Documentation
¶
Index ¶
- func OAuthConfiguredFromEnv() bool
- type AuthStores
- type Config
- type OAuthConfig
- type OAuthProvider
- func (p *OAuthProvider) ClientID() string
- func (p *OAuthProvider) HandleCallback(ctx context.Context, r *http.Request, state auth.AuthState) (*auth.ExternalIdentity, error)
- func (p *OAuthProvider) LoginURL(_ context.Context, state auth.AuthState) (string, error)
- func (p *OAuthProvider) Name() string
- type Provider
- type SetupParams
- type SetupResult
- type StateCookiePayload
- type StateManager
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func OAuthConfiguredFromEnv ¶ added in v0.40.0
func OAuthConfiguredFromEnv() bool
Types ¶
type AuthStores ¶
type AuthStores interface {
auth.UserStore
auth.LoginIdentityStore
auth.SessionStore
auth.CredentialStore
}
AuthStores combines all store interfaces needed for OIDC auth setup.
type Config ¶
type Config struct {
ProviderName string
IssuerURL string
ClientID string
ClientSecret string
RedirectURL string
Scopes []string
}
Config holds the configuration for a generic OIDC provider. All values are loaded from environment variables via ConfigFromEnv.
func ConfigFromEnv ¶
ConfigFromEnv reads OIDC configuration from environment variables.
- OIDC_PROVIDER_NAME (required)
- OIDC_ISSUER_URL (required)
- OIDC_CLIENT_ID (required)
- OIDC_CLIENT_SECRET (optional; empty = public client with PKCE only)
- OIDC_REDIRECT_URL (required)
- OIDC_SCOPES (optional, comma-separated; default: openid email profile)
type OAuthConfig ¶ added in v0.40.0
type OAuthConfig struct {
ProviderName string
Kind string
ClientID string
ClientSecret string
RedirectURL string
Scopes []string
AuthURL string
TokenURL string
TokenRequestStyle string
UserInfoURL string
UserEmailsURL string
AllowedEmailDomains []string
AllowedTenantKeys []string
RequireEmailVerified bool
}
func OAuthConfigFromEnv ¶ added in v0.40.0
func OAuthConfigFromEnv(providerName, baseURL string) (*OAuthConfig, error)
func OAuthConfigsFromEnv ¶ added in v0.40.0
func OAuthConfigsFromEnv(baseURL string) ([]*OAuthConfig, error)
func (*OAuthConfig) Validate ¶ added in v0.40.0
func (c *OAuthConfig) Validate() error
type OAuthProvider ¶ added in v0.40.0
type OAuthProvider struct {
// contains filtered or unexported fields
}
func NewOAuthProvider ¶ added in v0.40.0
func NewOAuthProvider(cfg *OAuthConfig) (*OAuthProvider, error)
func NewOAuthProviderWithClient ¶ added in v0.40.0
func NewOAuthProviderWithClient(cfg *OAuthConfig, client *http.Client) (*OAuthProvider, error)
func (*OAuthProvider) ClientID ¶ added in v0.43.0
func (p *OAuthProvider) ClientID() string
ClientID returns the OAuth client_id used for this login provider.
func (*OAuthProvider) HandleCallback ¶ added in v0.40.0
func (p *OAuthProvider) HandleCallback(ctx context.Context, r *http.Request, state auth.AuthState) (*auth.ExternalIdentity, error)
func (*OAuthProvider) Name ¶ added in v0.40.0
func (p *OAuthProvider) Name() string
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements auth.AuthProvider for a generic OIDC identity provider. It uses OIDC Discovery to find endpoints and go-oidc to verify ID tokens.
func NewProvider ¶
NewProvider creates a Provider, performing OIDC Discovery against cfg.IssuerURL. The context is used only for the discovery HTTP request.
func (*Provider) HandleCallback ¶
func (p *Provider) HandleCallback(ctx context.Context, r *http.Request, state auth.AuthState) (*auth.ExternalIdentity, error)
HandleCallback validates the IdP callback, exchanges the auth code, verifies the ID token, and returns the normalised ExternalIdentity.
Rejects logins where email_verified is false or email is empty.
type SetupParams ¶
type SetupParams struct {
DB *sql.DB
BaseURL string
VaultKey string
// AuthStores is a store that implements all auth store interfaces.
// In practice this is *db.OIDCStore.
AuthStores AuthStores
}
SetupParams contains dependencies for OIDC setup.
type SetupResult ¶
type SetupResult struct {
Providers []auth.AuthProvider
AuthSvc *auth.AuthService
SessionMgr *auth.SessionManager
StateMgr *StateManager
LocalAuth *local.Service
}
SetupResult contains the OIDC components created by Setup.
func Setup ¶
func Setup(ctx context.Context, p SetupParams) (*SetupResult, error)
Setup configures login authentication. When OIDC_ISSUER_URL is set it connects to the external provider; otherwise it enables local password auth.
type StateCookiePayload ¶
type StateCookiePayload struct {
State string `json:"state"`
CodeVerifier string `json:"code_verifier"`
ProviderName string `json:"provider_name"`
CreatedAt time.Time `json:"created_at"`
}
StateCookiePayload is the signed state stored in the OIDC state cookie. It ties the CSRF state string and PKCE code verifier together so they can be validated when the IdP redirects back to the callback endpoint.
type StateManager ¶
type StateManager struct {
// contains filtered or unexported fields
}
StateManager creates and validates signed OIDC state cookies. The cookie payload is JSON-encoded then HMAC-SHA256 signed using a key derived from STELLA_VAULT_KEY. The signature is appended as a hex suffix after a "." separator: base64(payload).hex(sig).
func NewStateManager ¶
func NewStateManager(vaultKey string) (*StateManager, error)
NewStateManager creates a StateManager. vaultKey is the raw STELLA_VAULT_KEY; a per-purpose key is derived via HKDF-SHA256.
func (*StateManager) Generate ¶
func (m *StateManager) Generate() (StateCookiePayload, error)
Generate creates a new StateCookiePayload with a random state and PKCE code verifier (S256 method).
func (*StateManager) SetCookie ¶
func (m *StateManager) SetCookie(w http.ResponseWriter, payload StateCookiePayload, secure bool) error
SetCookie encodes, signs, and writes the state cookie to the response.
func (*StateManager) ValidateAndClear ¶
func (m *StateManager) ValidateAndClear(w http.ResponseWriter, r *http.Request, queryState string) (StateCookiePayload, error)
ValidateAndClear reads the state cookie, verifies the HMAC signature and expiry, checks that queryState matches the stored state string, clears the cookie, and returns the payload. Any mismatch returns an error.
Source Files
Directories