Documentation

Index

Constants

View Source
const (
	LoginPath    = "/oauth2/auth/requests/login"
	ConsentPath  = "/oauth2/auth/requests/consent"
	LogoutPath   = "/oauth2/auth/requests/logout"
	SessionsPath = "/oauth2/auth/sessions"
)
View Source
const (
	CookieAuthenticationName    = "oauth2_authentication_session"
	CookieAuthenticationSIDName = "sid"
)

Variables

View Source
var ErrAbortOAuth2Request = errors.New("the OAuth 2.0 Authorization request must be aborted")
View Source
var ErrHintDoesNotMatchAuthentication = errors.New("subject from hint does not match subject from session")
View Source
var ErrNoAuthenticationSessionFound = errors.New("no previous login session was found")
View Source
var ErrNoPreviousConsentFound = errors.New("no previous OAuth 2.0 Consent could be found for this access request")

Functions

func CookieName

func CookieName(secure bool, name string) string

func ManagerTests

func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.FositeStorer) func(t *testing.T)

func MockAuthRequest

func MockAuthRequest(key string, authAt bool) (c *LoginRequest, h *HandledLoginRequest)

func MockConsentRequest

func MockConsentRequest(key string, remember bool, rememberFor int, hasError bool, skip bool, authAt bool) (c *ConsentRequest, h *HandledConsentRequest)

Types

type ConsentRequest

type ConsentRequest struct {
	// ID is the identifier ("authorization challenge") of the consent authorization request. It is used to
	// identify the session.
	//
	// required: true
	ID string `json:"challenge" db:"challenge"`

	// RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
	RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`

	// RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
	RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`

	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
	// If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the
	// consent request using the usual API call.
	Skip bool `json:"skip" db:"skip"`

	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
	// requested by the OAuth 2.0 client.
	Subject string `json:"subject" db:"subject"`

	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`

	// Client is the OAuth 2.0 Client that initiated the request.
	Client   *client.Client `json:"client" db:"-"`
	ClientID string         `json:"-" db:"client_id"`

	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
	// might come in handy if you want to deal with additional request parameters.
	RequestURL string `json:"request_url" db:"request_url"`

	// LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate
	// a login and consent request in the login & consent app.
	LoginChallenge sqlxx.NullString `json:"login_challenge" db:"login_challenge"`

	// LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
	// this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
	// this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
	// channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
	LoginSessionID sqlxx.NullString `json:"login_session_id" db:"login_session_id"`

	// ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
	// to express that, for example, a user authenticated using two factor authentication.
	ACR string `json:"acr" db:"acr"`

	// Context contains arbitrary information set by the login endpoint or is empty if not set.
	Context sqlxx.JSONRawMessage `json:"context,omitempty" db:"context"`

	// ForceSubjectIdentifier is the value from authentication (if set).
	ForceSubjectIdentifier string         `json:"-" db:"forced_subject_identifier"`
	SubjectIdentifier      string         `json:"-" db:"-"`
	Verifier               string         `json:"-" db:"verifier"`
	CSRF                   string         `json:"-" db:"csrf"`
	AuthenticatedAt        sqlxx.NullTime `json:"-" db:"authenticated_at"`
	RequestedAt            time.Time      `json:"-" db:"requested_at"`
	WasHandled             bool           `json:"-" db:"was_handled,r"`
}

    Contains information on an ongoing consent request.

    swagger:model consentRequest

    func SaneMockConsentRequest

    func SaneMockConsentRequest(t *testing.T, m Manager, ar *LoginRequest, skip bool) (c *ConsentRequest)

      SaneMockConsentRequest does the same thing as MockConsentRequest but uses less insanity and implicit dependencies.

