auth

package module
v0.4.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 17, 2023 License: MIT Imports: 14 Imported by: 6

README

Auth

Authenticating and authorizing client/server applications.

Usage

go get github.com/worldline-go/auth

Check http example: example/http

Client

Client is usefull to send request with oauth2 token.

First set a provider.

var providerClient = auth.Provider{
	Keycloak: &providers.KeyCloak{
		ClientID:     "test",
		ClientSecret: "GbkxWi8ZBJvMv2Wsh03JbX183xKAPrEs",
        // Keycloak server url
		BaseURL:      "http://localhost:8080",
		Realm:        "finops",
        // Scopes is optional
		Scopes:       []string{"openid", "profile", "email", "offline_access"},
	},
}

Then when you create a http.Client you can use the oauth2 transport.

provider := providerClient.ActiveProvider()
if == nil {
	return fmt.Errorf("no active provider")
}

roundTripper, err := provider.RoundTripper(ctx, http.DefaultTransport)
if err != nil {
	return fmt.Errorf("creating round tripper: %w", err)
}

client := &http.Client{
    Transport: roundTripper,
}

Now you can make request with this client.

Server

Check the token in the request. Just need to url of keycloak server and the realm.

var providerServer = auth.Provider{
	Keycloak: &providers.KeyCloak{
        // Keycloak server url
		BaseURL: "http://localhost:8080",
		Realm:   "finops",
	},
}

Then you can check the token in the request.

This is the http based, very simple function but check the our echo middleware to much more advanced operations.

provider := providerServer.ActiveProvider()
if provider == nil {
	return fmt.Errorf("no active provider")
}

keyFunc, err := provider.JWTKeyFunc(auth.WithContext(ctx))
if err != nil {
	return fmt.Errorf("creating parser: %w", err)
}

// if you don't use the context cancelation, you can use this
// defer keyFunc.EndBackground()

// Check the token in the request
claimsValue := claims.Custom{}
token, err := keyFunc.Parser(tokenToCheck, &claimsValue)
if err != nil {
    return fmt.Errorf("token 👎: %w", err)
}

Redirection Flow

When enabled redirection in the middleware, the user will be redirected to the oauth2 login page.

This is not a standard flow and we can change update it any time.
Code for echo middleware is here.

Redirection Flow

Documentation

Index

Constants

View Source 
const (
	ProviderKeycloakKey = "keycloak"
	ProviderGenericKey  = "generic"
	ProviderNoopKey     = "noop"
)
View Source 
const NoopKey = "noop"

Variables

View Source 
var DefaultExpireDuration = time.Second * 10

DefaultExpireDuration is the default duration to check if the access token is about to expire.

View Source 
var ErrTokenInvalid = fmt.Errorf("token is invalid")
View Source 
var IntrospectKey = "introspect"

Functions

func IsRefreshNeed added in v0.4.1 

func IsRefreshNeed(accessToken string) (bool, error)

IsRefreshNeed checks if the access token is about to expire.

func ParseUnverified added in v0.4.8 

func ParseUnverified(accessToken string) *jwt.MapClaims

Types

type InfJWTKeyFunc added in v0.4.0 

type InfJWTKeyFunc interface {
	Keyfunc(token *jwt.Token) (interface{}, error)
	EndBackground()
	Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)
}

type InfProvider added in v0.4.0 

type InfProvider interface {
	ClientConfig() (*clientcredentials.Config, error)

	GetCertURL() string
	GetTokenURL() string
	GetAuthURL() string
	GetClientID() string
	GetClientSecret() string
	GetScopes() []string
	GetIntrospectURL() string
}

type InfProviderExtra added in v0.4.0 

type InfProviderExtra interface {
	InfProvider
	// JWTKeyFunc returns the JWT key used to verify the token.
	JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)
	IsNoop() bool
	RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)
	RoundTripperWrapper(cfg *clientcredentials.Config) func(ctx context.Context, transport http.RoundTripper) http.RoundTripper
}

type IntrospectJWTKey added in v0.4.8 

type IntrospectJWTKey struct {
	URL          string
	ClientID     string
	ClientSecret string

	Client *http.Client
	Ctx    context.Context
}

func (IntrospectJWTKey) CheckIntrospect added in v0.4.8 

func (i IntrospectJWTKey) CheckIntrospect(token string) error

func (IntrospectJWTKey) EndBackground added in v0.4.8 

func (IntrospectJWTKey) EndBackground()

func (IntrospectJWTKey) Keyfunc added in v0.4.8 

func (IntrospectJWTKey) Keyfunc(token *jwt.Token) (interface{}, error)

func (IntrospectJWTKey) Parser added in v0.4.8 

func (i IntrospectJWTKey) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)

type JWTKeyFunc added in v0.4.0 

type JWTKeyFunc struct {
	*keyfunc.JWKS
}

func (*JWTKeyFunc) Parser added in v0.4.0 

func (j *JWTKeyFunc) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)

type Noop added in v0.4.0 

type Noop struct{}

func (Noop) ClientConfig added in v0.4.0 

func (Noop) ClientConfig() (*clientcredentials.Config, error)

