Documentation
¶
Index ¶
- type AuthOpts
- type AuthOptsStruct
- type BrowserOpenIdProvider
- type ClientOpts
- type CosignerProvider
- func (c *CosignerProvider) CreateInitAuthSig(redirectURI string) ([]byte, string, error)
- func (c *CosignerProvider) RequestToken(ctx context.Context, signer crypto.Signer, pkt *pktoken.PKToken, ...) (*pktoken.PKToken, error)
- func (c *CosignerProvider) ValidateCos(cosSig []byte, expectedNonce string, expectedRedirectURI string) error
- type OpenIdProvider
- type OpkClient
- func (o *OpkClient) Auth(ctx context.Context, opts ...AuthOpts) (*pktoken.PKToken, error)
- func (o *OpkClient) GetAlg() jwa.KeyAlgorithm
- func (o *OpkClient) GetCosP() *CosignerProvider
- func (o *OpkClient) GetOp() OpenIdProvider
- func (o *OpkClient) GetPKToken() (*pktoken.PKToken, error)
- func (o *OpkClient) GetSigner() crypto.Signer
- func (o *OpkClient) Refresh(ctx context.Context) (*pktoken.PKToken, error)
- func (o *OpkClient) SetPKToken(pkt *pktoken.PKToken)
- type PKTokenVerifier
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthOpts ¶
type AuthOpts func(a *AuthOptsStruct)
func WithExtraClaim ¶
WithExtraClaim specifies additional values to be included in the CIC. These claims will be include in the CIC protected header and will be hashed into the commitment claim in the ID Token. The commitment claim is typically the nonce or aud claim in the ID Token. Example use:
WithExtraClaim("claimKey", "claimValue")
type AuthOptsStruct ¶
type AuthOptsStruct struct {
// contains filtered or unexported fields
}
type BrowserOpenIdProvider ¶
type BrowserOpenIdProvider = providers.BrowserOpenIdProvider
type ClientOpts ¶
type ClientOpts func(o *OpkClient)
ClientOpts contains options for constructing an OpkClient
func WithCosignerProvider ¶
func WithCosignerProvider(cosP *CosignerProvider) ClientOpts
WithCosignerProvider specifies what cosigner provider should be used to cosign the PK Token. If this is not specified then the cosigning setup is skipped.
func WithSigner ¶
func WithSigner(signer crypto.Signer, alg jwa.KeyAlgorithm) ClientOpts
WithSigner allows the caller to inject their own signer and algorithm. Use this option if to generate to bring your own user key pair. If this option is not set the OpkClient constructor will automatically generate a signer, i.e., key pair. Example use:
signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) WithSigner(signer, jwa.ES256)
type CosignerProvider ¶
func (*CosignerProvider) CreateInitAuthSig ¶
func (c *CosignerProvider) CreateInitAuthSig(redirectURI string) ([]byte, string, error)
CreateInitAuthSig generates a random nonce, validates the redirectURI, creates an InitMFAAuth message, marshals it to JSON, and returns the JSON message along with the nonce.
func (*CosignerProvider) RequestToken ¶
func (*CosignerProvider) ValidateCos ¶
func (c *CosignerProvider) ValidateCos(cosSig []byte, expectedNonce string, expectedRedirectURI string) error
type OpenIdProvider ¶
type OpenIdProvider = providers.OpenIdProvider
type OpkClient ¶
type OpkClient struct {
Op OpenIdProvider
// contains filtered or unexported fields
}
func New ¶
func New(op OpenIdProvider, opts ...ClientOpts) (*OpkClient, error)
New returns a new client.OpkClient. The op argument should be the OpenID Provider you want to authenticate against.
func (*OpkClient) Auth ¶
Auth returns a PK Token by running the OpenPubkey protocol. It will first authenticate to the configured OpenID Provider (OP) and receive an ID Token. Using this ID Token it will generate a PK Token. If a Cosigner has been configured it will also attempt to get the PK Token cosigned.
func (*OpkClient) GetAlg ¶
func (o *OpkClient) GetAlg() jwa.KeyAlgorithm
GetAlg returns the algorithm of the client's key pair (Public Key, Signing Key)
func (*OpkClient) GetCosP ¶
func (o *OpkClient) GetCosP() *CosignerProvider
GetCosP returns the MFA Cosigner Provider the OpkClient has been configured to use
func (*OpkClient) GetOp ¶
func (o *OpkClient) GetOp() OpenIdProvider
GetOp returns the OpenID Provider the OpkClient has been configured to use
func (*OpkClient) GetPKToken ¶
GetPKToken returns a deep copy of client's current PK Token
func (*OpkClient) Refresh ¶
Refresh uses a Refresh Token to request a fresh ID Token and Access Token from an OpenID Provider. It provides a way to refresh the Access and ID Tokens for an OpenID Provider that supports refresh requests, allowing the client to continue making authenticated requests without requiring the user to re-authenticate.
Source Files
Directories