auth

README

Auth

Authenticating and authorizing client/server applications.

Usage

go get github.com/worldline-go/auth

Check http example: example/http

Development

Keycloak

Run keycloak in docker

make keycloak

Open http://localhost:8080 and login with admin/admin.

Create a new realm called finops and add a new client called test.
Choice client type openid-connect. Enable Client Authentication and Authorization Enabled.

We connect with oauth2 transport with our client id and secret. In server side we use the public key to verify the token.

Public key id find in the realms key settings.

Documentation

Index

• Variables
• type Configurer
• type OptionJWK
  • func WithRefreshErrorHandler(fn func(err error)) OptionJWK
  • func WithRefreshInterval(d time.Duration) OptionJWK
  • func WithRefreshUnknownKID(v bool) OptionJWK
• type OptionParser
  • func WithJwt() OptionParser
• type Provider
  • func (p *Provider) ActiveProvider() (Configurer, error)
  • func (p *Provider) GetJwks(ctx context.Context, opts ...OptionJWK) (*keyfunc.JWKS, error)
  • func (p *Provider) Parser(ctx context.Context, opts ...OptionParser) (func(string, jwt.Claims) (*jwt.Token, error), func(), error)
  • func (p *Provider) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)
  • func (p *Provider) RoundTripperMust(ctx context.Context, transport http.RoundTripper) http.RoundTripper
  • func (p Provider) SetActiveProvider(name string) *Provider

Variables

var ErrTokenInvalid = fmt.Errorf("token is invalid")

Types

type Configurer

type Configurer interface {
	Config() (*clientcredentials.Config, error)
	// CertURL returns the certificate URL and the public key-id.
	CertURL() (string, error)

	GetTokenURL() (string, error)
	GetAuthURL() (string, error)
	GetClientID() string
	GetClientSecret() string
}

type OptionJWK

type OptionJWK func(options *optionsJWK)

func WithRefreshErrorHandler

func WithRefreshErrorHandler(fn func(err error)) OptionJWK

func WithRefreshInterval

func WithRefreshInterval(d time.Duration) OptionJWK

WithRefreshInterval sets the refresh interval for the jwt.Keyfunc default is 5 minutes.

func WithRefreshUnknownKID

func WithRefreshUnknownKID(v bool) OptionJWK

type OptionParser

type OptionParser func(options *optionsParser)

func WithJwt

func WithJwt() OptionParser

type Provider

type Provider struct {
	Active   string              `cfg:"active"`
	Keycloak *providers.KeyCloak `cfg:"keycloak"`
}

func (*Provider) ActiveProvider

func (p *Provider) ActiveProvider() (Configurer, error)

ActiveProvider returns the active provider or the first provider if none is active.

func (*Provider) GetJwks

func (p *Provider) GetJwks(ctx context.Context, opts ...OptionJWK) (*keyfunc.JWKS, error)

GetJwks returns a jwt.Keyfunc.

func (*Provider) Parser

func (p *Provider) Parser(ctx context.Context, opts ...OptionParser) (func(string, jwt.Claims) (*jwt.Token, error), func(), error)

Parser returns a function to parse a token and a function to stop the background refresh certs.

func (*Provider) RoundTripper

func (p *Provider) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)

RoundTripper returns a new RoundTripper that adds an OAuth2 Authorization header.

func (*Provider) RoundTripperMust

func (p *Provider) RoundTripperMust(ctx context.Context, transport http.RoundTripper) http.RoundTripper

func (Provider) SetActiveProvider

func (p Provider) SetActiveProvider(name string) *Provider

SetActiveProvider return the provider with the given name as active without modifying the original provider.