sso

README

cern-sso

cern-sso provides tools to authenticate with CERN's Single Sign-On (SSO) machinery.

License

cern-sso is released under the BSD-3 license.

Documentation

Index

• Constants
• type Client
  • func Login(url string, opts ...Option) (*Client, error)
  • func NewClient(login string, opts ...Option) (*Client, error)
  • func (cli *Client) Close() error
  • func (cli *Client) Cookies() []*http.Cookie
  • func (cli *Client) Login() error
  • func (cli *Client) Valid() (exp time.Time, ok bool)
• type Option
  • func WithAuthServer(srv string) Option
  • func WithClient(cli *http.Client) Option
  • func WithCookieExpiration(exp time.Duration) Option
  • func WithKrb5(cli *krb5cli.Client) Option
  • func WithLogger(msg *log.Logger) Option

Examples

• Login

Constants

const (
	DefaultAuthServer = "auth.cern.ch" // Default authentication server name.
)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is a Single Sign-On client.

func Login

func Login(url string, opts ...Option) (*Client, error)

Login simulates a browser session to log in with the provided URL, using the SPNEGO protocol.

Example

package main

import (
	"fmt"
	"log"

	sso "github.com/sbinet/cern-sso"
)

func main() {
	const url = "https://openstack.cern.ch"

	cli, err := sso.Login(url)
	if err != nil {
		log.Fatalf("could not log into %q: %+v", url, err)
	}
	defer cli.Close()

	for _, c := range cli.Cookies() {
		scheme := "http"
		if c.Secure {
			scheme = "https"
		}
		fmt.Printf("%-20s %s\n", c.Name+":", scheme+"://"+c.Domain+c.Path)
	}
}

func NewClient

func NewClient(login string, opts ...Option) (*Client, error)

NewClient creates a new SSO client that will authenticate with the provided login page. The returned client is not yet authenticated: one should use the Login method to do so.

func (*Client) Close

func (cli *Client) Close() error

func (*Client) Cookies

func (cli *Client) Cookies() []*http.Cookie

func (*Client) Login

func (cli *Client) Login() error

Login attempts to login with the client login page.

func (*Client) Valid

func (cli *Client) Valid() (exp time.Time, ok bool)

Valid returns whether the Keycloak cookie is valid, and its expiration date.

type Option

type Option func(opt *Client) error

func WithAuthServer

func WithAuthServer(srv string) Option

WithAuthServer configures the authentication to use the passed authentication server name.

ex:

"auth.cern.ch"

func WithClient

func WithClient(cli *http.Client) Option

WithClient configures the authentication to use the passed HTTP client.

func WithCookieExpiration

func WithCookieExpiration(exp time.Duration) Option

WithCookieExpiration configures the default expiration for the SSO cookie.

func WithKrb5

func WithKrb5(cli *krb5cli.Client) Option

WithKrb5 configures the authentication to user the provided kerberos5 client.

func WithLogger

func WithLogger(msg *log.Logger) Option

WithLogger configures the authentication to use the passed logger.