oidc

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type GenericProvider 

type GenericProvider struct {
	// contains filtered or unexported fields
}

GenericProvider implements any OIDC-compliant provider using coreos/go-oidc library

func NewGenericProvider 

func NewGenericProvider(ctx context.Context, issuerURL, clientID, clientSecret string, scopes []string) (*GenericProvider, error)

NewGenericProvider creates OIDC provider with automatic discovery and configuration

func (*GenericProvider) ExchangeCode 

func (p *GenericProvider) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*iam.OIDCTokenResponse, error)

ExchangeCode exchanges authorization code for access and ID tokens using PKCE

func (*GenericProvider) GetAuthorizationURL 

func (p *GenericProvider) GetAuthorizationURL(state, codeVerifier, redirectURI string) (string, error)

GetAuthorizationURL generates OAuth authorization URL with PKCE for secure public clients

func (*GenericProvider) GetUserInfo 

func (p *GenericProvider) GetUserInfo(ctx context.Context, accessToken string) (*iam.OIDCUserInfo, error)

GetUserInfo retrieves user profile from provider's userinfo endpoint

func (*GenericProvider) ValidateIDToken 

func (p *GenericProvider) ValidateIDToken(ctx context.Context, rawIDToken string) (*iam.OIDCClaims, error)

ValidateIDToken validates ID token signature and expiration, returns claims

type GitHubProvider 

type GitHubProvider struct {
	// contains filtered or unexported fields
}

GitHubProvider implements OAuth authentication for GitHub Note: GitHub uses OAuth 2.0 but doesn't fully support OIDC (no ID tokens)

func NewGitHubProvider 

func NewGitHubProvider(cfg *ProviderConfig) *GitHubProvider

NewGitHubProvider creates a new GitHub OAuth provider

func (*GitHubProvider) ExchangeCode 

func (g *GitHubProvider) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*iam.OIDCTokenResponse, error)

ExchangeCode exchanges an authorization code for tokens

func (*GitHubProvider) GetAuthorizationURL 

func (g *GitHubProvider) GetAuthorizationURL(state, codeVerifier, redirectURI string) (string, error)

GetAuthorizationURL generates the OAuth authorization URL with PKCE

func (*GitHubProvider) GetUserInfo 

func (g *GitHubProvider) GetUserInfo(ctx context.Context, accessToken string) (*iam.OIDCUserInfo, error)

GetUserInfo retrieves user information from GitHub's API

func (*GitHubProvider) ValidateIDToken 

func (g *GitHubProvider) ValidateIDToken(ctx context.Context, idToken string) (*iam.OIDCClaims, error)

ValidateIDToken validates and parses an ID token Note: GitHub doesn't support OIDC ID tokens, so this returns an error

type GoogleProvider 

type GoogleProvider struct {
	// contains filtered or unexported fields
}

GoogleProvider implements Google OIDC for individual OAuth login (not SSO)

func NewGoogleProvider 

func NewGoogleProvider(ctx context.Context, cfg *ProviderConfig) (*GoogleProvider, error)

func (*GoogleProvider) ExchangeCode 

func (g *GoogleProvider) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*iam.OIDCTokenResponse, error)

ExchangeCode exchanges authorization code for tokens with PKCE verification

func (*GoogleProvider) GetAuthorizationURL 

func (g *GoogleProvider) GetAuthorizationURL(state, codeVerifier, redirectURI string) (string, error)

GetAuthorizationURL generates Google OAuth URL with PKCE and consent prompt

func (*GoogleProvider) GetUserInfo 

func (g *GoogleProvider) GetUserInfo(ctx context.Context, accessToken string) (*iam.OIDCUserInfo, error)

GetUserInfo retrieves user information from the provider

func (*GoogleProvider) ValidateIDToken 

func (g *GoogleProvider) ValidateIDToken(ctx context.Context, idToken string) (*iam.OIDCClaims, error)

ValidateIDToken validates and parses an ID token

type MicrosoftProvider 

type MicrosoftProvider struct {
	// contains filtered or unexported fields
}

MicrosoftProvider implements OIDC authentication for Microsoft (Azure AD)

func NewMicrosoftProvider 

func NewMicrosoftProvider(ctx context.Context, cfg *ProviderConfig) (*MicrosoftProvider, error)

