Documentation
¶
Index ¶
- Variables
- func LocalUsername(provider, subject, claimed string) string
- func ProviderContext(ctx context.Context) context.Context
- type GenericOIDCClient
- type IdentityClaims
- type KySignOnClient
- func (k *KySignOnClient) BuildAuthURL(ctx context.Context, redirectURI, state, verifier, nonce string) (string, error)
- func (k *KySignOnClient) ExchangeCode(ctx context.Context, code, verifier, redirectURI, expectedNonce string) (*IdentityClaims, error)
- func (k *KySignOnClient) HandleSyncWebhook(ctx context.Context, body []byte, signature string) error
- type KySignOnSyncPayload
- type Provider
- type SAMLServiceProvider
- type SSOState
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidState = errors.New("invalid or expired SSO state") ErrInvalidIDToken = errors.New("invalid ID token") ErrProviderDisabled = errors.New("SSO provider is not enabled") )
var ErrUsernameTaken = errors.New("username is taken by another account")
ErrUsernameTaken refuses a directory user whose username matches an existing account ignoring case: sign-in matches LOWER(username), and a directory's claim is never a link to that account.
Functions ¶
func LocalUsername ¶
LocalUsername is the account name for a provider's claimed username: the claim when it passes auth.ValidateUsername, otherwise "sso_" and a hash of provider and subject, stable per identity.
Types ¶
type GenericOIDCClient ¶
type GenericOIDCClient struct {
// contains filtered or unexported fields
}
func NewGenericOIDCClient ¶
func NewGenericOIDCClient(cfg config.SSOConfig, _ store.Store) *GenericOIDCClient
func (*GenericOIDCClient) BuildAuthURL ¶
func (*GenericOIDCClient) ExchangeCode ¶
func (g *GenericOIDCClient) ExchangeCode(ctx context.Context, code, verifier, redirectURI, expectedNonce string) (*IdentityClaims, error)
type IdentityClaims ¶
type IdentityClaims struct {
Issuer string `json:"iss"`
AppRoles []string `json:"app_roles,omitempty"`
Subject string `json:"sub"`
Email string `json:"email"`
Name string `json:"name"`
PreferredUsername string `json:"preferred_username"`
Role string `json:"role,omitempty"`
Provider string `json:"provider"` // "kysignon", "oidc", "saml"
}
IdentityClaims holds the unified identity extracted from any SSO provider.
type KySignOnClient ¶
type KySignOnClient struct {
// contains filtered or unexported fields
}
KySignOnClient manages interactions with the central KySignOn identity provider.
func NewKySignOnClient ¶
func NewKySignOnClient(cfg config.SSOConfig, st store.Store) *KySignOnClient
func (*KySignOnClient) BuildAuthURL ¶
func (k *KySignOnClient) BuildAuthURL(ctx context.Context, redirectURI, state, verifier, nonce string) (string, error)
BuildAuthURL generates the authorization code URL with PKCE for KySignOn.
func (*KySignOnClient) ExchangeCode ¶
func (k *KySignOnClient) ExchangeCode(ctx context.Context, code, verifier, redirectURI, expectedNonce string) (*IdentityClaims, error)
ExchangeCode exchanges the authorization code and verifier for identity claims.
func (*KySignOnClient) HandleSyncWebhook ¶
func (k *KySignOnClient) HandleSyncWebhook(ctx context.Context, body []byte, signature string) error
HandleSyncWebhook processes inbound HMAC-SHA256 signed user updates from KySignOn server. Each signed event applies at most once and never after a newer event for the same user.
type KySignOnSyncPayload ¶
type KySignOnSyncPayload struct {
Event string `json:"event"` // "user.created", "user.updated", "user.deactivated", "user.deleted"
EventID string `json:"event_id"` // unique per event; an event applies once
ID string `json:"id"` // the user's stable subject
Username string `json:"username"`
Email string `json:"email"`
DisplayName string `json:"display_name"`
Role string `json:"role"`
Status string `json:"status"`
Timestamp int64 `json:"timestamp"`
}
KySignOnSyncPayload defines the schema received during automatic directory replication webhooks.
type Provider ¶
type Provider struct {
InstallerManaged bool `json:"installer_managed,omitempty"`
CallbackURL string `json:"callback_url,omitempty"`
ID string `json:"id"`
Name string `json:"name"`
Kind string `json:"kind"`
Issuer string `json:"issuer"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret,omitempty"`
AuthorizationURL string `json:"authorization_url"`
TokenURL string `json:"token_url"`
UserInfoURL string `json:"userinfo_url"`
Scopes string `json:"scopes"`
SubjectField string `json:"subject_field"`
UsernameField string `json:"username_field"`
NameField string `json:"name_field"`
EmailField string `json:"email_field"`
AuthMethod string `json:"auth_method"`
Enabled bool `json:"enabled"`
AutoProvision bool `json:"auto_provision"`
SecretSet bool `json:"secret_set,omitempty"`
}
Provider supports OIDC discovery and OAuth2 providers with a JSON profile API. The subject mapping must name a stable provider-issued account ID, never an email.
type SAMLServiceProvider ¶
func NewSAMLServiceProvider ¶
func NewSAMLServiceProvider(entityID, acsURL string) *SAMLServiceProvider
func (*SAMLServiceProvider) GenerateMetadata ¶
func (s *SAMLServiceProvider) GenerateMetadata() string
Source Files