Documentation
¶
Overview ¶
Package oidc implements a generic OpenID Connect provider for Auth-All.
The provider reaches every conformant issuer, so an application needs no provider package of its own for a standard identity server.
authall.WithProvider(oidc.New(
oidc.WithIssuer("https://id.example.com"),
oidc.WithClientID(id),
oidc.WithClientSecret(secret),
))
The provider discovers the endpoints on the first use, not in New. A constructor that performs network input and output would make authall.New fail for a briefly unreachable issuer.
Index ¶
- Constants
- type Option
- func WithClientID(v string) Option
- func WithClientSecret(v string) Option
- func WithClock(now func() time.Time) Option
- func WithEndpoints(authURL, tokenURL, jwksURL string) Option
- func WithHTTPClient(c *http.Client) Option
- func WithID(v string) Option
- func WithIssuer(v string) Option
- func WithScopes(v ...string) Option
- type Provider
Constants ¶
const DiscoveryPath = "/.well-known/openid-configuration"
DiscoveryPath is the well-known path of an OpenID Connect discovery document.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Provider)
Option configures the provider.
func WithClientSecret ¶
WithClientSecret sets the OAuth client secret.
func WithEndpoints ¶
WithEndpoints sets the endpoints and skips discovery. Use it for an issuer that publishes no discovery document, and in a test that points at a deterministic server.
func WithHTTPClient ¶
WithHTTPClient sets the HTTP client used for provider calls.
func WithID ¶
WithID sets the stable provider identifier used in routes and storage.
The default is the host of the issuer, so two issuers cannot collide. Set this when one host serves two issuers, or when the route should read better.
Auth-All refuses two providers that share an identifier, so a collision with a preset such as google fails the construction with a named error.
Changing the identifier of a live provider orphans the existing links, because the account table keys on it.
func WithIssuer ¶
WithIssuer sets the issuer URL. The provider appends the well-known path to find the discovery document, and it requires the document to name this issuer.
func WithScopes ¶
WithScopes replaces the requested scopes. The default is openid, email, and profile.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is a generic OpenID Connect provider.
func (*Provider) AuthCodeURL ¶
func (p *Provider) AuthCodeURL(req oauth.AuthRequest) (string, error)
AuthCodeURL implements oauth.Provider.
func (*Provider) Exchange ¶
func (p *Provider) Exchange(ctx context.Context, req oauth.ExchangeRequest) (*oauth.Identity, error)
Exchange implements oauth.Provider. It validates the signature, the issuer, the audience, the nonce, and the expiry of the identity token.
func (*Provider) ID ¶
ID implements oauth.Provider. It defaults to the host of the issuer, so two issuers cannot collide in the account table.
func (*Provider) SupportsPKCE ¶
SupportsPKCE implements oauth.Provider. OpenID Connect providers accept a PKCE challenge.
Source Files