ssooidc

package
v1.8.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 23 Imported by: 0

README

IAM Identity Center OIDC

Parity grade: B · SDK aws-sdk-go-v2/service/ssooidc@v1.42.0 · last audited 2026-10-12 (94a8059bf)

Coverage

Metric Value
PARITY entries audited 4 (4 ok)
Feature families 2 (2 ok)
Known gaps 1
Structural gaps (can't be emulated) 1
Deferred items 0
Resource leaks clean
Known gaps
  • RegisterClient AuthorizationEndpoint/TokenEndpoint: returned only when authorization_code is registered; whether AWS returns them for every client is not determinable from the SDK (bd: gopherstack-cefu7.3)
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • CreateTokenWithIAM jwt-bearer and token-exchange grants need an external identity provider and trusted token issuer trust chain; no data source exists in an emulator

More

Documentation

Index

Constants

View Source 
const (
	DevicePath    = "/_gopherstack/sso/device"
	AuthorizePath = "/_gopherstack/sso/authorize"
)

Emulator-only browser endpoints behind verificationUri and authorizationEndpoint.

Variables

View Source 
var (
	ErrUnknownUserCode = errors.New("unknown or expired user code")
	ErrUnknownUser     = errors.New("unknown user")
	ErrTokenNotFound   = errors.New("session token not found or invalid")
	ErrTokenExpired    = errors.New("session token expired")
	ErrNoResolver      = errors.New("no identity resolver is wired")
)

Sentinels for the approval endpoints and the portal's token lookup.

Functions

This section is empty.

Types

type APIError 

type APIError struct {
	Code    string
	OAuth   string
	Message string
	Status  int
}

APIError is an OIDC protocol error: Code is the exception name, OAuth the RFC 6749 "error" value.

func (*APIError) Error 

func (e *APIError) Error() string

type AuthCode 

type AuthCode struct {
	ExpiresAt     time.Time `json:"expiresAt"`
	Subject       Subject   `json:"subject"`
	Code          string    `json:"code"`
	ClientID      string    `json:"clientId"`
	RedirectURI   string    `json:"redirectUri"`
	CodeChallenge string    `json:"codeChallenge"`
}

AuthCode is a single-use authorization code awaiting CreateToken.

type Client 

type Client struct {
	IssuedAt     time.Time `json:"issuedAt"`
	ExpiresAt    time.Time `json:"expiresAt"`
	ClientID     string    `json:"clientId"`
	ClientSecret string    `json:"clientSecret"`
	ClientName   string    `json:"clientName"`
	IssuerURL    string    `json:"issuerUrl,omitempty"`
	EntitledApp  string    `json:"entitledApplicationArn,omitempty"`
	GrantTypes   []string  `json:"grantTypes,omitempty"`
	RedirectURIs []string  `json:"redirectUris,omitempty"`
	Scopes       []string  `json:"scopes,omitempty"`
}

Client is a public client registered by RegisterClient.

type ClientRegistration 

type ClientRegistration struct {
	ClientID              string
	ClientSecret          string
	ClientIDIssuedAt      int64
	ClientSecretExpiresAt int64
}

ClientRegistration is the outcome of RegisterClient.

type CreateTokenInput 

type CreateTokenInput struct {
	ClientID     string
	ClientSecret string
	GrantType    string
	Code         string
	CodeVerifier string
	DeviceCode   string
	RedirectURI  string
	RefreshToken string
}

CreateTokenInput carries the CreateToken and CreateTokenWithIAM request members.

type Device 

type Device struct {
	ExpiresAt  time.Time `json:"expiresAt"`
	LastPolled time.Time `json:"lastPolled"`
	Subject    Subject   `json:"subject"`
	DeviceCode string    `json:"deviceCode"`
	UserCode   string    `json:"userCode"`
	ClientID   string    `json:"clientId"`
	StartURL   string    `json:"startUrl"`
	Status     string    `json:"status"`
	Interval   int32     `json:"interval"`
}

Device is one in-flight StartDeviceAuthorization request.

type DeviceAuthorization 

type DeviceAuthorization struct {
	DeviceCode string
	UserCode   string
	ExpiresIn  int32
	Interval   int32
}

DeviceAuthorization is the outcome of StartDeviceAuthorization.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo handler for the IAM Identity Center OIDC API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler over backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns the fault-injectable operations.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns the regions served.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns a fixed label to avoid high-cardinality metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset implements service.Resettable.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches the OIDC endpoints. The SDK sends these calls unsigned, so an S3-signed request or one carrying query parameters (an S3 subresource) is not ours.

