Documentation
¶
Index ¶
- Constants
- Variables
- func ParseScopes(raw string) []string
- type Config
- type Provider
- func (p *Provider) Begin(w http.ResponseWriter, _ *http.Request, returnTo string) (string, error)
- func (p *Provider) ClearStateCookie(w http.ResponseWriter, _ *http.Request)
- func (p *Provider) Complete(r *http.Request) (*authpkg.ExternalIdentity, error)
- func (p *Provider) CompleteWithReturnTo(r *http.Request) (*authpkg.ExternalIdentity, string, error)
- func (p *Provider) Name() string
Constants ¶
const ( // ProviderName is the auth method reported by the OIDC redirect provider. ProviderName = "oidc" // DefaultScopes is the envconfig default for CAESIUM_AUTH_OIDC_SCOPES. DefaultScopes = "openid profile email groups" // DefaultGroupsClaim is the envconfig default for CAESIUM_AUTH_OIDC_GROUPS_CLAIM. DefaultGroupsClaim = "groups" // DefaultRedirectPath is the Caesium callback path used when only a public // base URL is configured. DefaultRedirectPath = "/auth/sso/oidc/callback" DefaultStateCookieName = "caesium_oidc_state" DefaultStateTTL = 10 * time.Minute )
Variables ¶
var ( ErrAuthorizationFailed = errors.New("oidc authorization failed") ErrMissingCode = errors.New("oidc callback missing code") ErrMissingIDToken = errors.New("oidc token response missing id_token") ErrInvalidIDToken = errors.New("invalid oidc id_token") ErrInvalidNonce = errors.New("invalid oidc nonce") ErrInvalidGroupsClaim = errors.New("invalid oidc groups claim") )
var ( ErrInvalidReturnTo = errors.New("invalid returnTo") ErrInvalidState = errors.New("invalid oidc state") )
Functions ¶
func ParseScopes ¶
ParseScopes parses CAESIUM_AUTH_OIDC_SCOPES. Empty input returns the default OpenID Connect scopes.
Types ¶
type Config ¶
type Config struct {
IssuerURL string
ClientID string
ClientSecret string
Scopes []string
GroupsClaim string
RedirectURL string
PublicBaseURL string
StateCookieName string
StateTTL time.Duration
CookieSecure bool
CookieSecret []byte
HTTPClient *http.Client
}
Config configures the OIDC redirect provider.
func ConfigFromEnv ¶
func ConfigFromEnv(vars env.Environment) Config
ConfigFromEnv converts Caesium environment config into provider config. The caller still controls construction so startup can decide when OIDC is enabled.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements the Caesium browser redirect authenticator for OIDC.
func New ¶
New discovers the OIDC issuer and constructs an Authorization Code + PKCE redirect provider.
func (*Provider) Begin ¶
Begin creates the signed pre-login state cookie and returns the IdP authorization URL.
func (*Provider) ClearStateCookie ¶
func (p *Provider) ClearStateCookie(w http.ResponseWriter, _ *http.Request)
ClearStateCookie expires the one-time pre-login state cookie.
func (*Provider) Complete ¶
Complete validates the callback and returns the normalized external identity.
func (*Provider) CompleteWithReturnTo ¶
CompleteWithReturnTo is the callback variant route handlers can use when they need the same-origin return destination stored during Begin.
Source Files