identity

Documentation

Overview

Package identity provides support for making OpenID Connect (OIDC) and OAuth2 authenticated HTTP requests with third party identity providers.

Index

• Variables
• func RegisterAuthenticator(name string, ctor AuthenticatorConstructor)
• type Authenticator
  • func GetIdentityProvider(ctx context.Context, tracerProvider oteltrace.TracerProvider, ...) (Authenticator, error)
  • func NewAuthenticator(ctx context.Context, tracerProvider oteltrace.TracerProvider, o oauth.Options) (a Authenticator, err error)
• type AuthenticatorConstructor
• type Claims
  • func NewClaimsFromRaw(raw map[string]json.RawMessage) Claims
  • func (claims Claims) Claims(v any) error
  • func (claims Claims) Flatten() FlattenedClaims
  • func (claims Claims) ToAnyMap() map[string]*anypb.Any
  • func (claims *Claims) UnmarshalJSON(data []byte) error
• type FlattenedClaims
  • func NewFlattenedClaimsFromPB(m map[string]*structpb.ListValue) FlattenedClaims
  • func (claims FlattenedClaims) ToPB() map[string]*structpb.ListValue
  • func (claims *FlattenedClaims) UnmarshalJSON(data []byte) error
• type MockProvider
  • func (mp MockProvider) Authenticate(context.Context, string, identity.State) (*oauth2.Token, error)
  • func (mp MockProvider) DeviceAccessToken(_ context.Context, _ *oauth2.DeviceAuthResponse, _ identity.State) (*oauth2.Token, error)
  • func (mp MockProvider) DeviceAuth(_ context.Context) (*oauth2.DeviceAuthResponse, error)
  • func (mp MockProvider) Name() string
  • func (mp MockProvider) Refresh(context.Context, *oauth2.Token, identity.State) (*oauth2.Token, error)
  • func (mp MockProvider) Revoke(_ context.Context, _ *oauth2.Token) error
  • func (mp MockProvider) SignIn(_ http.ResponseWriter, _ *http.Request, _ string) error
  • func (mp MockProvider) SignOut(_ http.ResponseWriter, _ *http.Request, _, _, _ string) error
  • func (mp MockProvider) UpdateUserInfo(_ context.Context, _ *oauth2.Token, _ any) error
  • func (mp MockProvider) VerifyAccessToken(_ context.Context, _ string) (claims map[string]any, err error)
  • func (mp MockProvider) VerifyIdentityToken(_ context.Context, _ string) (claims map[string]any, err error)
• type SessionClaims
  • func (claims *SessionClaims) SetRawIDToken(rawIDToken string)
• type State

Variables

var (
	ErrVerifyAccessTokenNotSupported   = identity.ErrVerifyAccessTokenNotSupported
	ErrVerifyIdentityTokenNotSupported = identity.ErrVerifyIdentityTokenNotSupported
)

re-exported errors

Functions

func RegisterAuthenticator

func RegisterAuthenticator(name string, ctor AuthenticatorConstructor)

RegisterAuthenticator registers a new Authenticator.

Types

type Authenticator

type Authenticator interface {
	Authenticate(context.Context, string, State) (*oauth2.Token, error)
	Refresh(context.Context, *oauth2.Token, State) (*oauth2.Token, error)
	Revoke(context.Context, *oauth2.Token) error
	Name() string
	UpdateUserInfo(ctx context.Context, t *oauth2.Token, v any) error
	VerifyAccessToken(ctx context.Context, rawAccessToken string) (claims map[string]any, err error)
	VerifyIdentityToken(ctx context.Context, rawIdentityToken string) (claims map[string]any, err error)

	SignIn(w http.ResponseWriter, r *http.Request, state string) error
	SignOut(w http.ResponseWriter, r *http.Request, idTokenHint, authenticateSignedOutURL, redirectToURL string) error

	DeviceAuth(ctx context.Context) (*oauth2.DeviceAuthResponse, error)
	DeviceAccessToken(ctx context.Context, r *oauth2.DeviceAuthResponse, state State) (*oauth2.Token, error)
}

Authenticator is an interface representing the ability to authenticate with an identity provider.

func GetIdentityProvider

func GetIdentityProvider(
	ctx context.Context,
	tracerProvider oteltrace.TracerProvider,
	idp *identitypb.Provider,
	redirectURL *url.URL,
	overwriteIDTokenOnRefresh bool,
) (Authenticator, error)

func NewAuthenticator

func NewAuthenticator(ctx context.Context, tracerProvider oteltrace.TracerProvider, o oauth.Options) (a Authenticator, err error)

NewAuthenticator returns a new identity provider based on its name.

type AuthenticatorConstructor

type AuthenticatorConstructor func(context.Context, *oauth.Options) (Authenticator, error)

