oidc

func (*Driver) Authenticate ¶

func (d *Driver) Authenticate(r *http.Request) (*model.User, error)

Authenticate falls back to the local driver's session token contract — once the OIDC callback completed, downstream requests carry the same session cookie that the local driver knows how to validate.

func (*Driver) Capabilities ¶

func (d *Driver) Capabilities() auth.Capabilities

Capabilities implements auth.Driver.

func (*Driver) EndSessionURL ¶

func (d *Driver) EndSessionURL(_ *http.Request, idToken, postLogoutRedirect string) string

EndSessionURL implements auth.OIDCLogoutDriver: where to send the browser so the IdP ends its own session too (OpenID Connect RP-Initiated Logout 1.0).

⚠ Without this, signing out of filex was not signing out. The IdP's session stayed open, so in SSO-first mode (FILEX_OIDC_AUTO_REDIRECT) the login page went straight back to the IdP, which issued a new code without a form: the same account was signed in again ~0.5 s later (measured on Keycloak 26), and on a shared computer the next person got the previous one's files.

id_token_hint is what lets the IdP end the session without first asking "Do you want to log out?" (Keycloak) — or at all (IdPs that require it). An expired token is fine: the spec has the IdP accept it, and by sign-out time it usually has expired.

"" — keep sign-out local — when the IdP advertises no end_session_endpoint, no id_token was kept for the session, or the one kept was issued by another issuer (a provider re-pointed between sign-in and sign-out): one IdP is never handed a token another one issued.

func (*Driver) HandleCallback ¶

func (d *Driver) HandleCallback(w http.ResponseWriter, r *http.Request) (*model.User, string, error)

HandleCallback processes ?code= and ?state= from the IdP. It returns the upserted local user plus the local session token.

func (*Driver) Init ¶

func (d *Driver) Init(ctx context.Context, cfg map[string]any) error

Init configures the driver. Required keys: issuer, client_id, client_secret, redirect_url. Optional: scopes, role_claim, admin_group.

func (*Driver) Name ¶

func (d *Driver) Name() string

Name implements auth.Driver.

func (*Driver) Probe ¶

func (d *Driver) Probe(ctx context.Context, cfg map[string]any, _ *http.Request) []auth.ProbeCheck

Probe tests an OpenID Connect configuration as far as it can be tested without a person signing in:

required    issuer, client ID and return address are filled in
discovery   <issuer>/.well-known/openid-configuration answers JSON
issuer      the document names the SAME issuer (the spec requires it, and
            go-oidc refuses a mismatch at sign-in)
endpoints   it names an authorization, a token and a key endpoint
client      the token endpoint accepts the client ID and secret — asked
            with a client-credentials request, which proves who the client
            is and grants nothing a person could use
redirect    NOT checkable here: an identity provider judges the return
            address only inside a real sign-in, so the result says so

⚠ "client" is only as good as the answer can be read. 401 or `invalid_client` means the ID or the secret was refused; 200 or a 400 with `unauthorized_client` means the client authenticated and is merely not allowed that grant; anything else is reported as not checked rather than guessed. A client with no secret (a public client) cannot be checked without a sign-in at all, and is said to be.

func (*Driver) SetProviderID ¶

func (d *Driver) SetProviderID(id int64)

SetProviderID pins this driver instance to a tenant. Called by the multi-provider dispatcher right after Init.

func (*Driver) StartFlow ¶

func (d *Driver) StartFlow(w http.ResponseWriter, r *http.Request) error

StartFlow redirects the browser to the IdP authorization endpoint.