      func (*ConsentRequest) AfterFind

      func (r *ConsentRequest) AfterFind(c *pop.Connection) error

      func (*ConsentRequest) BeforeSave

      func (r *ConsentRequest) BeforeSave(_ *pop.Connection) error

      func (*ConsentRequest) FindInDB

      func (r *ConsentRequest) FindInDB(c *pop.Connection, id string) error

      func (ConsentRequest) TableName

      func (_ ConsentRequest) TableName() string

      type ConsentRequestSessionData

      type ConsentRequestSessionData struct {
      	// AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the
      	// refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.
      	// If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties
      	// can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
      	AccessToken map[string]interface{} `json:"access_token"`
      
      	// IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable
      	// by anyone that has access to the ID Challenge. Use with care!
      	IDToken map[string]interface{} `json:"id_token"`
      }

        Used to pass session data to a consent request.

        swagger:model consentRequestSession

        func NewConsentRequestSessionData

        func NewConsentRequestSessionData() *ConsentRequestSessionData

        type DefaultStrategy

        type DefaultStrategy struct {
        	// contains filtered or unexported fields
        }

        func NewStrategy

        func NewStrategy(
        	r InternalRegistry,
        	c *config.Provider,
        ) *DefaultStrategy

        func (*DefaultStrategy) HandleOAuth2AuthorizationRequest

        func (s *DefaultStrategy) HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)

        func (*DefaultStrategy) HandleOpenIDConnectLogout

        func (s *DefaultStrategy) HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)

        type ForcedObfuscatedLoginSession

        type ForcedObfuscatedLoginSession struct {
        	ClientID          string `db:"client_id"`
        	Subject           string `db:"subject"`
        	SubjectObfuscated string `db:"subject_obfuscated"`
        }

        func (*ForcedObfuscatedLoginSession) TableName

        func (_ *ForcedObfuscatedLoginSession) TableName() string

        type HandledConsentRequest

        type HandledConsentRequest struct {
        	// ID instead of Challenge because of pop
        	ID string `json:"-" db:"challenge"`
        
        	// GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
        	GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`
        
        	// GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
        	GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`
        
        	// Session allows you to set (optional) session data for access and ID tokens.
        	Session *ConsentRequestSessionData `json:"session" db:"-"`
        
        	// Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
        	// client asks the same user for the same, or a subset of, scope.
        	Remember bool `json:"remember" db:"remember"`
        
        	// RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
        	// authorization will be remembered indefinitely.
        	RememberFor int `json:"remember_for" db:"remember_for"`
        
        	// HandledAt contains the timestamp the consent request was handled.
        	HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`
        
        	ConsentRequest  *ConsentRequest     `json:"-" db:"-"`
        	Error           *RequestDeniedError `json:"-" db:"error"`
        	RequestedAt     time.Time           `json:"-" db:"requested_at"`
        	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
        	WasUsed         bool                `json:"-" db:"was_used"`
        
        	SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
        	SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
        }

          The request payload used to accept a consent request.

          swagger:model acceptConsentRequest

          func SaneMockHandleConsentRequest

          func SaneMockHandleConsentRequest(t *testing.T, m Manager, c *ConsentRequest, authAt time.Time, rememberFor int, remember bool, hasError bool) *HandledConsentRequest

          func (*HandledConsentRequest) AfterFind

          func (r *HandledConsentRequest) AfterFind(c *pop.Connection) error

          func (*HandledConsentRequest) AfterSave

          func (r *HandledConsentRequest) AfterSave(c *pop.Connection) error

          func (*HandledConsentRequest) BeforeSave

          func (r *HandledConsentRequest) BeforeSave(_ *pop.Connection) error

          func (*HandledConsentRequest) HasError

          func (r *HandledConsentRequest) HasError() bool

          func (HandledConsentRequest) TableName

          func (_ HandledConsentRequest) TableName() string

          type HandledLoginRequest

          type HandledLoginRequest struct {
          	// ID instead of challenge for pop
          	ID string `json:"-" db:"challenge"`
          
          	// Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store
          	// a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she
          	// will not be asked to log in again.
          	Remember bool `json:"remember" db:"remember"`
          
          	// RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the
          	// authorization will be remembered for the duration of the browser session (using a session cookie).
          	RememberFor int `json:"remember_for" db:"remember_for"`
          
