sso

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 28, 2026 License: MIT Imports: 24 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrInvalidState       = errors.New("invalid or expired SSO state")
	ErrInvalidIDToken     = errors.New("invalid ID token")
	ErrProviderDisabled   = errors.New("SSO provider is not enabled")
	ErrInvalidLogoutToken = errors.New("invalid logout token")
)
View Source 
var ErrUsernameTaken = errors.New("username is taken by another account")

ErrUsernameTaken refuses a directory user whose username matches an existing account ignoring case: sign-in matches LOWER(username), and a directory's claim is never a link to that account.

Functions

func LocalUsername 

func LocalUsername(provider, subject, claimed string) string

LocalUsername is the account name for a provider's claimed username: the claim when it passes auth.ValidateUsername, otherwise "sso_" and a hash of provider and subject, stable per identity.

func ProviderContext 

func ProviderContext(ctx context.Context) context.Context

Types

type GenericOIDCClient 

type GenericOIDCClient struct {
	// contains filtered or unexported fields
}

func NewGenericOIDCClient 

func NewGenericOIDCClient(cfg config.SSOConfig, _ store.Store) *GenericOIDCClient

func (*GenericOIDCClient) BuildAuthURL 

func (g *GenericOIDCClient) BuildAuthURL(ctx context.Context, redirectURI, state, verifier, nonce string) (string, error)

func (*GenericOIDCClient) ExchangeCode 

func (g *GenericOIDCClient) ExchangeCode(ctx context.Context, code, verifier, redirectURI, expectedNonce string) (*IdentityClaims, error)

type IdentityClaims 

type IdentityClaims struct {
	Issuer            string   `json:"iss"`
	AppRoles          []string `json:"roles,omitempty"`
	Subject           string   `json:"sub"`
	Email             string   `json:"email"`
	Name              string   `json:"name"`
	PreferredUsername string   `json:"preferred_username"`
	Role              string   `json:"role,omitempty"`
	Provider          string   `json:"provider"` // "kysignon", "oidc", "saml"
	// SessionID is the ID token `sid`; back-channel logout names the login by it.
	SessionID string `json:"sid,omitempty"`
	// IssuedAt is the ID token's iat: when the provider vouched for this login.
	IssuedAt time.Time `json:"-"`
}

IdentityClaims holds the unified identity extracted from any SSO provider.

type KySignOnClient 

type KySignOnClient struct {
	// contains filtered or unexported fields
}

KySignOnClient manages interactions with the central KySignOn identity provider.

func NewKySignOnClient 

func NewKySignOnClient(cfg config.SSOConfig, st store.Store) *KySignOnClient

func (*KySignOnClient) BuildAuthURL 

func (k *KySignOnClient) BuildAuthURL(ctx context.Context, redirectURI, state, verifier, nonce string) (string, error)

BuildAuthURL generates the authorization code URL with PKCE for KySignOn.

func (*KySignOnClient) ExchangeCode 

func (k *KySignOnClient) ExchangeCode(ctx context.Context, code, verifier, redirectURI, expectedNonce string) (*IdentityClaims, error)

ExchangeCode exchanges the authorization code and verifier for identity claims.

func (*KySignOnClient) HandleSyncWebhook 

func (k *KySignOnClient) HandleSyncWebhook(ctx context.Context, body []byte, signature string) error

HandleSyncWebhook processes inbound HMAC-SHA256 signed user updates from KySignOn server. Each signed event applies at most once and never after a newer event for the same user.

type KySignOnSyncPayload 

type KySignOnSyncPayload struct {
	Event       string `json:"event"`    // "user.created", "user.updated", "user.deactivated", "user.deleted"
	EventID     string `json:"event_id"` // unique per event; an event applies once
	ID          string `json:"id"`       // the user's stable subject
	Username    string `json:"username"`
	Email       string `json:"email"`
	DisplayName string `json:"display_name"`
	Role        string `json:"role"`
	Status      string `json:"status"`
	Timestamp   int64  `json:"timestamp"`
}

KySignOnSyncPayload defines the schema received during automatic directory replication webhooks.

type LogoutClaims added in v0.5.0 

type LogoutClaims struct {
	Subject   string
	SessionID string
	IssuedAt  time.Time
}

LogoutClaims names the login an OpenID Connect Back-Channel Logout token ended. SessionID is empty when the provider ended every login of Subject issued by IssuedAt.

type Provider 

type Provider struct {
	InstallerManaged bool   `json:"installer_managed,omitempty"`
	CallbackURL      string `json:"callback_url,omitempty"`
	ID               string `json:"id"`
	Name             string `json:"name"`
	Kind             string `json:"kind"`
	Issuer           string `json:"issuer"`
	ClientID         string `json:"client_id"`
	ClientSecret     string `json:"client_secret,omitempty"`
	AuthorizationURL string `json:"authorization_url"`
	TokenURL         string `json:"token_url"`
	UserInfoURL      string `json:"userinfo_url"`
	Scopes           string `json:"scopes"`
	SubjectField     string `json:"subject_field"`
	UsernameField    string `json:"username_field"`
	NameField        string `json:"name_field"`
	EmailField       string `json:"email_field"`
	AuthMethod       string `json:"auth_method"`
	Enabled          bool   `json:"enabled"`
	AutoProvision    bool   `json:"auto_provision"`
	SecretSet        bool   `json:"secret_set,omitempty"`
}

Provider supports OIDC discovery and OAuth2 providers with a JSON profile API. The subject mapping must name a stable provider-issued account ID, never an email.

func (Provider) AuthURL 

func (p Provider) AuthURL(ctx context.Context, redirect, state, verifier, nonce string) (string, error)

func (Provider) Exchange 

func (p Provider) Exchange(ctx context.Context, code, verifier, redirect, nonce string) (*IdentityClaims, error)

func (Provider) Validate 

func (p Provider) Validate() error

func (Provider) VerifyLogout added in v0.5.0 

func (p Provider) VerifyLogout(ctx context.Context, raw string) (*LogoutClaims, error)

VerifyLogout verifies a back-channel logout token signed by this OIDC provider for its client.

type SAMLServiceProvider 

type SAMLServiceProvider struct {
	EntityID string
	ACSURL   string
}

func NewSAMLServiceProvider 

func NewSAMLServiceProvider(entityID, acsURL string) *SAMLServiceProvider

func (*SAMLServiceProvider) GenerateMetadata 

func (s *SAMLServiceProvider) GenerateMetadata() string

type SSOState 

type SSOState struct {
	State        string    `json:"state"`
	Verifier     string    `json:"verifier"`
	Provider     string    `json:"provider"`
	RedirectBack string    `json:"redirect_back"`
	CreatedAt    time.Time `json:"created_at"`
}

SSOState represents ephemeral state held during OAuth/OIDC authorization flow.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.