auth

README

Auth

Authenticating and authorizing client/server applications.

Usage

go get github.com/worldline-go/auth

Check http example: example/http

Client

Client is usefull to send request with oauth2 token.

First set a provider.

var providerClient = auth.Provider{
	Keycloak: &providers.KeyCloak{
		ClientID:     "test",
		ClientSecret: "GbkxWi8ZBJvMv2Wsh03JbX183xKAPrEs",
        // Keycloak server url
		BaseURL:      "http://localhost:8080",
		Realm:        "finops",
        // Scopes is optional
		Scopes:       []string{"openid", "profile", "email", "offline_access"},
	},
}

Then when you create a http.Client you can use the oauth2 transport.

provider := providerClient.ActiveProvider()
if == nil {
	return fmt.Errorf("no active provider")
}

roundTripper, err := provider.RoundTripper(ctx, http.DefaultTransport)
if err != nil {
	return fmt.Errorf("creating round tripper: %w", err)
}

client := &http.Client{
    Transport: roundTripper,
}

Now you can make request with this client.

Server

Check the token in the request. Just need to url of keycloak server and the realm.

var providerServer = auth.Provider{
	Keycloak: &providers.KeyCloak{
        // Keycloak server url
		BaseURL: "http://localhost:8080",
		Realm:   "finops",
	},
}

Then you can check the token in the request.

This is the http based, very simple function but check the our echo middleware to much more advanced operations.

provider := providerServer.ActiveProvider()
if provider == nil {
	return fmt.Errorf("no active provider")
}

keyFunc, err := provider.JWTKeyFunc(auth.WithContext(ctx))
if err != nil {
	return fmt.Errorf("creating parser: %w", err)
}

// if you don't use the context cancelation, you can use this
// defer keyFunc.EndBackground()

// Check the token in the request
claimsValue := claims.Custom{}
token, err := keyFunc.Parser(tokenToCheck, &claimsValue)
if err != nil {
    return fmt.Errorf("token 👎: %w", err)
}

Redirection Flow

When enabled redirection in the middleware, the user will be redirected to the oauth2 login page.

This is not a standard flow and we can change update it any time.
Code for echo middleware is here.

Documentation

Index

• Variables
• func IsRefreshNeed(accessToken string) (bool, error)
• type InfJWTKeyFunc
• type InfProvider
• type InfProviderExtra
• type JWTKeyFunc
  • func (j *JWTKeyFunc) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)
• type Noop
  • func (Noop) ClientConfig() (*clientcredentials.Config, error)
  • func (Noop) GetAuthURL() string
  • func (Noop) GetCertURL() string
  • func (Noop) GetClientID() string
  • func (Noop) GetClientSecret() string
  • func (Noop) GetTokenURL() string
  • func (Noop) IsNoop() bool
  • func (Noop) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)
  • func (Noop) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)
  • func (Noop) RoundTripperWrapper(_ *clientcredentials.Config) func(_ context.Context, transport http.RoundTripper) http.RoundTripper
• type NoopJWTKey
  • func (NoopJWTKey) EndBackground()
  • func (NoopJWTKey) Keyfunc(token *jwt.Token) (interface{}, error)
  • func (NoopJWTKey) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)
• type OptionActiveProvider
  • func WithNoop(v bool) OptionActiveProvider
• type OptionJWK
  • func WithClient(client *http.Client) OptionJWK
  • func WithContext(ctx context.Context) OptionJWK
  • func WithRefreshErrorHandler(fn func(err error)) OptionJWK
  • func WithRefreshInterval(d time.Duration) OptionJWK
  • func WithRefreshUnknownKID(v bool) OptionJWK
• type Provider
  • func (p *Provider) ActiveProvider(opts ...OptionActiveProvider) (ret InfProviderExtra)
  • func (p Provider) SetActiveProvider(name string) *Provider
• type ProviderExtra
  • func (p *ProviderExtra) IsNoop() bool
  • func (p *ProviderExtra) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)
  • func (p *ProviderExtra) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)
  • func (p *ProviderExtra) RoundTripperWrapper(cfg *clientcredentials.Config) func(ctx context.Context, transport http.RoundTripper) http.RoundTripper

Variables

var DefaultExpireDuration = time.Second * 10

DefaultExpireDuration is the default duration to check if the access token is about to expire.

var ErrTokenInvalid = fmt.Errorf("token is invalid")

Functions

func IsRefreshNeed

func IsRefreshNeed(accessToken string) (bool, error)

IsRefreshNeed checks if the access token is about to expire.

