Documentation
¶
Overview ¶
Package multioidc dispatches OIDC flows to per-tenant IdP realms (docs/MULTI-TENANCY.md §5,§7).
In multi-tenant mode each provider row may carry its own OIDC config (issuer/client/secret — e.g. one Keycloak realm per tenant, each on its own host). TenantDriver builds a lazily initialised, cached oidc.Driver pinned to that provider (SetProviderID): it signs people in to that tenant only.
⚠ A sign-in is started and finished through authsetup's flows (oidcflow.go), which name the tenant it is for. The host dispatch below (resolve, falling back to the config-file driver) is what EndSessionURL uses; a callback without its flow is refused on a multi-tenant install, never answered by the fallback (docs/SSO.md, "Which account an SSO sign-in opens").
Index ¶
- func HasOwnOIDC(p *model.Provider) bool
- func RequestHost(r *http.Request) string
- type Dispatcher
- func (m *Dispatcher) EndSessionURL(r *http.Request, idToken, postLogoutRedirect string) string
- func (m *Dispatcher) HandleCallback(w http.ResponseWriter, r *http.Request) (*model.User, string, error)
- func (m *Dispatcher) StartFlow(w http.ResponseWriter, r *http.Request) error
- func (m *Dispatcher) TenantDriver(ctx context.Context, p *model.Provider, host string) (auth.OIDCDriver, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HasOwnOIDC ¶ added in v0.50.0
HasOwnOIDC reports whether a tenant's provider row carries an OIDC of its own: the tenant's own SSO (docs/TENANT-ADMIN.md), started for that tenant only.
func RequestHost ¶
RequestHost extracts the bare hostname (no port) the client asked for. Behind the reverse proxy filex trusts the proxied Host header (the proxy is the only reachable path in the documented deployments — §13 trusted-host).
Types ¶
type Dispatcher ¶
type Dispatcher struct {
// contains filtered or unexported fields
}
Dispatcher implements auth.OIDCDriver over N per-tenant realms.
func New ¶
func New(store db.Store, fallback auth.OIDCDriver) *Dispatcher
New wraps the config-file OIDC driver (may be nil) with per-tenant dispatch.
func (*Dispatcher) EndSessionURL ¶
func (m *Dispatcher) EndSessionURL(r *http.Request, idToken, postLogoutRedirect string) string
EndSessionURL implements auth.OIDCLogoutDriver on the tenant's own driver — the host resolves exactly as it did for sign-in. "" (sign-out stays local) when the host has no IdP, the IdP cannot be reached for discovery, or the driver does not do RP-initiated logout.
func (*Dispatcher) HandleCallback ¶
func (m *Dispatcher) HandleCallback(w http.ResponseWriter, r *http.Request) (*model.User, string, error)
HandleCallback implements auth.OIDCDriver.
func (*Dispatcher) StartFlow ¶
func (m *Dispatcher) StartFlow(w http.ResponseWriter, r *http.Request) error
StartFlow implements auth.OIDCDriver.
func (*Dispatcher) TenantDriver ¶ added in v0.50.0
func (m *Dispatcher) TenantDriver(ctx context.Context, p *model.Provider, host string) (auth.OIDCDriver, error)
TenantDriver is the driver of a tenant's own OIDC (its provider row), built once per configuration and cached; host is the address the flow runs on, for the default redirect URI.
Source Files