NewMicrosoftProvider creates a new Microsoft OIDC provider

func (*MicrosoftProvider) ExchangeCode 

func (m *MicrosoftProvider) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*iam.OIDCTokenResponse, error)

ExchangeCode exchanges an authorization code for tokens

func (*MicrosoftProvider) GetAuthorizationURL 

func (m *MicrosoftProvider) GetAuthorizationURL(state, codeVerifier, redirectURI string) (string, error)

GetAuthorizationURL generates the OAuth authorization URL with PKCE

func (*MicrosoftProvider) GetUserInfo 

func (m *MicrosoftProvider) GetUserInfo(ctx context.Context, accessToken string) (*iam.OIDCUserInfo, error)

GetUserInfo retrieves user information from the provider

func (*MicrosoftProvider) ValidateIDToken 

func (m *MicrosoftProvider) ValidateIDToken(ctx context.Context, idToken string) (*iam.OIDCClaims, error)

ValidateIDToken validates and parses an ID token

type OktaProvider 

type OktaProvider struct {
	// contains filtered or unexported fields
}

OktaProvider implements OIDC authentication for Okta

func NewOktaProvider 

func NewOktaProvider(ctx context.Context, domain, clientID, clientSecret, redirectURI string) (*OktaProvider, error)

NewOktaProvider creates a new Okta OIDC provider domain should be your Okta domain (e.g., "dev-12345.okta.com" or "example.okta.com")

func (*OktaProvider) ExchangeCode 

func (o *OktaProvider) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*iam.OIDCTokenResponse, error)

ExchangeCode exchanges an authorization code for tokens

func (*OktaProvider) GetAuthorizationURL 

func (o *OktaProvider) GetAuthorizationURL(state, codeVerifier, redirectURI string) (string, error)

GetAuthorizationURL generates the OAuth authorization URL with PKCE

func (*OktaProvider) GetUserInfo 

func (o *OktaProvider) GetUserInfo(ctx context.Context, accessToken string) (*iam.OIDCUserInfo, error)

GetUserInfo retrieves user information from the provider

func (*OktaProvider) ValidateIDToken 

func (o *OktaProvider) ValidateIDToken(ctx context.Context, idToken string) (*iam.OIDCClaims, error)

ValidateIDToken validates and parses an ID token

type ProviderConfig 

type ProviderConfig struct {
	ClientID     string
	ClientSecret string
	RedirectURI  string

	// OIDC providers (Google, Microsoft)
	IssuerURL string

	// Microsoft-specific
	TenantID string

	// GitHub-specific (plain OAuth2, not OIDC)
	AuthURL  string
	TokenURL string
	APIBase  string
}

ProviderConfig contains configuration for creating OAuth/OIDC providers

type ProviderFactory 

type ProviderFactory struct{}

ProviderFactory creates OIDC provider instances for tenant-specific SSO configurations

func NewProviderFactory 

func NewProviderFactory() *ProviderFactory

func (*ProviderFactory) NewProvider 

func (f *ProviderFactory) NewProvider(ctx context.Context, issuerURL, clientID, clientSecret string, scopes []string) (iam.OIDCProvider, error)

NewProvider creates a new OIDC provider instance with discovery and validation

type RegistrationClient 

type RegistrationClient struct {
	// contains filtered or unexported fields
}

RegistrationClient handles OIDC discovery and RFC 7591 dynamic client registration

func NewRegistrationClient 

func NewRegistrationClient() *RegistrationClient

func (*RegistrationClient) Discover 

func (c *RegistrationClient) Discover(ctx context.Context, issuerURL string) (*iam.OIDCDiscoveryMetadata, error)

Discover performs OIDC discovery to fetch provider metadata from .well-known endpoint

func (*RegistrationClient) Register 

func (c *RegistrationClient) Register(ctx context.Context, registrationEndpoint, callbackURL, clientName, accessToken string, scopes []string) (*iam.OIDCRegistration, error)

Register dynamically registers a new OAuth client with the OIDC provider (RFC 7591)

func (*RegistrationClient) Unregister 

func (c *RegistrationClient) Unregister(ctx context.Context, registrationClientURI, registrationAccessToken string) error

Unregister deletes a dynamically registered client (RFC 7592)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.