Documentation
¶
Overview ¶
Package google configures Google OpenID Connect sign-in for the oauth plugin.
Google is an OIDC provider: identity is the ID token's immutable "sub" claim, verified by the engine against Google's fixed issuer and published keys. The engine reads no email, profile or hosted-domain claim, so the default request asks only for the openid scope. Additional scopes change the consent screen but never what the engine trusts.
Index ¶
Constants ¶
View Source
const ( ID = "google" Issuer = "https://accounts.google.com" AuthorizationURL = "https://accounts.google.com/o/oauth2/v2/auth" TokenURL = "https://oauth2.googleapis.com/token" JWKSURL = "https://www.googleapis.com/oauth2/v3/certs" )
Endpoints are fixed from Google's published discovery document. Nothing is discovered at runtime, so a callback parameter cannot steer verification.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Config ¶
type Config struct {
ClientID string
ClientSecret sigil.Secret
// RedirectURL is the exact HTTPS callback registered as an authorized
// redirect URI in Google Cloud Console. Google exempts localhost from its
// HTTPS requirement; the engine does not.
RedirectURL string
// Scopes are optional additions such as "email" or "profile". They only
// change consent; the engine never uses the resulting claims for identity.
Scopes []string
}
Config is trusted host configuration for one Google OAuth 2.0 web client.
Source Files
Click to show internal directories.
Click to hide internal directories.