Types

type InfJWTKeyFunc

type InfJWTKeyFunc interface {
	Keyfunc(token *jwt.Token) (interface{}, error)
	EndBackground()
	Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)
}

type InfProvider

type InfProvider interface {
	ClientConfig() (*clientcredentials.Config, error)

	GetCertURL() string
	GetTokenURL() string
	GetAuthURL() string
	GetClientID() string
	GetClientSecret() string
}

type InfProviderExtra

type InfProviderExtra interface {
	InfProvider
	// JWTKeyFunc returns the JWT key used to verify the token.
	JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)
	IsNoop() bool
	RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)
	RoundTripperWrapper(cfg *clientcredentials.Config) func(ctx context.Context, transport http.RoundTripper) http.RoundTripper
}

type JWTKeyFunc

type JWTKeyFunc struct {
	*keyfunc.JWKS
}

func (*JWTKeyFunc) Parser

func (j *JWTKeyFunc) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)

type Noop

type Noop struct{}

func (Noop) ClientConfig

func (Noop) ClientConfig() (*clientcredentials.Config, error)

func (Noop) GetAuthURL

func (Noop) GetAuthURL() string

func (Noop) GetCertURL

func (Noop) GetCertURL() string

func (Noop) GetClientID

func (Noop) GetClientID() string

func (Noop) GetClientSecret

func (Noop) GetClientSecret() string

func (Noop) GetTokenURL

func (Noop) GetTokenURL() string

func (Noop) IsNoop

func (Noop) IsNoop() bool

func (Noop) JWTKeyFunc

func (Noop) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)

func (Noop) RoundTripper

func (Noop) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)

func (Noop) RoundTripperWrapper

func (Noop) RoundTripperWrapper(_ *clientcredentials.Config) func(_ context.Context, transport http.RoundTripper) http.RoundTripper

type NoopJWTKey

type NoopJWTKey struct{}

func (NoopJWTKey) EndBackground

func (NoopJWTKey) EndBackground()

func (NoopJWTKey) Keyfunc

func (NoopJWTKey) Keyfunc(token *jwt.Token) (interface{}, error)

func (NoopJWTKey) Parser

func (NoopJWTKey) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)

type OptionActiveProvider

type OptionActiveProvider func(options *optionsActiveProvider)

func WithNoop

func WithNoop(v bool) OptionActiveProvider

WithNoop sets the active provider to noop.

type OptionJWK

type OptionJWK func(options *optionsJWK)

func WithClient

func WithClient(client *http.Client) OptionJWK

WithClient is used to set the http.Client used to fetch the JWKs.

func WithContext

func WithContext(ctx context.Context) OptionJWK

WithContext is used to set the context used to fetch the JWKs.

func WithRefreshErrorHandler

func WithRefreshErrorHandler(fn func(err error)) OptionJWK

WithRefreshErrorHandler sets the refresh error handler for the jwt.Key.

func WithRefreshInterval

func WithRefreshInterval(d time.Duration) OptionJWK

WithRefreshInterval sets the refresh interval for the jwt.Keyfunc default is 5 minutes.

func WithRefreshUnknownKID

func WithRefreshUnknownKID(v bool) OptionJWK

WithRefreshUnknownKID sets the refresh unknown KID for the jwt.Key, default is false.

type Provider

type Provider struct {
	// Active is the name of the active provider, if empty the first provider is used.
	//
	// If set to "noop" the Noop provider is used.
	Active   string              `cfg:"active"`
	Keycloak *providers.KeyCloak `cfg:"keycloak"`
}

func (*Provider) ActiveProvider

func (p *Provider) ActiveProvider(opts ...OptionActiveProvider) (ret InfProviderExtra)

ActiveProvider returns the active provider or the first provider if none is active.

Returns nil if no provider is configured.

func (Provider) SetActiveProvider

func (p Provider) SetActiveProvider(name string) *Provider

SetActiveProvider return the provider with the given name as active without modifying the original provider.

type ProviderExtra

type ProviderExtra struct {
	InfProvider
	// contains filtered or unexported fields
}

func (*ProviderExtra) IsNoop

func (p *ProviderExtra) IsNoop() bool

func (*ProviderExtra) JWTKeyFunc

func (p *ProviderExtra) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)

JWTKeyFunc returns a jwt.Keyfunc.

Need GetCertURL in provider.

func (*ProviderExtra) RoundTripper

func (p *ProviderExtra) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)

RoundTripper returns a new RoundTripper that adds an OAuth2 Transport.

Uses provider's ClientConfig.

func (*ProviderExtra) RoundTripperWrapper

func (p *ProviderExtra) RoundTripperWrapper(cfg *clientcredentials.Config) func(ctx context.Context, transport http.RoundTripper) http.RoundTripper