Documentation
¶
Index ¶
- func ClaimValues(claims map[string]any, path string) []string
- func DecodeIDTokenClaims(idToken string) (map[string]any, error)
- func EmailDomain(email string) string
- func MapOrganization(in OrganizationMapping) (string, error)
- func MapRole(claims map[string]any, roleClaim string, roleMap []config.ClaimMapEntry, ...) (string, error)
- func MergeTokenClaims(userinfo map[string]any, token *oauth2.Token) map[string]any
- type OrganizationMapping
- type ProviderRegistry
- func (r *ProviderRegistry) Endpoint(providerID string) (oauth2.Endpoint, bool)
- func (r *ProviderRegistry) HTTPClient(providerID string) *http.Client
- func (r *ProviderRegistry) Register(providerID string, endpoint oauth2.Endpoint, fetcher UserInfoFetcher, ...)
- func (r *ProviderRegistry) UserInfo(ctx context.Context, providerID string, token *oauth2.Token) (*UserProfile, error)
- type UserInfoFetcher
- type UserProfile
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClaimValues ¶ added in v0.1.3
ClaimValues returns string values at a dotted JSON path. Missing paths yield nil. Strings, string arrays, and numeric scalars are collected; objects are ignored.
func DecodeIDTokenClaims ¶ added in v0.1.3
DecodeIDTokenClaims base64-decodes the JWT payload. Signature verification is intentionally skipped.
func EmailDomain ¶ added in v0.1.3
EmailDomain returns the exact domain after the last "@", lowercased.
func MapOrganization ¶ added in v0.1.3
func MapOrganization(in OrganizationMapping) (string, error)
MapOrganization returns an organization name or UUID to resolve. Precedence: allowlisted email domain, then mapped org claim, then domain→org map, then default. A present org claim that matches nothing is denied (no domain/default fallback).
func MapRole ¶ added in v0.1.3
func MapRole(claims map[string]any, roleClaim string, roleMap []config.ClaimMapEntry, defaultRole string) (string, error)
MapRole returns the IPAM role for JIT provisioning. If any mapped claim value is admin, admin wins; else user if mapped; else the default role.
func MergeTokenClaims ¶ added in v0.1.3
MergeTokenClaims overlays ID-token claims on userinfo. The token is the one returned by the configured token endpoint after a confidential-client code exchange; the JWT signature is not re-verified.
Types ¶
type OrganizationMapping ¶ added in v0.1.3
type OrganizationMapping struct {
Claims map[string]any
Email string
OrgClaim string
OrgMap []config.ClaimMapEntry
DefaultOrg string
AllowedDomains []string
DomainOrgMap []config.ClaimMapEntry
}
OrganizationMapping is the input for JIT organization resolution.
type ProviderRegistry ¶
type ProviderRegistry struct {
// contains filtered or unexported fields
}
func NewProviderRegistry ¶
func NewProviderRegistry(cfg *config.Config) (*ProviderRegistry, error)
func (*ProviderRegistry) Endpoint ¶
func (r *ProviderRegistry) Endpoint(providerID string) (oauth2.Endpoint, bool)
func (*ProviderRegistry) HTTPClient ¶ added in v0.1.1
func (r *ProviderRegistry) HTTPClient(providerID string) *http.Client
func (*ProviderRegistry) Register ¶
func (r *ProviderRegistry) Register(providerID string, endpoint oauth2.Endpoint, fetcher UserInfoFetcher, client *http.Client)
func (*ProviderRegistry) UserInfo ¶
func (r *ProviderRegistry) UserInfo(ctx context.Context, providerID string, token *oauth2.Token) (*UserProfile, error)
Source Files