oauth2

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	CheckPass = "pass"
	CheckFail = "fail"
	CheckSkip = "skip"
)
View Source 
const (
	DPoPHeaderName = "DPoP"
	DPoPHeaderType = "dpop+jwt"
)
View Source 
const (
	ErrAuthorizationPending = "authorization_pending"
	ErrSlowDown             = "slow_down"
)
View Source 
const (
	AuthorizationCodeGrantType string = "authorization_code"
	ClientCredentialsGrantType string = "client_credentials"
	ImplicitGrantType          string = "implicit"
	PasswordGrantType          string = "password"
	RefreshTokenGrantType      string = "refresh_token"
	JWTBearerGrantType         string = "urn:ietf:params:oauth:grant-type:jwt-bearer"
	TokenExchangeGrantType     string = "urn:ietf:params:oauth:grant-type:token-exchange"
	DeviceGrantType            string = "urn:ietf:params:oauth:grant-type:device_code"
)

grant types

View Source 
const (
	ClientSecretBasicAuthMethod string = "client_secret_basic"
	ClientSecretPostAuthMethod  string = "client_secret_post"
	ClientSecretJwtAuthMethod   string = "client_secret_jwt"
	PrivateKeyJwtAuthMethod     string = "private_key_jwt"
	SelfSignedTLSAuthMethod     string = "self_signed_tls_client_auth"
	TLSClientAuthMethod         string = "tls_client_auth"
	NoneAuthMethod              string = "none"
)

auth methods

View Source 
const (
	DeviceDefaultPollInterval = 5 * time.Second
	DeviceSlowDownIncrement   = 5 * time.Second
)
View Source 
const (
	NonceSourceGenerated = "generated"
	NonceSourceCustom    = "custom"
)
View Source 
const CodeVerifierLength = 43
View Source 
const (
	JwtBearerClientAssertion string = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
)

client assertion types

View Source 
const OpenIDConfigurationPath = "/.well-known/openid-configuration"

Variables

View Source 
var (
	ErrIDTokenNonceMissing  = errors.New("id token nonce claim is missing")
	ErrIDTokenNonceMismatch = errors.New("id token nonce does not match")
)
View Source 
var CodeChallengeEncoder = base64.RawURLEncoding
View Source 
var JOSEContentEncryption = []jose.ContentEncryption{
	jose.A128CBC_HS256, jose.A192CBC_HS384, jose.A256CBC_HS512,
	jose.A128GCM, jose.A192GCM, jose.A256GCM,
}
View Source 
var JOSEKeyAlgorithms = []jose.KeyAlgorithm{
	jose.RSA1_5, jose.RSA_OAEP, jose.RSA_OAEP_256,
	jose.A128KW, jose.A192KW, jose.A256KW,
	jose.DIRECT,
	jose.ECDH_ES, jose.ECDH_ES_A128KW, jose.ECDH_ES_A192KW, jose.ECDH_ES_A256KW,
	jose.A128GCMKW, jose.A192GCMKW, jose.A256GCMKW,
	jose.PBES2_HS256_A128KW, jose.PBES2_HS384_A192KW, jose.PBES2_HS512_A256KW,
}
View Source 
var JOSESignatureAlgorithms = []jose.SignatureAlgorithm{
	jose.HS256, jose.HS384, jose.HS512,
	jose.RS256, jose.RS384, jose.RS512,
	jose.ES256, jose.ES384, jose.ES512,
	jose.PS256, jose.PS384, jose.PS512,
	jose.EdDSA,
}

Functions

func DPoPSignRequest 

func DPoPSignRequest(signingKey string, hc *http.Client, r *http.Request) error

func DPoPThumbprint 

func DPoPThumbprint(signingKey string, hc *http.Client) (string, error)

func DevicePollInterval 

func DevicePollInterval(current time.Duration, err error) (time.Duration, bool)

DevicePollInterval applies RFC 8628 polling backoff. authorization_pending retries at the current interval; slow_down increases all subsequent intervals by five seconds.

func EncryptJWT 

func EncryptJWT(token string, encrypterProvider EncrypterProvider) (nestedJWT string, key interface{}, err error)

func FetchOpenIDConfiguration 

func FetchOpenIDConfiguration(ctx context.Context, issuerURL string, hc *http.Client) (request Request, c ServerConfig, err error)

func ParseError 

func ParseError(resp *http.Response) error

func PlaintextJWT 

func PlaintextJWT(claimsProvider ClaimsProvider) (string, string, error)

func RandomString 

func RandomString(n int) string

func ReadKey 

func ReadKey(use KeyUse, location string, hc *http.Client) (jose.JSONWebKey, error)

func ReadKeyPair 

func ReadKeyPair(cert string, key string, hc *http.Client) (keyPair tls.Certificate, err error)

func ReadKeySet 

func ReadKeySet(location string, hc *http.Client) (jose.JSONWebKeySet, error)

func ReadRootCA 

func ReadRootCA(location string, hc *http.Client) (pool *x509.CertPool, err error)