          	// ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
          	// to express that, for example, a user authenticated using two factor authentication.
          	ACR string `json:"acr" db:"acr"`
          
          	// Subject is the user ID of the end-user that authenticated.
          	//
          	// required: true
          	Subject string `json:"subject" db:"subject"`
          
          	// ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the
          	// (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID
          	// Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.
          	//
          	// Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the
          	// sub claim in the OAuth 2.0 Introspection.
          	//
          	// Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself
          	// you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in
          	// ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's
          	// configuration).
          	//
          	// Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies
          	// that you have to compute this value on every authentication process (probably depending on the client ID or some
          	// other unique value).
          	//
          	// If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.
          	ForceSubjectIdentifier string `json:"force_subject_identifier" db:"forced_subject_identifier"`
          
          	// Context is an optional object which can hold arbitrary data. The data will be made available when fetching the
          	// consent request under the "context" field. This is useful in scenarios where login and consent endpoints share
          	// data.
          	Context sqlxx.JSONRawMessage `json:"context" db:"context"`
          
          	LoginRequest    *LoginRequest       `json:"-" db:"-"`
          	Error           *RequestDeniedError `json:"-" db:"error"`
          	RequestedAt     time.Time           `json:"-" db:"requested_at"`
          	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
          	WasUsed         bool                `json:"-" db:"was_used"`
          }

            HandledLoginRequest is the request payload used to accept a login request.

            swagger:model acceptLoginRequest

            func (*HandledLoginRequest) AfterUpdate

            func (r *HandledLoginRequest) AfterUpdate(c *pop.Connection) error

            func (*HandledLoginRequest) BeforeSave

            func (r *HandledLoginRequest) BeforeSave(_ *pop.Connection) error

            func (*HandledLoginRequest) HasError

            func (r *HandledLoginRequest) HasError() bool

            func (HandledLoginRequest) TableName

            func (_ HandledLoginRequest) TableName() string

            type Handler

            type Handler struct {
            	// contains filtered or unexported fields
            }

            func NewHandler

            func NewHandler(
            	r InternalRegistry,
            	c *config.Provider,
            ) *Handler

            func (*Handler) AcceptConsentRequest

            func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/consent/accept admin acceptConsentRequest

            When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

            The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

            The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

            This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests.

            The response contains a redirect URL which the consent provider should redirect the user-agent to.

            Consumes:
            - application/json
            
            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              404: genericError
              500: genericError
            

            func (*Handler) AcceptLoginRequest

            func (h *Handler) AcceptLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/login/accept admin acceptLoginRequest

            Accept a Login Request

            When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

            The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

            This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting a cookie.

            The response contains a redirect URL which the login provider should redirect the user-agent to.

            Consumes:
            - application/json
            
            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              400: genericError
              404: genericError
              401: genericError
              500: genericError
            

            func (*Handler) AcceptLogoutRequest

            func (h *Handler) AcceptLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route PUT /oauth2/auth/requests/logout/accept admin acceptLogoutRequest

            Accept a Logout Request

            When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request. No body is required.

            The response contains a redirect URL which the consent provider should redirect the user-agent to.

            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              200: completedRequest
              404: genericError
              500: genericError
            

            func (*Handler) DeleteConsentSession

            func (h *Handler) DeleteConsentSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

            swagger:route DELETE /oauth2/auth/sessions/consent admin revokeConsentSessions

            This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all associated OAuth 2.0 Access Tokens.

            Consumes:
            - application/json
            
            Produces:
            - application/json
            
            Schemes: http, https
            
            Responses:
              204: emptyResponse
              400: genericError
              404: genericError
              500: genericError
            

            func (*Handler) DeleteLoginSession

            func (h *Handler) DeleteLoginSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route DELETE /oauth2/auth/sessions/login admin revokeAuthenticationSession

              Invalidates All Login Sessions of a Certain User Invalidates a Subject's Authentication Session

              This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect Front- or Back-channel logout.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                204: emptyResponse
                400: genericError
                404: genericError
                500: genericError
              

              func (*Handler) GetConsentRequest

              func (h *Handler) GetConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route GET /oauth2/auth/requests/consent admin getConsentRequest

              When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

              The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

              The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: consentRequest
                404: genericError
                409: genericError
                500: genericError
              

              func (*Handler) GetConsentSessions

              func (h *Handler) GetConsentSessions(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route GET /oauth2/auth/sessions/consent admin listSubjectConsentSessions

              This endpoint lists all subject's granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK.

