upstreamoidc

Documentation

Overview

Package upstreamoidc implements an abstraction of upstream OIDC provider interactions.

Index

• func New(config *oauth2.Config, provider *coreosoidc.Provider, client *http.Client) provider.UpstreamOIDCIdentityProviderI
• type ProviderConfig
  • func (p *ProviderConfig) AllowsPasswordGrant() bool
  • func (p *ProviderConfig) ExchangeAuthcodeAndValidateTokens(ctx context.Context, authcode string, pkceCodeVerifier pkce.Code, ...) (*oidctypes.Token, error)
  • func (p *ProviderConfig) GetAdditionalAuthcodeParams() map[string]string
  • func (p *ProviderConfig) GetAdditionalClaimMappings() map[string]string
  • func (p *ProviderConfig) GetAuthorizationURL() *url.URL
  • func (p *ProviderConfig) GetClientID() string
  • func (p *ProviderConfig) GetGroupsClaim() string
  • func (p *ProviderConfig) GetName() string
  • func (p *ProviderConfig) GetResourceUID() types.UID
  • func (p *ProviderConfig) GetRevocationURL() *url.URL
  • func (p *ProviderConfig) GetScopes() []string
  • func (p *ProviderConfig) GetUsernameClaim() string
  • func (p *ProviderConfig) HasUserInfoURL() bool
  • func (p *ProviderConfig) PasswordCredentialsGrantAndValidateTokens(ctx context.Context, username, password string) (*oidctypes.Token, error)
  • func (p *ProviderConfig) PerformRefresh(ctx context.Context, refreshToken string) (*oauth2.Token, error)
  • func (p *ProviderConfig) RevokeToken(ctx context.Context, token string, tokenType provider.RevocableTokenType) error
  • func (p *ProviderConfig) ValidateTokenAndMergeWithUserInfo(ctx context.Context, tok *oauth2.Token, expectedIDTokenNonce nonce.Nonce, ...) (*oidctypes.Token, error)

Functions

func New

func New(config *oauth2.Config, provider *coreosoidc.Provider, client *http.Client) provider.UpstreamOIDCIdentityProviderI

Types

type ProviderConfig

type ProviderConfig struct {
	Name                     string
	ResourceUID              types.UID
	UsernameClaim            string
	GroupsClaim              string
	Config                   *oauth2.Config
	Client                   *http.Client
	AllowPasswordGrant       bool
	AdditionalAuthcodeParams map[string]string
	AdditionalClaimMappings  map[string]string
	RevocationURL            *url.URL // will commonly be nil: many providers do not offer this
	Provider                 interface {
		Verifier(*coreosoidc.Config) *coreosoidc.IDTokenVerifier
		Claims(v interface{}) error
		UserInfo(ctx context.Context, tokenSource oauth2.TokenSource) (*coreosoidc.UserInfo, error)
	}
}

ProviderConfig holds the active configuration of an upstream OIDC provider.

func (*ProviderConfig) AllowsPasswordGrant

func (p *ProviderConfig) AllowsPasswordGrant() bool

func (*ProviderConfig) ExchangeAuthcodeAndValidateTokens

func (p *ProviderConfig) ExchangeAuthcodeAndValidateTokens(ctx context.Context, authcode string, pkceCodeVerifier pkce.Code, expectedIDTokenNonce nonce.Nonce, redirectURI string) (*oidctypes.Token, error)

func (*ProviderConfig) GetAdditionalAuthcodeParams

func (p *ProviderConfig) GetAdditionalAuthcodeParams() map[string]string

func (*ProviderConfig) GetAdditionalClaimMappings

func (p *ProviderConfig) GetAdditionalClaimMappings() map[string]string

func (*ProviderConfig) GetAuthorizationURL

func (p *ProviderConfig) GetAuthorizationURL() *url.URL

func (*ProviderConfig) GetClientID

func (p *ProviderConfig) GetClientID() string

func (*ProviderConfig) GetGroupsClaim

func (p *ProviderConfig) GetGroupsClaim() string

func (*ProviderConfig) GetName

func (p *ProviderConfig) GetName() string

func (*ProviderConfig) GetResourceUID

func (p *ProviderConfig) GetResourceUID() types.UID

func (*ProviderConfig) GetRevocationURL

func (p *ProviderConfig) GetRevocationURL() *url.URL

func (*ProviderConfig) GetScopes

func (p *ProviderConfig) GetScopes() []string

func (*ProviderConfig) GetUsernameClaim

func (p *ProviderConfig) GetUsernameClaim() string

func (*ProviderConfig) HasUserInfoURL

func (p *ProviderConfig) HasUserInfoURL() bool

func (*ProviderConfig) PasswordCredentialsGrantAndValidateTokens

func (p *ProviderConfig) PasswordCredentialsGrantAndValidateTokens(ctx context.Context, username, password string) (*oidctypes.Token, error)

func (*ProviderConfig) PerformRefresh

func (p *ProviderConfig) PerformRefresh(ctx context.Context, refreshToken string) (*oauth2.Token, error)

func (*ProviderConfig) RevokeToken

func (p *ProviderConfig) RevokeToken(ctx context.Context, token string, tokenType provider.RevocableTokenType) error

RevokeToken will attempt to revoke the given token, if the provider has a revocation endpoint. It may return an error wrapped by a RetryableRevocationError, which is an error indicating that it may be worth trying to revoke the same token again later. Any other error returned should be assumed to represent an error such that it is not worth retrying revocation later, even though revocation failed.

func (*ProviderConfig) ValidateTokenAndMergeWithUserInfo

func (p *ProviderConfig) ValidateTokenAndMergeWithUserInfo(ctx context.Context, tok *oauth2.Token, expectedIDTokenNonce nonce.Nonce, requireIDToken bool, requireUserInfo bool) (*oidctypes.Token, error)

ValidateTokenAndMergeWithUserInfo will validate the ID token. It will also merge the claims from the userinfo endpoint response, if the provider offers the userinfo endpoint.