func (Noop) GetAuthURL added in v0.4.0 

func (Noop) GetAuthURL() string

func (Noop) GetCertURL added in v0.4.0 

func (Noop) GetCertURL() string

func (Noop) GetClientID added in v0.4.0 

func (Noop) GetClientID() string

func (Noop) GetClientSecret added in v0.4.0 

func (Noop) GetClientSecret() string

func (Noop) GetIntrospectURL added in v0.4.8 

func (Noop) GetIntrospectURL() string

func (Noop) GetScopes added in v0.4.8 

func (Noop) GetScopes() []string

func (Noop) GetTokenURL added in v0.4.0 

func (Noop) GetTokenURL() string

func (Noop) IsNoop added in v0.4.0 

func (Noop) IsNoop() bool

func (Noop) JWTKeyFunc added in v0.4.0 

func (Noop) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)

func (Noop) RoundTripper added in v0.4.2 

func (Noop) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)

func (Noop) RoundTripperWrapper added in v0.4.5 

func (Noop) RoundTripperWrapper(_ *clientcredentials.Config) func(_ context.Context, transport http.RoundTripper) http.RoundTripper

type NoopJWTKey added in v0.4.0 

type NoopJWTKey struct{}

func (NoopJWTKey) EndBackground added in v0.4.0 

func (NoopJWTKey) EndBackground()

func (NoopJWTKey) Keyfunc added in v0.4.0 

func (NoopJWTKey) Keyfunc(token *jwt.Token) (interface{}, error)

func (NoopJWTKey) Parser added in v0.4.0 

func (NoopJWTKey) Parser(tokenString string, claims jwt.Claims) (*jwt.Token, error)

type OptionActiveProvider added in v0.4.0 

type OptionActiveProvider func(options *optionsActiveProvider)

func WithNoop added in v0.4.0 

func WithNoop(v bool) OptionActiveProvider

WithNoop sets the active provider to noop.

type OptionJWK 

type OptionJWK func(options *optionsJWK)

func WithClient added in v0.2.2 

func WithClient(client *http.Client) OptionJWK

WithClient is used to set the http.Client used to fetch the JWKs.

func WithContext added in v0.4.5 

func WithContext(ctx context.Context) OptionJWK

WithContext is used to set the context used to fetch the JWKs.

func WithIntrospect added in v0.4.8 

func WithIntrospect(v bool) OptionJWK

func WithRefreshErrorHandler 

func WithRefreshErrorHandler(fn func(err error)) OptionJWK

WithRefreshErrorHandler sets the refresh error handler for the jwt.Key.

func WithRefreshInterval added in v0.2.0 

func WithRefreshInterval(d time.Duration) OptionJWK

WithRefreshInterval sets the refresh interval for the jwt.Keyfunc default is 5 minutes.

func WithRefreshUnknownKID added in v0.2.0 

func WithRefreshUnknownKID(v bool) OptionJWK

WithRefreshUnknownKID sets the refresh unknown KID for the jwt.Key, default is false.

type Provider 

type Provider struct {
	// Active is the name of the active provider, if empty the first provider is used.
	//
	// If set to "noop" the Noop provider is used.
	Active   string              `cfg:"active"`
	Keycloak *providers.KeyCloak `cfg:"keycloak"`
	Generic  *providers.Generic  `cfg:"generic"`
}

func (*Provider) ActiveProvider 

func (p *Provider) ActiveProvider(opts ...OptionActiveProvider) (ret InfProviderExtra)

ActiveProvider returns the active provider or the first provider if none is active.

Returns nil if no provider is configured.

func (Provider) SetActiveProvider 

func (p Provider) SetActiveProvider(name string) *Provider

SetActiveProvider return the provider with the given name as active without modifying the original provider.

type ProviderExtra added in v0.4.0 

type ProviderExtra struct {
	InfProvider
	// contains filtered or unexported fields
}

func (*ProviderExtra) IsNoop added in v0.4.0 

func (p *ProviderExtra) IsNoop() bool

func (*ProviderExtra) JWTKeyFunc added in v0.4.0 

func (p *ProviderExtra) JWTKeyFunc(opts ...OptionJWK) (InfJWTKeyFunc, error)

JWTKeyFunc returns a jwt.Keyfunc.

Need GetCertURL in provider.

If introspect is true, the introspect endpoint is used to verify the token. Use Parser function for introspect, not keyfunc.

func (*ProviderExtra) RoundTripper added in v0.4.2 

func (p *ProviderExtra) RoundTripper(ctx context.Context, transport http.RoundTripper) (http.RoundTripper, error)

RoundTripper returns a new RoundTripper that adds an OAuth2 Transport.

Uses provider's ClientConfig.

func (*ProviderExtra) RoundTripperWrapper added in v0.4.5 

func (p *ProviderExtra) RoundTripperWrapper(cfg *clientcredentials.Config) func(ctx context.Context, transport http.RoundTripper) http.RoundTripper

type RestIntrospect added in v0.4.8 

type RestIntrospect struct {
	Active bool `json:"active"`
}

Source Files

View all Source files

Directories

Path Synopsis
example
http module
middlewares
authecho module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.