oidc

Documentation

Index

• Constants
• func AppendClaimsAuthenticationRequestParameter(opts []oauth2.AuthCodeOption, requestedClaims map[string]*oidc.Claim) []oauth2.AuthCodeOption
• func GetScopesOrDefault(scopes []string) []string
• func ImplicitFlowURL(c *oauth2.Config, state string, opts ...oauth2.AuthCodeOption) string
• func InferGrantType(oidcConf *OIDCConfiguration) string
• func OfflineAccess(scopes []string) bool
• type ClaimsRequest
• type ClientApp
  • func NewClientApp(settings *settings.ArgoCDSettings, cache OIDCStateStorage, ...) (*ClientApp, error)
  • func (a *ClientApp) HandleCallback(w http.ResponseWriter, r *http.Request)
  • func (a *ClientApp) HandleLogin(w http.ResponseWriter, r *http.Request)
• type OIDCConfiguration
  • func ParseConfig(provider *gooidc.Provider) (*OIDCConfiguration, error)
• type OIDCState
• type OIDCStateStorage
• type Provider
  • func NewOIDCProvider(issuerURL string, client *http.Client) Provider

Constants

const (
	GrantTypeAuthorizationCode = "authorization_code"
	GrantTypeImplicit          = "implicit"
	ResponseTypeCode           = "code"
)

Functions

func AppendClaimsAuthenticationRequestParameter

func AppendClaimsAuthenticationRequestParameter(opts []oauth2.AuthCodeOption, requestedClaims map[string]*oidc.Claim) []oauth2.AuthCodeOption

AppendClaimsAuthenticationRequestParameter appends a OIDC claims authentication request parameter to `opts` with the `requestedClaims`

func GetScopesOrDefault

func GetScopesOrDefault(scopes []string) []string

func ImplicitFlowURL

func ImplicitFlowURL(c *oauth2.Config, state string, opts ...oauth2.AuthCodeOption) string

ImplicitFlowURL is an adaptation of oauth2.Config::AuthCodeURL() which returns a URL appropriate for an OAuth2 implicit login flow (as opposed to authorization code flow).

func InferGrantType

func InferGrantType(oidcConf *OIDCConfiguration) string

InferGrantType infers the proper grant flow depending on the OAuth2 client config and OIDC configuration. Returns either: "authorization_code" or "implicit"

func OfflineAccess

func OfflineAccess(scopes []string) bool

OfflineAccess returns whether or not 'offline_access' is a supported scope

Types

type ClaimsRequest

type ClaimsRequest struct {
	IDToken map[string]*oidc.Claim `json:"id_token"`
}

type ClientApp

type ClientApp struct {
	// contains filtered or unexported fields
}

func NewClientApp

func NewClientApp(settings *settings.ArgoCDSettings, cache OIDCStateStorage, dexServerAddr, baseHRef string) (*ClientApp, error)

NewClientApp will register the Argo CD client app (either via Dex or external OIDC) and return an object which has HTTP handlers for handling the HTTP responses for login and callback

func (*ClientApp) HandleCallback

func (a *ClientApp) HandleCallback(w http.ResponseWriter, r *http.Request)

HandleCallback is the callback handler for an OAuth2 login flow

func (*ClientApp) HandleLogin

func (a *ClientApp) HandleLogin(w http.ResponseWriter, r *http.Request)

HandleLogin formulates the proper OAuth2 URL (auth code or implicit) and redirects the user to the IDp login & consent page

type OIDCConfiguration

type OIDCConfiguration struct {
	Issuer                 string   `json:"issuer"`
	ScopesSupported        []string `json:"scopes_supported"`
	ResponseTypesSupported []string `json:"response_types_supported"`
	GrantTypesSupported    []string `json:"grant_types_supported,omitempty"`
}

OIDCConfiguration holds a subset of interested fields from the OIDC configuration spec

func ParseConfig

func ParseConfig(provider *gooidc.Provider) (*OIDCConfiguration, error)

ParseConfig parses the OIDC Config into the concrete datastructure

type OIDCState

type OIDCState struct {
	// ReturnURL is the URL in which to redirect a user back to after completing an OAuth2 login
	ReturnURL string `json:"returnURL"`
}

type OIDCStateStorage

type OIDCStateStorage interface {
	GetOIDCState(key string) (*OIDCState, error)
	SetOIDCState(key string, state *OIDCState) error
}

type Provider

type Provider interface {
	Endpoint() (*oauth2.Endpoint, error)

	ParseConfig() (*OIDCConfiguration, error)

	Verify(clientID, tokenString string) (*gooidc.IDToken, error)
}

Provider is a wrapper around go-oidc provider to also provide the following features: 1. lazy initialization/querying of the provider 2. automatic detection of change in signing keys 3. convenience function for verifying tokens We have to initialize the provider lazily since Argo CD can be an OIDC client to itself (in the case of dex reverse proxy), which presents a chicken-and-egg problem of (1) serving dex over HTTP, and (2) querying the OIDC provider (ourself) to initialize the OIDC client.

func NewOIDCProvider

func NewOIDCProvider(issuerURL string, client *http.Client) Provider

NewOIDCProvider initializes an OIDC provider