Documentation
¶
Index ¶
- Variables
- func NewGlobalHelper(opts ...Option) error
- type Auth
- type Client
- type ClientCredentials
- type Helper
- func (h *Helper) AddClientRolesToUser(realm, clientId, userID string, roles []gocloak.Role) error
- func (h *Helper) AddRealmRoleToUser(realm, userID string, roles []gocloak.Role) error
- func (h *Helper) AddUserToGroup(realm, userID, groupID string) error
- func (h *Helper) CheckLoginUser(username, password string, client ClientCredentials) (*gocloak.JWT, error)
- func (h *Helper) CreateClient(realm string, opts gocloak.Client) (string, error)
- func (h *Helper) CreateClientProtocolMapper(realm, clientId string, opts gocloak.ProtocolMapperRepresentation) (string, error)
- func (h *Helper) CreateUser(realm string, user gocloak.User) (string, error)
- func (h *Helper) DeleteClientRolesFromUser(realm, clientId, userID string, roles []gocloak.Role) error
- func (h *Helper) DeleteGroup(realm, groupID string) error
- func (h *Helper) DeleteUser(realm, userID string) error
- func (h *Helper) DeleteUserFromGroup(realm, userID, groupID string) error
- func (h *Helper) ExecuteActionsEmail(realm, userID string, actions []string, lifespanSeconds int) error
- func (h *Helper) FindGroupPathSegments(realm string, segments []string) (*gocloak.Group, error)
- func (h *Helper) GetClientRole(realm, clientId, roleName string) (*gocloak.Role, error)
- func (h *Helper) GetClientSecret(realm, clientId string) (*gocloak.CredentialRepresentation, error)
- func (h *Helper) GetClients(realm string, params gocloak.GetClientsParams) ([]*gocloak.Client, error)
- func (h *Helper) GetComponent(realm, componentID string) (*gocloak.Component, error)
- func (h *Helper) GetGroupByPath(realm, path string) (*gocloak.Group, error)
- func (h *Helper) GetGroupMembers(realm, groupID string) ([]*gocloak.User, error)
- func (h *Helper) GetGroups(realm string, params gocloak.GetGroupsParams) ([]*gocloak.Group, error)
- func (h *Helper) GetOrCreateGroupPath(realm, path string) (*gocloak.Group, error)
- func (h *Helper) GetOrCreateGroupPathSegments(realm string, segments []string) (*gocloak.Group, error)
- func (h *Helper) GetRealmRole(realm, roleName string) (*gocloak.Role, error)
- func (h *Helper) GetUser(realm, name string) (*gocloak.User, error)
- func (h *Helper) GetUserByEmail(realm, email string) (*gocloak.User, error)
- func (h *Helper) GetUserGroups(realm, userID string) ([]*gocloak.Group, error)
- func (h *Helper) GetUsersByClientRoleName(realm, clientID, roleName string) ([]*gocloak.User, error)
- func (h *Helper) HasClientRole(realm, clientID, userID, roleName string) (bool, error)
- func (h *Helper) LoginAdmin() error
- func (h *Helper) LoginServiceAccount() error
- func (h *Helper) LogoutUserSession(realm, sessionID string) error
- func (h *Helper) SetKeycloakClient() error
- func (h *Helper) SetPassword(realm, userID, password string) error
- func (h *Helper) UpdateUser(realm string, user gocloak.User) error
- type HelperWithoutCredentials
- type Host
- type Option
- func ClientID(clientID string) Option
- func ClientSecret(clientSecret string) Option
- func Insecure(insecure bool) Option
- func Ip(ip string) Option
- func Password(password string) Option
- func Path(path string) Option
- func Port(port int) Option
- func Realm(realm string) Option
- func Scheme(scheme string) Option
- func Username(username string) Option
- type Options
Constants ¶
This section is empty.