              The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'. Multiple links can be included in this header, and will be separated by a comma.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: handledConsentRequestList
                400: genericError
                500: genericError
              

              func (*Handler) GetLoginRequest

              func (h *Handler) GetLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route GET /oauth2/auth/requests/login admin getLoginRequest

              Get a Login Request

              When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

              The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: loginRequest
                400: genericError
                404: genericError
                409: genericError
                500: genericError
              

              func (*Handler) GetLogoutRequest

              func (h *Handler) GetLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route GET /oauth2/auth/requests/logout admin getLogoutRequest

              Get a Logout Request

              Use this endpoint to fetch a logout request.

              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: logoutRequest
                404: genericError
                500: genericError
              

              func (*Handler) RejectConsentRequest

              func (h *Handler) RejectConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route PUT /oauth2/auth/requests/consent/reject admin rejectConsentRequest

              When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

              The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

              The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

              This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted.

              The response contains a redirect URL which the consent provider should redirect the user-agent to.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: completedRequest
                404: genericError
                500: genericError
              

              func (*Handler) RejectLoginRequest

              func (h *Handler) RejectLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route PUT /oauth2/auth/requests/login/reject admin rejectLoginRequest

              Reject a Login Request

              When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

              The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

              This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication was be denied.

              The response contains a redirect URL which the login provider should redirect the user-agent to.

              Consumes:
              - application/json
              
              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                200: completedRequest
                400: genericError
                401: genericError
                404: genericError
                500: genericError
              

              func (*Handler) RejectLogoutRequest

              func (h *Handler) RejectLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

              swagger:route PUT /oauth2/auth/requests/logout/reject admin rejectLogoutRequest

              Reject a Logout Request

              When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request. No body is required.

              The response is empty as the logout provider has to chose what action to perform next.

              Produces:
              - application/json
              
              Schemes: http, https
              
              Responses:
                204: emptyResponse
                404: genericError
                500: genericError
              

              func (*Handler) SetRoutes

              func (h *Handler) SetRoutes(admin *x.RouterAdmin)

              type InternalRegistry

              type InternalRegistry interface {
              	x.RegistryWriter
              	x.RegistryCookieStore
              	x.RegistryLogger
              	Registry
              	client.Registry
              
              	OAuth2Storage() x.FositeStorer
              	OpenIDJWTStrategy() jwk.JWTStrategy
              	OpenIDConnectRequestValidator() *openid.OpenIDConnectRequestValidator
              	ScopeStrategy() fosite.ScopeStrategy
              }

              type LoginRequest

              type LoginRequest struct {
              	// ID is the identifier ("login challenge") of the login request. It is used to
              	// identify the session.
              	//
              	// required: true
              	ID string `json:"challenge" db:"challenge"`
              
              	// RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
              	//
              	// required: true
              	RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`
              
              	// RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
              	//
              	// required: true
              	RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`
              
              	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
              	// If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.
              	//
              	// This feature allows you to update / set session information.
              	//
              	// required: true
              	Skip bool `json:"skip" db:"skip"`
              
              	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
              	// requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type
              	// when accepting the login request, or the request will fail.
              	//
              	// required: true
              	Subject string `json:"subject" db:"subject"`
              
              	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
              	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
              	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`
              
              	// Client is the OAuth 2.0 Client that initiated the request.
              	//
              	// required: true
              	Client *client.Client `json:"client" db:"-"`
              
