contains information to help resolve the problem as a developer. Usually not exposed
                              	// to the public but only in the server logs.
                              	Debug string `json:"error_debug"`
                              	// contains filtered or unexported fields
                              }

                                The request payload used to accept a login or consent request.

                                swagger:model rejectRequest

                                func (*RequestDeniedError) IsError

                                func (e *RequestDeniedError) IsError() bool

                                func (*RequestDeniedError) Scan

                                func (e *RequestDeniedError) Scan(value interface{}) error

                                func (*RequestDeniedError) SetDefaults

                                func (e *RequestDeniedError) SetDefaults(name string)

                                func (*RequestDeniedError) Value

                                func (e *RequestDeniedError) Value() (driver.Value, error)

                                type RequestHandlerResponse

                                type RequestHandlerResponse struct {
                                	// RedirectURL is the URL which you should redirect the user to once the authentication process is completed.
                                	//
                                	// required: true
                                	RedirectTo string `json:"redirect_to"`
                                }

                                  The response payload sent when accepting or rejecting a login or consent request.

                                  swagger:model completedRequest

                                  type Strategy

                                  type Strategy interface {
                                  	HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)
                                  	HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)
                                  }

                                  type SubjectIdentifierAlgorithm

                                  type SubjectIdentifierAlgorithm interface {
                                  	// Obfuscate derives a pairwise subject identifier from the given string.
                                  	Obfuscate(subject string, client *client.Client) (string, error)
                                  }

                                  type SubjectIdentifierAlgorithmPairwise

                                  type SubjectIdentifierAlgorithmPairwise struct {
                                  	Salt []byte
                                  }

                                  func NewSubjectIdentifierAlgorithmPairwise

                                  func NewSubjectIdentifierAlgorithmPairwise(salt []byte) *SubjectIdentifierAlgorithmPairwise

                                  func (*SubjectIdentifierAlgorithmPairwise) Obfuscate

                                  func (g *SubjectIdentifierAlgorithmPairwise) Obfuscate(subject string, client *client.Client) (string, error)

                                  type SubjectIdentifierAlgorithmPublic

                                  type SubjectIdentifierAlgorithmPublic struct{}

                                  func NewSubjectIdentifierAlgorithmPublic

                                  func NewSubjectIdentifierAlgorithmPublic() *SubjectIdentifierAlgorithmPublic

                                  func (*SubjectIdentifierAlgorithmPublic) Obfuscate

                                  func (g *SubjectIdentifierAlgorithmPublic) Obfuscate(subject string, client *client.Client) (string, error)