Variables ¶
var DefaultAdmin = ClientCredentials{ID: "admin-cli"}
* DefaultAdmin is the public "admin-cli" client Keycloak provisions in every * realm by default, with direct access grants already enabled -- the same * client gocloak's own LoginAdmin uses internally for its hardcoded admin * login. Pass this to CheckLoginUser unless the target realm needs a * different client.
var ErrUserNotFound = errors.New("user not found")
ErrUserNotFound is returned by Helper.GetUser when no user matches, distinguishing that case from a transport/auth failure so callers can branch on it with errors.Is.
Functions ¶
func NewGlobalHelper ¶
Types ¶
type Auth ¶
type Auth struct {
Realm string `json:"realm" yaml:"realm"`
Username string `json:"username" yaml:"username"`
Password string `json:"password" yaml:"password"`
// ClientID/ClientSecret authenticate as a confidential client's service
// account (client_credentials grant) instead of Username/Password.
ClientID string `json:"clientId" yaml:"clientId"`
ClientSecret string `json:"clientSecret" yaml:"clientSecret"`
}
type Client ¶
type Client interface {
RestyClient() *resty.Client
Login(context.Context, string, string, string, string, string) (*gocloak.JWT, error)
LoginAdmin(context.Context, string, string, string) (*gocloak.JWT, error)
LoginClient(ctx context.Context, clientID, clientSecret, realm string, scopes ...string) (*gocloak.JWT, error)
GetUsers(context.Context, string, string, gocloak.GetUsersParams) ([]*gocloak.User, error)
GetClients(context.Context, string, string, gocloak.GetClientsParams) ([]*gocloak.Client, error)
CreateClient(context.Context, string, string, gocloak.Client) (string, error)
CreateClientProtocolMapper(context.Context, string, string, string, gocloak.ProtocolMapperRepresentation) (string, error)
GetClientSecret(ctx context.Context, token, realm, idOfClient string) (*gocloak.CredentialRepresentation, error)
CreateUser(context.Context, string, string, gocloak.User) (string, error)
SetPassword(context.Context, string, string, string, string, bool) error
UpdateUser(context.Context, string, string, gocloak.User) error
DeleteUser(context.Context, string, string, string) error
GetClientRole(ctx context.Context, token string, realm string, idOfClient string, roleName string) (*gocloak.Role, error)
AddClientRolesToUser(ctx context.Context, token string, realm string, idOfClient string, userID string, roles []gocloak.Role) error
DeleteClientRolesFromUser(ctx context.Context, token string, realm string, idOfClient string, userID string, roles []gocloak.Role) error
ExecuteActionsEmail(ctx context.Context, token, realm string, params gocloak.ExecuteActionsEmail) error
/* Client mirrors methods gocloak.GoCloak already implements -- there's no
* implementation here because gocloak's real client satisfies this interface
* directly (assigned in SetKeycloakClient). This exists purely so mockery can
* generate a mock for tests.