func ReadURL 

func ReadURL(location string, hc *http.Client) (data []byte, err error)

func RequestDeviceAuthorization 

func RequestDeviceAuthorization(ctx context.Context, cconfig ClientConfig, sconfig ServerConfig, hc *http.Client) (request Request, response DeviceAuthorizationResponse, err error)

func RequestPAR 

func RequestPAR(
	ctx context.Context,
	cconfig ClientConfig,
	sconfig ServerConfig,
	hc *http.Client,
) (parRequest Request, parResponse PARResponse, authorizeRequest Request, codeVerifier string, err error)

func RequestToken 

func RequestToken(
	ctx context.Context,
	cconfig ClientConfig,
	sconfig ServerConfig,
	hc *http.Client,
	opts ...RequestTokenOption,
) (request Request, response TokenResponse, err error)

func SignJWT 

func SignJWT(claimsProvider ClaimsProvider, signerProvider SignerProvider) (jwt string, key interface{}, err error)

func UnsafeParseJWT 

func UnsafeParseJWT(token string) (*jwt.JSONWebToken, map[string]interface{}, error)

func WithAuthorizationCode 

func WithAuthorizationCode(code string) func(*RequestTokenParams)

func WithCodeVerifier 

func WithCodeVerifier(codeVerifier string) func(*RequestTokenParams)

func WithDeviceCode 

func WithDeviceCode(deviceCode string) func(*RequestTokenParams)

func WithRedirectURL 

func WithRedirectURL(url string) func(*RequestTokenParams)

Types

type ClaimsProvider 

type ClaimsProvider func() (map[string]interface{}, error)

func AssertionClaims 

func AssertionClaims(serverConfig ServerConfig, clientConfig ClientConfig) ClaimsProvider

func ClientAssertionClaims 

func ClientAssertionClaims(serverConfig ServerConfig, clientConfig ClientConfig) ClaimsProvider

func RequestObjectClaims 

func RequestObjectClaims(params url.Values, serverConfig ServerConfig, clientConfig ClientConfig) ClaimsProvider

type ClientConfig 

type ClientConfig struct {
	IssuerURL              string
	RedirectURL            string
	NoOrigin               bool
	GrantType              string
	ClientID               string
	ClientSecret           string
	Scopes                 []string
	ACRValues              []string
	Audience               []string
	Resource               []string
	AuthMethod             string
	PKCE                   bool
	Nonce                  string
	PAR                    bool
	RequestObject          bool
	EncryptedRequestObject bool
	Insecure               bool
	ResponseType           []string
	ResponseMode           string
	Username               string
	Password               string
	RefreshToken           string
	Assertion              string
	SigningKey             string
	EncryptionKey          string
	SubjectToken           string
	SubjectTokenType       string
	ActorToken             string
	ActorTokenType         string
	IDTokenHint            string
	LoginHint              string
	IDPHint                string
	TLSCert                string
	TLSKey                 string
	TLSRootCA              string
	CallbackTLSCert        string
	CallbackTLSKey         string
	CallbackAddr           string
	HTTPTimeout            time.Duration
	BrowserTimeout         time.Duration
	NoBrowser              bool
	DPoP                   bool
	Claims                 string
	RAR                    string
	Purpose                string
	Prompt                 []string
	MaxAge                 string
	AuthenticationCode     string
}

func (ClientConfig) Validate 

func (c ClientConfig) Validate() error

type DPoPClaims 

type DPoPClaims struct {
	Htm      string `json:"htm"`
	Htu      string `json:"htu"`
	Jti      string `json:"jti"`
	IssuedAt int64  `json:"iat"`
}

type DeviceAuthorizationResponse 

type DeviceAuthorizationResponse struct {
	DeviceCode              string  `json:"device_code"`
	UserCode                string  `json:"user_code"`
	VerificationURI         string  `json:"verification_uri"`
	VerificationURIComplete *string `json:"verification_uri_complete"`
	ExpiresIn               int64   `json:"expires_in"`
	Interval                *int64  `json:"interval"`
}

type EncrypterProvider 

type EncrypterProvider func() (jose.Encrypter, interface{}, error)

func JWEEncrypter 

func JWEEncrypter(keyPath string, hc *http.Client) EncrypterProvider

type Error 

type Error struct {
	StatusCode int    `json:"-"`
	TraceID    string `json:"-"`

	ErrorCode   string `json:"error,omitempty"`
	Description string `json:"error_description,omitempty"`
	Hint        string `json:"error_hint,omitempty"`
	Cause       string `json:"cause,omitempty"`
}

func (*Error) Error 

func (e *Error) Error() string

type FlexibleInt64 

type FlexibleInt64 int64

func (*FlexibleInt64) UnmarshalJSON 

func (f *FlexibleInt64) UnmarshalJSON(b []byte) error

type KeyUse 

type KeyUse string
const (
	SigningKey    KeyUse = "sig"
	EncryptionKey KeyUse = "enc"
)

