oidc

Documentation

Overview

Package oidc serves the directory's accounts to browsers as an OpenID Connect provider.

It exists so that one sign-in reaches every interface a deployment puts in front of this directory. A provider that keeps no browser session makes each of them ask for a password again, however recently the person typed one — which is the whole of the complaint this package answers, and is not something a relying party can fix on its own.

The scope is deliberately small: the authorization code flow with PKCE against the accounts already here, and the client credentials grant for service accounts. No consent screen, no refresh tokens, no dynamic registration. A client may still be confidential — the secret then stands in addition to PKCE, not instead of it. What the package does carry is the part the accounts make cheap — the same credential decision as an LDAP bind (store.Authenticate), and the groups the directory already resolves.

Index

• Constants
• type Client
• type Config
• type Server
  • func New(ctx context.Context, cfg Config, st *store.Store, log zerolog.Logger, ...) (*Server, error)
  • func (s *Server) Shutdown(ctx context.Context) error
  • func (s *Server) Start(ctx context.Context) error

Constants

const MetaSigningKey = "oidc_signing_key"

MetaSigningKey is where the provider's token signing key lives, sealed with the master key like every other secret in the database.

It is the provider's own key and nothing else signs with it. The management API issues its administrative sessions under a different one, so an id token a relying party holds can never be presented there as an administrator's session: the signature would not be the API's.

Types

type Client

type Client struct {
	ID   string
	Name string
	// Secret makes this a CONFIDENTIAL client: one that runs on a server and can keep it. When it
	// is set the token endpoint demands it, in ADDITION to PKCE rather than instead of it — the
	// secret proves which application is exchanging, PKCE proves it is the one the browser was
	// sent from, and neither answers the other's question. A client with no secret is public: a
	// page, which can keep nothing.
	Secret             string
	RedirectURIs       []string
	PostLogoutRedirect []string
}

Client is a relying party this provider will issue tokens to.

The id is any string, and that is not laxity: an id token's audience IS the client id, so a deployment whose services identify themselves by URL has to be able to say so here. Nothing is issued to an id that is not listed, and nothing is redirected to a URI that is not.

type Config

type Config struct {
	Listen string
	TLS    *tls.Config

	// Issuer is what lands in every token's iss and what the BROWSER must reach. It is the
	// provider's public address, which on a stand behind a proxy is not the address it binds.
	Issuer string

	// AllowedOrigins are the web origins permitted to read discovery, the keys and the token
	// endpoint from script. A browser page on another origin cannot do it without this.
	AllowedOrigins []string

	Clients []Client

	// Mount is what serves everything this provider does not: when the directory's console and
	// management API share this listener, it is their handler. Nil keeps the provider alone on its
	// port, which is what a deployment that gives them a port of their own gets.
	//
	// A provider and a console on ONE address is what makes a directory reachable by one name — the
	// console at /ui/, the provider at /.well-known and /keys — and the sets of paths do not
	// overlap, so the routing needs no list anybody has to keep in step: the provider's patterns are
	// more specific than "/" and win by the mux's own rule.
	Mount http.Handler

	// ServiceAccountGroup is the directory group whose members may use the client credentials
	// grant. Empty refuses the grant outright.
	ServiceAccountGroup string

	SessionLifetime time.Duration
	SessionIdle     time.Duration
	CodeLifetime    time.Duration
	TokenLifetime   time.Duration
}

Config is everything the provider is configured with.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is the provider.

func New

func New(ctx context.Context, cfg Config, st *store.Store, log zerolog.Logger, m *metrics.Metrics) (*Server, error)

New builds the provider. The signing key is loaded — or created and sealed — here, so a misconfigured store fails at start rather than at the first sign-in.

func (*Server) Shutdown

func (s *Server) Shutdown(ctx context.Context) error

Shutdown stops serving.

func (*Server) Start

func (s *Server) Start(ctx context.Context) error

Start binds the listener and serves.