Documentation
¶
Overview ¶
Package multioidc dispatches OIDC flows to per-tenant IdP realms (docs/MULTI-TENANCY.md §5,§7).
In multi-tenant mode each provider row may carry its own OIDC config (issuer/client/secret — e.g. one Keycloak realm per tenant, each on its own host). The dispatcher resolves the request Host → provider → a lazily initialised, cached oidc.Driver pinned to that provider (SetProviderID), so the JIT upsert stamps users with the right tenant. Hosts that resolve to no provider — or to a provider without OIDC config — fall back to the config-file driver (the single-tenant/supertenant realm), so the flag being on never breaks the operator's own login.
The OIDC callback arrives on the same host that started the flow (each tenant's redirect URL lives on its own host), so StartFlow and HandleCallback resolve to the same provider by construction.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RequestHost ¶
RequestHost extracts the bare hostname (no port) the client asked for. Behind the reverse proxy filex trusts the proxied Host header (the proxy is the only reachable path in the documented deployments — §13 trusted-host).
Types ¶
type Dispatcher ¶
type Dispatcher struct {
// contains filtered or unexported fields
}
Dispatcher implements auth.OIDCDriver over N per-tenant realms.
func New ¶
func New(store db.Store, fallback auth.OIDCDriver) *Dispatcher
New wraps the config-file OIDC driver (may be nil) with per-tenant dispatch.
func (*Dispatcher) EndSessionURL ¶
func (m *Dispatcher) EndSessionURL(r *http.Request, idToken, postLogoutRedirect string) string
EndSessionURL implements auth.OIDCLogoutDriver on the tenant's own driver — the host resolves exactly as it did for sign-in. "" (sign-out stays local) when the host has no IdP, the IdP cannot be reached for discovery, or the driver does not do RP-initiated logout.
func (*Dispatcher) HandleCallback ¶
func (m *Dispatcher) HandleCallback(w http.ResponseWriter, r *http.Request) (*model.User, string, error)
HandleCallback implements auth.OIDCDriver.
func (*Dispatcher) StartFlow ¶
func (m *Dispatcher) StartFlow(w http.ResponseWriter, r *http.Request) error
StartFlow implements auth.OIDCDriver.
Source Files