func (*Handler) ServeAuthorize 

func (h *Handler) ServeAuthorize(c *echo.Context) error

ServeAuthorize implements the authorization-code endpoint: it signs in the requested (or default) user and redirects to redirect_uri with a single-use code, requiring a PKCE S256 challenge.

func (*Handler) ServeDeviceVerification 

func (h *Handler) ServeDeviceVerification(c *echo.Context) error

ServeDeviceVerification serves the device-code verification page. With action=approve or action=deny (query or form) it completes the authorization; user selects the signed-in user.

func (*Handler) SetSubjectResolver 

func (h *Handler) SetSubjectResolver(r SubjectResolver)

SetSubjectResolver wires the directory used to resolve users on sign-in approval.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds every OIDC client, in-flight authorization and issued token.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) ApproveDevice 

func (b *InMemoryBackend) ApproveDevice(userCode string, subject Subject) error

ApproveDevice marks the authorization for userCode approved for subject.

func (*InMemoryBackend) CreateToken 

func (b *InMemoryBackend) CreateToken(in *CreateTokenInput, iamCaller bool) (*TokenResult, *APIError)

CreateToken exchanges a device code, authorization code or refresh token for tokens. IAM-authenticated callers (CreateTokenWithIAM) present no client secret.

func (*InMemoryBackend) DenyDevice 

func (b *InMemoryBackend) DenyDevice(userCode string) error

DenyDevice marks the authorization for userCode denied.

func (*InMemoryBackend) DeviceUserCodeValid 

func (b *InMemoryBackend) DeviceUserCodeValid(userCode string) bool

DeviceUserCodeValid reports whether userCode names a pending, unexpired authorization.

func (*InMemoryBackend) IssueAuthCode 

func (b *InMemoryBackend) IssueAuthCode(
	clientID, redirectURI, challenge, method string, subject Subject,
) (string, *APIError)

IssueAuthCode validates an authorization request and returns a single-use code bound to its PKCE challenge.

func (*InMemoryBackend) RegisterClient 

func (b *InMemoryBackend) RegisterClient(in *RegisterClientInput) (*ClientRegistration, *APIError)

RegisterClient registers a public client.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state; an incompatible version starts empty.

func (*InMemoryBackend) RevokeSession 

func (b *InMemoryBackend) RevokeSession(token string) error

RevokeSession deletes every token of the sign-in session that issued token.

func (*InMemoryBackend) SessionForAccessToken 

func (b *InMemoryBackend) SessionForAccessToken(token string) (Session, error)

SessionForAccessToken resolves a bearer access token to its sign-in session.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes the backend state. It implements persistence.Persistable.

func (*InMemoryBackend) StartDeviceAuthorization 

func (b *InMemoryBackend) StartDeviceAuthorization(
	clientID, clientSecret, startURL string,
) (*DeviceAuthorization, *APIError)

StartDeviceAuthorization opens a device authorization for a registered client.

type Provider 

type Provider struct{}

Provider implements service.Provider for the IAM Identity Center OIDC API.

func (*Provider) Init 

func (p *Provider) Init(_ *service.AppContext) (service.Registerable, error)

Init builds the backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RegisterClientInput 

type RegisterClientInput struct {
	ClientName   string
	ClientType   string
	IssuerURL    string
	EntitledApp  string
	GrantTypes   []string
	RedirectURIs []string
	Scopes       []string
}

RegisterClientInput carries the RegisterClient request members.

type Session 

type Session struct {
	ExpiresAt time.Time
	Subject   Subject
	ClientID  string
	StartURL  string
}

Session is what the portal learns about a valid access token.

type Subject 

type Subject struct {
	UserName        string `json:"userName,omitempty"`
	UserID          string `json:"userId,omitempty"`
	IdentityStoreID string `json:"identityStoreId,omitempty"`
}

Subject is the Identity Center user a device or authorization-code approval signs in.

type SubjectResolver 

type SubjectResolver interface {
	ResolveSubject(userName string) (Subject, error)
}

SubjectResolver maps an Identity Center user name to the subject a sign-in approval acts for. An empty userName selects the default user.

type Token 

type Token struct {
	ExpiresAt time.Time `json:"expiresAt"`
	Subject   Subject   `json:"subject"`
	Token     string    `json:"token"`
	Kind      string    `json:"kind"`
	ClientID  string    `json:"clientId"`
	SessionID string    `json:"sessionId"`
	StartURL  string    `json:"startUrl,omitempty"`
	Scopes    []string  `json:"scopes,omitempty"`
}

Token is an issued access or refresh token.

type TokenResult 

type TokenResult struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	Scopes       []string
	ExpiresIn    int32
}

TokenResult is the outcome of CreateToken.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.