Help us shape the future of Go! Take the 2026 Go Developer Survey

ssooidc

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 23 Imported by: 0

README

IAM Identity Center OIDC

Parity grade: B · SDK aws-sdk-go-v2/service/ssooidc@v1.42.0 · last audited 2026-10-12 (94a8059bf)

Coverage

Metric Value
PARITY entries audited 4 (4 ok)
Feature families 2 (2 ok)
Known gaps 1
Structural gaps (can't be emulated) 1
Deferred items 0
Resource leaks clean
Known gaps
  • RegisterClient AuthorizationEndpoint/TokenEndpoint: returned only when authorization_code is registered; whether AWS returns them for every client is not determinable from the SDK (bd: gopherstack-cefu7.3)
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • CreateTokenWithIAM jwt-bearer and token-exchange grants need an external identity provider and trusted token issuer trust chain; no data source exists in an emulator

More

Documentation

Index

Constants

View Source 
const (
	DevicePath    = "/_gopherstack/sso/device"
	AuthorizePath = "/_gopherstack/sso/authorize"
)

Emulator-only browser endpoints behind verificationUri and authorizationEndpoint.

Variables

View Source 
var (
	ErrUnknownUserCode = errors.New("unknown or expired user code")
	ErrUnknownUser     = errors.New("unknown user")
	ErrTokenNotFound   = errors.New("session token not found or invalid")
	ErrTokenExpired    = errors.New("session token expired")
	ErrNoResolver      = errors.New("no identity resolver is wired")
)

Sentinels for the approval endpoints and the portal's token lookup.

Functions

This section is empty.

Types

type APIError 

type APIError struct {
	Code    string
	OAuth   string
	Message string
	Status  int
}

APIError is an OIDC protocol error: Code is the exception name, OAuth the RFC 6749 "error" value.

func (*APIError) Error 

func (e *APIError) Error() string

type AuthCode 

type AuthCode struct {
	ExpiresAt     time.Time `json:"expiresAt"`
	Subject       Subject   `json:"subject"`
	Code          string    `json:"code"`
	ClientID      string    `json:"clientId"`
	RedirectURI   string    `json:"redirectUri"`
	CodeChallenge string    `json:"codeChallenge"`
}

AuthCode is a single-use authorization code awaiting CreateToken.

type Client 

type Client struct {
	IssuedAt     time.Time `json:"issuedAt"`
	ExpiresAt    time.Time `json:"expiresAt"`
	ClientID     string    `json:"clientId"`
	ClientSecret string    `json:"clientSecret"`
	ClientName   string    `json:"clientName"`
	IssuerURL    string    `json:"issuerUrl,omitempty"`
	EntitledApp  string    `json:"entitledApplicationArn,omitempty"`
	GrantTypes   []string  `json:"grantTypes,omitempty"`
	RedirectURIs []string  `json:"redirectUris,omitempty"`
	Scopes       []string  `json:"scopes,omitempty"`
}

Client is a public client registered by RegisterClient.

type ClientRegistration 

type ClientRegistration struct {
	ClientID              string
	ClientSecret          string
	ClientIDIssuedAt      int64
	ClientSecretExpiresAt int64
}

ClientRegistration is the outcome of RegisterClient.

type CreateTokenInput 

type CreateTokenInput struct {
	ClientID     string
	ClientSecret string
	GrantType    string
	Code         string
	CodeVerifier string
	DeviceCode   string
	RedirectURI  string
	RefreshToken string
}

CreateTokenInput carries the CreateToken and CreateTokenWithIAM request members.

type Device 

type Device struct {
	ExpiresAt  time.Time `json:"expiresAt"`
	LastPolled time.Time `json:"lastPolled"`
	Subject    Subject   `json:"subject"`
	DeviceCode string    `json:"deviceCode"`
	UserCode   string    `json:"userCode"`
	ClientID   string    `json:"clientId"`
	StartURL   string    `json:"startUrl"`
	Status     string    `json:"status"`
	Interval   int32     `json:"interval"`
}

Device is one in-flight StartDeviceAuthorization request.

type DeviceAuthorization 

type DeviceAuthorization struct {
	DeviceCode string
	UserCode   string
	ExpiresIn  int32
	Interval   int32
}

DeviceAuthorization is the outcome of StartDeviceAuthorization.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo handler for the IAM Identity Center OIDC API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler over backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns the fault-injectable operations.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns the regions served.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns a fixed label to avoid high-cardinality metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset implements service.Resettable.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches the OIDC endpoints. The SDK sends these calls unsigned, so an S3-signed request or one carrying query parameters (an S3 subresource) is not ours.