              	ClientID string `json:"-" db:"client_id"`
              
              	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
              	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
              	// might come in handy if you want to deal with additional request parameters.
              	//
              	// required: true
              	RequestURL string `json:"request_url" db:"request_url"`
              
              	// SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
              	// this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
              	// this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
              	// channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
              	SessionID sqlxx.NullString `json:"session_id" db:"login_session_id"`
              
              	ForceSubjectIdentifier string `json:"-" db:"-"` // this is here but has no meaning apart from sql_helper working properly.
              	Verifier               string `json:"-" db:"verifier"`
              	CSRF                   string `json:"-" db:"csrf"`
              
              	AuthenticatedAt sqlxx.NullTime `json:"-" db:"authenticated_at"`
              	RequestedAt     time.Time      `json:"-" db:"requested_at"`
              	WasHandled      bool           `json:"-" db:"was_handled,r"`
              }

                Contains information on an ongoing login request.

                swagger:model loginRequest

                func SaneMockAuthRequest

                func SaneMockAuthRequest(t *testing.T, m Manager, ls *LoginSession, cl *client.Client) (c *LoginRequest)

                  SaneMockAuthRequest does the same thing as MockAuthRequest but uses less insanity and implicit dependencies.

                  func (*LoginRequest) AfterFind

                  func (r *LoginRequest) AfterFind(c *pop.Connection) error

                  func (*LoginRequest) BeforeSave

                  func (r *LoginRequest) BeforeSave(_ *pop.Connection) error

                  func (*LoginRequest) FindInDB

                  func (r *LoginRequest) FindInDB(c *pop.Connection, id string) error

                  func (LoginRequest) TableName

                  func (_ LoginRequest) TableName() string

                  type LoginSession

                  type LoginSession struct {
                  	ID              string         `db:"id"`
                  	AuthenticatedAt sqlxx.NullTime `db:"authenticated_at"`
                  	Subject         string         `db:"subject"`
                  	Remember        bool           `db:"remember"`
                  }

                    swagger:ignore

                    func (LoginSession) TableName

                    func (_ LoginSession) TableName() string

                    type LogoutRequest

                    type LogoutRequest struct {
                    	// Challenge is the identifier ("logout challenge") of the logout authentication request. It is used to
                    	// identify the session.
                    	ID string `json:"-" db:"challenge"`
                    
                    	// Subject is the user for whom the logout was request.
                    	Subject string `json:"subject" db:"subject"`
                    
                    	// SessionID is the login session ID that was requested to log out.
                    	SessionID string `json:"sid,omitempty" db:"sid"`
                    
                    	// RequestURL is the original Logout URL requested.
                    	RequestURL string `json:"request_url" db:"request_url"`
                    
                    	// RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client.
                    	RPInitiated bool `json:"rp_initiated" db:"rp_initiated"`
                    
                    	Verifier              string         `json:"-" db:"verifier"`
                    	PostLogoutRedirectURI string         `json:"-" db:"redir_url"`
                    	WasUsed               bool           `json:"-" db:"was_used"`
                    	Accepted              bool           `json:"-" db:"accepted"`
                    	Rejected              bool           `db:"rejected" json:"-"`
                    	ClientID              sql.NullString `json:"-" db:"client_id"`
                    	Client                *client.Client `json:"-" db:"-"`
                    }

                      Contains information about an ongoing logout request.

                      swagger:model logoutRequest

                      func MockLogoutRequest

                      func MockLogoutRequest(key string, withClient bool) (c *LogoutRequest)

                      func (*LogoutRequest) AfterFind

                      func (r *LogoutRequest) AfterFind(c *pop.Connection) error

                      func (*LogoutRequest) BeforeSave

                      func (r *LogoutRequest) BeforeSave(_ *pop.Connection) error

                      func (LogoutRequest) TableName

                      func (_ LogoutRequest) TableName() string

                      type LogoutResult

                      type LogoutResult struct {
                      	RedirectTo             string
                      	FrontChannelLogoutURLs []string
                      }

                        Returned when the log out request was used.