*/
GetGroups(ctx context.Context, token string, realm string, params gocloak.GetGroupsParams) ([]*gocloak.Group, error)
GetGroup(ctx context.Context, token string, realm string, groupID string) (*gocloak.Group, error)
GetGroupByPath(ctx context.Context, token string, realm string, groupPath string) (*gocloak.Group, error)
CreateGroup(ctx context.Context, token string, realm string, group gocloak.Group) (string, error)
CreateChildGroup(ctx context.Context, token string, realm string, groupID string, group gocloak.Group) (string, error)
DeleteGroup(ctx context.Context, token string, realm string, groupID string) error
GetUserGroups(ctx context.Context, token string, realm string, userID string, params gocloak.GetGroupsParams) ([]*gocloak.Group, error)
GetGroupMembers(ctx context.Context, token string, realm string, groupID string, params gocloak.GetGroupsParams) ([]*gocloak.User, error)
AddUserToGroup(ctx context.Context, token string, realm string, userID string, groupID string) error
DeleteUserFromGroup(ctx context.Context, token string, realm string, userID string, groupID string) error
GetClientRolesByUserID(ctx context.Context, token string, realm string, idOfClient string, userID string) ([]*gocloak.Role, error)
GetUsersByClientRoleName(ctx context.Context, token string, realm string, idOfClient string, roleName string, params gocloak.GetUsersByRoleParams) ([]*gocloak.User, error)
GetRealmRole(ctx context.Context, token string, realm string, roleName string) (*gocloak.Role, error)
AddRealmRoleToUser(ctx context.Context, token string, realm string, userID string, roles []gocloak.Role) error
LogoutUserSession(context.Context, string, string, string) error
GetComponent(ctx context.Context, token string, realm string, componentID string) (*gocloak.Component, error)
}
type ClientCredentials ¶
type Helper ¶
func GetGlobalHelper ¶
func GetGlobalHelper() *Helper
func (*Helper) AddClientRolesToUser ¶
func (*Helper) AddRealmRoleToUser ¶
func (*Helper) AddUserToGroup ¶
func (*Helper) CheckLoginUser ¶
func (*Helper) CreateClient ¶
func (*Helper) CreateClientProtocolMapper ¶
func (*Helper) CreateUser ¶
func (*Helper) DeleteClientRolesFromUser ¶
func (*Helper) DeleteGroup ¶
func (*Helper) DeleteUser ¶
func (*Helper) DeleteUserFromGroup ¶
func (*Helper) ExecuteActionsEmail ¶
func (*Helper) FindGroupPathSegments ¶
func (*Helper) GetClientRole ¶
func (*Helper) GetClientSecret ¶
func (h *Helper) GetClientSecret(realm, clientId string) (*gocloak.CredentialRepresentation, error)
func (*Helper) GetClients ¶
func (*Helper) GetComponent ¶
func (*Helper) GetGroupByPath ¶
func (*Helper) GetGroupMembers ¶
func (*Helper) GetOrCreateGroupPath ¶
func (*Helper) GetOrCreateGroupPathSegments ¶
func (h *Helper) GetOrCreateGroupPathSegments(realm string, segments []string) (*gocloak.Group, error)
* GetOrCreateGroupPathSegments is GetOrCreateGroupPath's own walk, taking each level's * name directly instead of a single "/"-joined path string. A caller that already holds * the segments as separate values (e.g. a product/project/role triple) should call this * instead of joining them into a path and having GetOrCreateGroupPath split it straight * back apart -- joining first only matters when a segment's own value could itself * contain "/", which turns into an extra (wrong) tree level once rejoined and split.
func (*Helper) GetRealmRole ¶
func (*Helper) GetUserByEmail ¶
func (*Helper) GetUserGroups ¶
func (*Helper) GetUsersByClientRoleName ¶
func (*Helper) HasClientRole ¶
func (*Helper) LoginAdmin ¶
func (*Helper) LoginServiceAccount ¶
* LoginServiceAccount authenticates as a confidential client's service account * (client_credentials grant) instead of a human admin's username/password. * Unlike LoginAdmin, this has no separate expiry to manage beyond the resulting * access token itself: the client secret backing it doesn't expire on its own, * so a fresh token is always a re-login away.
func (*Helper) LogoutUserSession ¶
func (*Helper) SetKeycloakClient ¶
func (*Helper) SetPassword ¶
type HelperWithoutCredentials ¶
* HelperWithoutCredentials is a keycloak client for call patterns like * CheckLoginUser that take login credentials as call-time parameters rather * than pre-configured Options. Unlike Helper, it has no LoginAdmin or * LoginServiceAccount methods, so a caller can't accidentally try to log in * with Options-level credentials that were never required to construct it -- * that misuse is a compile error here instead of a runtime one.
func NewHelperWithoutCredentials ¶
func NewHelperWithoutCredentials(opts ...Option) (*HelperWithoutCredentials, error)
func (*HelperWithoutCredentials) CheckLoginUser ¶
func (h *HelperWithoutCredentials) CheckLoginUser(username, password string, client ClientCredentials) (*gocloak.JWT, error)