type PARResponse 

type PARResponse struct {
	RequestURI string `json:"request_uri"`
	ExpiresIn  int64  `json:"expires_in"`
}

type Request 

type Request struct {
	Method        string
	URL           *url.URL
	Headers       map[string][]string
	Form          url.Values
	JARM          map[string]interface{}
	RequestObject string
	SigningKey    interface{}
	EncryptionKey interface{}
	Cert          *x509.Certificate
	Nonce         string
	NonceSource   string
	State         string
	UsedMTLSAlias bool
}

func RequestAuthorization 

func RequestAuthorization(cconfig ClientConfig, sconfig ServerConfig, hc *http.Client) (r Request, codeVerifier string, err error)

func WaitForCallback 

func WaitForCallback(clientConfig ClientConfig, serverConfig ServerConfig, hc *http.Client, expectedState string) (Request, error)

func (*Request) AuthenticateClient 

func (r *Request) AuthenticateClient(
	endpoint string,
	mtlsEndpoint string,
	cconfig ClientConfig,
	sconfig ServerConfig,
	hc *http.Client,
) (string, error)

func (*Request) AuthorizeRequest 

func (r *Request) AuthorizeRequest(
	cconfig ClientConfig,
	sconfig ServerConfig,
	hc *http.Client,
) (codeVerifier string, err error)

func (*Request) Get 

func (r *Request) Get(key string) string

func (*Request) ParseJARM 

func (r *Request) ParseJARM(signingKey interface{}, encryptionKey interface{}) error

type RequestTokenOption 

type RequestTokenOption func(*RequestTokenParams)

type RequestTokenParams 

type RequestTokenParams struct {
	Code         string
	DeviceCode   string
	CodeVerifier string
	RedirectURL  string
}

type ServerConfig 

type ServerConfig struct {
	SupportedGrantTypes               []string `json:"grant_types_supported"`
	SupportedResponseTypes            []string `json:"response_types_supported"`
	SupportedTokenEndpointAuthMethods []string `json:"token_endpoint_auth_methods_supported"`
	SupportedScopes                   []string `json:"scopes_supported"`
	SupportedResponseModes            []string `json:"response_modes_supported"`

	AuthorizationEndpoint              string `json:"authorization_endpoint"`
	DeviceAuthorizationEndpoint        string `json:"device_authorization_endpoint"`
	PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint"`
	TokenEndpoint                      string `json:"token_endpoint"`
	MTLsEndpointAliases                struct {
		TokenEndpoint                      string `json:"token_endpoint"`
		PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint"`
	} `json:"mtls_endpoint_aliases"`

	JWKsURI string `json:"jwks_uri"`
	Issuer  string `json:"issuer"`
}

func (ServerConfig) IsConfigured 

func (c ServerConfig) IsConfigured() bool

type SignerProvider 

type SignerProvider func() (jose.Signer, interface{}, error)

func JWKSigner 

func JWKSigner(keyPath string, hc *http.Client) SignerProvider

func SecretSigner 

func SecretSigner(secret []byte) SignerProvider

type TokenResponse 

type TokenResponse struct {
	AccessToken          string           `json:"access_token,omitempty"`
	ExpiresIn            FlexibleInt64    `json:"expires_in,omitempty"`
	IDToken              string           `json:"id_token,omitempty"`
	IssuedTokenType      string           `json:"issued_token_type,omitempty"`
	RefreshToken         string           `json:"refresh_token,omitempty"`
	Scope                string           `json:"scope,omitempty"`
	TokenType            string           `json:"token_type,omitempty"`
	AuthorizationDetails []map[string]any `json:"authorization_details,omitempty"`
	// contains filtered or unexported fields
}

func NewTokenResponseFromForm 

func NewTokenResponseFromForm(f url.Values) TokenResponse

func (TokenResponse) MarshalJSON 

func (t TokenResponse) MarshalJSON() ([]byte, error)

func (*TokenResponse) UnmarshalJSON 

func (t *TokenResponse) UnmarshalJSON(data []byte) error

type Verification 

type Verification struct {
	Name     string `yaml:"-"`
	Spec     string `yaml:"spec,omitempty"`
	Purpose  string `yaml:"purpose,omitempty"`
	Source   string `yaml:"source,omitempty"`
	Expected string `yaml:"expected,omitempty"`
	Received string `yaml:"received,omitempty"`
	Detail   string `yaml:"detail,omitempty"`
	Result   string `yaml:"result,omitempty"`
}

Verification is a client-side OAuth/OIDC check the CLI prints so each flow can be learned from stderr.

func VerifyIDToken 

func VerifyIDToken(idToken string, sconfig ServerConfig, cconfig ClientConfig, hc *http.Client) (map[string]interface{}, []Verification, error)

func VerifyIDTokenWithNonce 

func VerifyIDTokenWithNonce(idToken, expected string, sconfig ServerConfig, cconfig ClientConfig, hc *http.Client) (string, []Verification, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.