                        swagger:ignore

                        type Manager

                        type Manager interface {
                        	CreateConsentRequest(ctx context.Context, req *ConsentRequest) error
                        	GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)
                        	HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)
                        	RevokeSubjectConsentSession(ctx context.Context, user string) error
                        	RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error
                        
                        	VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*HandledConsentRequest, error)
                        	FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]HandledConsentRequest, error)
                        	FindSubjectsGrantedConsentRequests(ctx context.Context, user string, limit, offset int) ([]HandledConsentRequest, error)
                        	CountSubjectsGrantedConsentRequests(ctx context.Context, user string) (int, error)
                        
                        	// Cookie management
                        	GetRememberedLoginSession(ctx context.Context, id string) (*LoginSession, error)
                        	CreateLoginSession(ctx context.Context, session *LoginSession) error
                        	DeleteLoginSession(ctx context.Context, id string) error
                        	RevokeSubjectLoginSession(ctx context.Context, user string) error
                        	ConfirmLoginSession(ctx context.Context, id string, authTime time.Time, subject string, remember bool) error
                        
                        	CreateLoginRequest(ctx context.Context, req *LoginRequest) error
                        	GetLoginRequest(ctx context.Context, challenge string) (*LoginRequest, error)
                        	HandleLoginRequest(ctx context.Context, challenge string, r *HandledLoginRequest) (*LoginRequest, error)
                        	VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*HandledLoginRequest, error)
                        
                        	CreateForcedObfuscatedLoginSession(ctx context.Context, session *ForcedObfuscatedLoginSession) error
                        	GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)
                        
                        	ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
                        	ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
                        
                        	CreateLogoutRequest(ctx context.Context, request *LogoutRequest) error
                        	GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
                        	AcceptLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
                        	RejectLogoutRequest(ctx context.Context, challenge string) error
                        	VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*LogoutRequest, error)
                        }

                        type OpenIDConnectContext

                        type OpenIDConnectContext struct {
                        	// ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.
                        	// It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.
                        	//
                        	// OpenID Connect defines it as follows:
                        	// > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values
                        	// that the Authorization Server is being requested to use for processing this Authentication Request, with the
                        	// values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication
                        	// performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a
                        	// Voluntary Claim by this parameter.
                        	ACRValues []string `json:"acr_values,omitempty"`
                        
                        	// UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a
                        	// space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value
                        	// "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),
                        	// followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested
                        	// locales are not supported by the OpenID Provider.
                        	UILocales []string `json:"ui_locales,omitempty"`
                        
                        	// Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
                        	// The defined values are:
                        	// - page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
                        	// - popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
                        	// - touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
                        	// - wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
                        	//
                        	// The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.
                        	Display string `json:"display,omitempty"`
                        
                        	// IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the
                        	// End-User's current or past authenticated session with the Client.
                        	IDTokenHintClaims map[string]interface{} `json:"id_token_hint_claims,omitempty"`
                        
                        	// LoginHint hints about the login identifier the End-User might use to log in (if necessary).
                        	// This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)
                        	// and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a
                        	// phone number in the format specified for the phone_number Claim. The use of this parameter is optional.
                        	LoginHint string `json:"login_hint,omitempty"`
                        }

                          Contains optional information about the OpenID Connect request.

                          swagger:model openIDConnectContext

                          func (*OpenIDConnectContext) Scan

                          func (n *OpenIDConnectContext) Scan(value interface{}) error

                          func (*OpenIDConnectContext) Value

                          func (n *OpenIDConnectContext) Value() (driver.Value, error)

                          type PreviousConsentSession

                          type PreviousConsentSession struct {
                          	// Named ID because of pop
                          	ID string `json:"-" db:"challenge"`
                          
                          	// GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
                          	GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`
                          
                          	// GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
                          	GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`
                          
                          	// Session allows you to set (optional) session data for access and ID tokens.
                          	Session *ConsentRequestSessionData `json:"session" db:"-"`
                          
                          	// Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
                          	// client asks the same user for the same, or a subset of, scope.
                          	Remember bool `json:"remember" db:"remember"`
                          