func (*Handler) ServeAuthorize 

func (h *Handler) ServeAuthorize(c *echo.Context) error

ServeAuthorize implements the authorization-code endpoint: it signs in the requested (or default) user and redirects to redirect_uri with a single-use code, requiring a PKCE S256 challenge.

func (*Handler) ServeDeviceVerification 

func (h *Handler) ServeDeviceVerification(c *echo.Context) error

ServeDeviceVerification serves the device-code verification page. With action=approve or action=deny (query or form) it completes the authorization; user selects the signed-in user.

func (*Handler) SetSubjectResolver 

func (h *Handler) SetSubjectResolver(r SubjectResolver)

SetSubjectResolver wires the directory used to resolve users on sign-in approval.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds every OIDC client, in-flight authorization and issued token.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) ApproveDevice 

func (b *InMemoryBackend) ApproveDevice(userCode string, subject Subject) error

ApproveDevice marks the authorization for userCode approved for subject.

func (*InMemoryBackend) CreateToken 

func (b *InMemoryBackend) CreateToken(in *CreateTokenInput, iamCaller bool) (*TokenResult, *APIError)

CreateToken exchanges a device code, authorization code or refresh token for tokens. IAM-authenticated callers (CreateTokenWithIAM) present no client secret.

func (*InMemoryBackend) DenyDevice 

func (b *InMemoryBackend) DenyDevice(userCode string) error

DenyDevice marks the authorization for userCode denied.

func (*InMemoryBackend) DeviceUserCodeValid 

func (b *InMemoryBackend) DeviceUserCodeValid(userCode string) bool

DeviceUserCodeValid reports whether userCode names a pending, unexpired authorization.

func (*InMemoryBackend) IssueAuthCode 

func (b *InMemoryBackend) IssueAuthCode(
	clientID, redirectURI, challenge, method string, subject Subject,
) (string, *APIError)

IssueAuthCode validates an authorization request and returns a single-use code bound to its PKCE challenge.

func (*InMemoryBackend) RegisterClient 

func (b *InMemoryBackend) RegisterClient(in *RegisterClientInput) (*ClientRegistration, *APIError)

RegisterClient registers a public client.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state; an incompatible version starts empty.

func (*InMemoryBackend) RevokeSession 

func (b *InMemoryBackend) RevokeSession(token string) error

RevokeSession deletes every token of the sign-in session that issued token.

func (*InMemoryBackend) SessionForAccessToken 

func (b *InMemoryBackend) SessionForAccessToken(token string) (Session, error)

SessionForAccessToken resolves a bearer access token to its sign-in session.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes the backend state. It implements persistence.Persistable.

func (*InMemoryBackend) StartDeviceAuthorization 

func (b *InMemoryBackend) StartDeviceAuthorization(
	clientID, clientSecret, startURL string,
) (*DeviceAuthorization, *APIError)

StartDeviceAuthorization opens a device authorization for a registered client.

type Provider 

type Provider struct{}

Provider implements service.Provider for the IAM Identity Center OIDC API.

func (*Provider) Init 

func (p *Provider) Init(_ *service.AppContext) (service.Registerable, error)

Init builds the backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type RegisterClientInput 

type RegisterClientInput struct {
	ClientName   string
	ClientType   string
	IssuerURL    string
	EntitledApp  string
	GrantTypes   []string
	RedirectURIs []string
	Scopes       []string
}

RegisterClientInput carries the RegisterClient request members.

type Session 

type Session struct {
	ExpiresAt time.Time
	Subject   Subject
	ClientID  string
	StartURL  string
}

Session is what the portal learns about a valid access token.

type Subject 

type Subject struct {
	UserName        string `json:"userName,omitempty"`
	UserID          string `json:"userId,omitempty"`
	IdentityStoreID string `json:"identityStoreId,omitempty"`
}

Subject is the Identity Center user a device or authorization-code approval signs in.

type SubjectResolver 

type SubjectResolver interface {
	ResolveSubject(userName string) (Subject, error)
}

SubjectResolver maps an Identity Center user name to the subject a sign-in approval acts for. An empty userName selects the default user.

type Token 

type Token struct {
	ExpiresAt time.Time `json:"expiresAt"`
	Subject   Subject   `json:"subject"`
	Token     string    `json:"token"`
	Kind      string    `json:"kind"`
	ClientID  string    `json:"clientId"`
	SessionID string    `json:"sessionId"`
	StartURL  string    `json:"startUrl,omitempty"`
	Scopes    []string  `json:"scopes,omitempty"`
}

Token is an issued access or refresh token.

type TokenResult 

type TokenResult struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	Scopes       []string
	ExpiresIn    int32
}

TokenResult is the outcome of CreateToken.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.