AuthenticatorConstructor makes an Authenticator from the given options.

type Claims

type Claims map[string]any

Claims are JWT claims.

func NewClaimsFromRaw

func NewClaimsFromRaw(raw map[string]json.RawMessage) Claims

NewClaimsFromRaw creates a new Claims map from a map of raw messages.

func (Claims) Claims

func (claims Claims) Claims(v any) error

Claims takes the claims data and fills v.

func (Claims) Flatten

func (claims Claims) Flatten() FlattenedClaims

Flatten flattens the claims to a FlattenedClaims map. For example:

{ "a": { "b": { "c": 12345 } } } => { "a.b.c": [12345] }

func (Claims) ToAnyMap

func (claims Claims) ToAnyMap() map[string]*anypb.Any

ToAnyMap converts the claims into a map of string => any.

func (*Claims) UnmarshalJSON

func (claims *Claims) UnmarshalJSON(data []byte) error

UnmarshalJSON unmarshals the raw json data into the claims object.

type FlattenedClaims

type FlattenedClaims map[string][]any

FlattenedClaims are a set claims flattened into a single-level map.

func NewFlattenedClaimsFromPB

func NewFlattenedClaimsFromPB(m map[string]*structpb.ListValue) FlattenedClaims

NewFlattenedClaimsFromPB creates a new FlattenedClaims from the protobuf struct type.

func (FlattenedClaims) ToPB

func (claims FlattenedClaims) ToPB() map[string]*structpb.ListValue

ToPB converts the flattened claims into a protobuf type.

func (*FlattenedClaims) UnmarshalJSON

func (claims *FlattenedClaims) UnmarshalJSON(data []byte) error

UnmarshalJSON unmarshals JSON into the flattened claims.

type MockProvider

type MockProvider struct {
	AuthenticateResponse      oauth2.Token
	AuthenticateError         error
	RefreshResponse           oauth2.Token
	RefreshError              error
	RevokeError               error
	UpdateUserInfoError       error
	SignInError               error
	SignOutError              error
	DeviceAuthResponse        oauth2.DeviceAuthResponse
	DeviceAuthError           error
	DeviceAccessTokenResponse oauth2.Token
	DeviceAccessTokenError    error
}

MockProvider provides a mocked implementation of the providers interface.

func (MockProvider) Authenticate

func (mp MockProvider) Authenticate(context.Context, string, identity.State) (*oauth2.Token, error)

Authenticate is a mocked providers function.

func (MockProvider) DeviceAccessToken

func (mp MockProvider) DeviceAccessToken(_ context.Context, _ *oauth2.DeviceAuthResponse, _ identity.State) (*oauth2.Token, error)

DeviceAccessToken implements Authenticator.

func (MockProvider) DeviceAuth

func (mp MockProvider) DeviceAuth(_ context.Context) (*oauth2.DeviceAuthResponse, error)

DeviceAuth implements Authenticator.

func (MockProvider) Name

func (mp MockProvider) Name() string

Name returns the provider name.

func (MockProvider) Refresh

func (mp MockProvider) Refresh(context.Context, *oauth2.Token, identity.State) (*oauth2.Token, error)

Refresh is a mocked providers function.

func (MockProvider) Revoke

func (mp MockProvider) Revoke(_ context.Context, _ *oauth2.Token) error

Revoke is a mocked providers function.

func (MockProvider) SignIn

func (mp MockProvider) SignIn(_ http.ResponseWriter, _ *http.Request, _ string) error

SignIn is a mocked providers function.

func (MockProvider) SignOut

func (mp MockProvider) SignOut(_ http.ResponseWriter, _ *http.Request, _, _, _ string) error

SignOut is a mocked providers function.

func (MockProvider) UpdateUserInfo

func (mp MockProvider) UpdateUserInfo(_ context.Context, _ *oauth2.Token, _ any) error

UpdateUserInfo is a mocked providers function.

func (MockProvider) VerifyAccessToken

func (mp MockProvider) VerifyAccessToken(_ context.Context, _ string) (claims map[string]any, err error)

VerifyAccessToken verifies an access token.

func (MockProvider) VerifyIdentityToken

func (mp MockProvider) VerifyIdentityToken(_ context.Context, _ string) (claims map[string]any, err error)

VerifyIdentityToken verifies an identity token.

type SessionClaims

type SessionClaims struct {
	Claims
	RawIDToken string
}

SessionClaims are claims that are attached to a session so we can store the raw id token.

func (*SessionClaims) SetRawIDToken

func (claims *SessionClaims) SetRawIDToken(rawIDToken string)

SetRawIDToken sets the raw id token.

type State

type State = identity.State

State is the identity state.