                          	// RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
                          	// authorization will be remembered indefinitely.
                          	RememberFor int `json:"remember_for" db:"remember_for"`
                          
                          	// HandledAt contains the timestamp the consent request was handled.
                          	HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`
                          
                          	ConsentRequest  *ConsentRequest     `json:"consent_request" db:"-"`
                          	Error           *RequestDeniedError `json:"-" db:"error"`
                          	RequestedAt     time.Time           `json:"-" db:"requested_at"`
                          	AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
                          	WasUsed         bool                `json:"-" db:"was_used"`
                          
                          	SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
                          	SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
                          }

                            The response used to return used consent requests same as HandledLoginRequest, just with consent_request exposed as json

                            type Registry

                            type Registry interface {
                            	ConsentManager() Manager
                            	ConsentStrategy() Strategy
                            	SubjectIdentifierAlgorithm() map[string]SubjectIdentifierAlgorithm
                            }

                            type RequestDeniedError

                            type RequestDeniedError struct {
                            	// The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`).
                            	//
                            	// Defaults to `request_denied`.
                            	Name string `json:"error"`
                            
                            	// Description of the error in a human readable format.
                            	Description string `json:"error_description"`
                            
                            	// Hint to help resolve the error.
                            	Hint string `json:"error_hint"`
                            
                            	// Represents the HTTP status code of the error (e.g. 401 or 403)
                            	//
                            	// Defaults to 400
                            	Code int `json:"status_code"`
                            
                            	// Debug contains information to help resolve the problem as a developer. Usually not exposed
                            	// to the public but only in the server logs.
                            	Debug string `json:"error_debug"`
                            	// contains filtered or unexported fields
                            }

                              The request payload used to accept a login or consent request.

                              swagger:model rejectRequest

                              func (*RequestDeniedError) IsError

                              func (e *RequestDeniedError) IsError() bool

                              func (*RequestDeniedError) Scan

                              func (e *RequestDeniedError) Scan(value interface{}) error

                              func (*RequestDeniedError) SetDefaults

                              func (e *RequestDeniedError) SetDefaults(name string)

                              func (*RequestDeniedError) Value

                              func (e *RequestDeniedError) Value() (driver.Value, error)

                              type RequestHandlerResponse

                              type RequestHandlerResponse struct {
                              	// RedirectURL is the URL which you should redirect the user to once the authentication process is completed.
                              	//
                              	// required: true
                              	RedirectTo string `json:"redirect_to"`
                              }

                                The response payload sent when accepting or rejecting a login or consent request.

                                swagger:model completedRequest

                                type Strategy

                                type Strategy interface {
                                	HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)
                                	HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)
                                }

                                type SubjectIdentifierAlgorithm

                                type SubjectIdentifierAlgorithm interface {
                                	// Obfuscate derives a pairwise subject identifier from the given string.
                                	Obfuscate(subject string, client *client.Client) (string, error)
                                }

                                type SubjectIdentifierAlgorithmPairwise

                                type SubjectIdentifierAlgorithmPairwise struct {
                                	Salt []byte
                                }

                                func NewSubjectIdentifierAlgorithmPairwise

                                func NewSubjectIdentifierAlgorithmPairwise(salt []byte) *SubjectIdentifierAlgorithmPairwise

                                func (*SubjectIdentifierAlgorithmPairwise) Obfuscate

                                func (g *SubjectIdentifierAlgorithmPairwise) Obfuscate(subject string, client *client.Client) (string, error)

                                type SubjectIdentifierAlgorithmPublic

                                type SubjectIdentifierAlgorithmPublic struct{}

                                func NewSubjectIdentifierAlgorithmPublic

                                func NewSubjectIdentifierAlgorithmPublic() *SubjectIdentifierAlgorithmPublic

                                func (*SubjectIdentifierAlgorithmPublic) Obfuscate

                                func (g *SubjectIdentifierAlgorithmPublic) Obfuscate(subject string, client *client.Client) (string, error)