Documentation
¶
Index ¶
- Constants
- func NewAuthenticator(config clientcredentials.Config, client *http.Client) *http.Client
- type Admin
- type AuthMethod
- type Authenticator
- type AuthorizeOption
- func WithAuthorizationDetails(authorizationDetails string) AuthorizeOption
- func WithOpenbankingACR(acr []string) AuthorizeOption
- func WithOpenbankingIntentID(intentID string, acr []string) AuthorizeOption
- func WithPAR(clientID string, requestURI string) AuthorizeOption
- func WithPKCE() AuthorizeOption
- func WithRequestObjectEncryption(key jose.JSONWebKey) AuthorizeOption
- func WithResponseMode(responseMode string) AuthorizeOption
- func WithResponseType(responseTypes ...string) AuthorizeOption
- func WithSignedRequestObject(claims jwt.MapClaims) AuthorizeOption
- type CSRF
- type Cdr
- type ClaimRequest
- type ClaimRequests
- type Client
- func (c *Client) AuthorizeURL(options ...AuthorizeOption) (authorizeURL string, csrf CSRF, err error)
- func (c *Client) AuthorizeURLWithPAR(requestURI string) (authorizeURL string, err error)
- func (c *Client) DoPAR(options ...AuthorizeOption) (pr PARResponse, csrf CSRF, err error)
- func (c *Client) DoRequest(request *http.Request) (*http.Response, error)
- func (c *Client) Exchange(code string, state string, csrf CSRF) (token Token, err error)
- func (c *Client) GenerateClientAssertion() (assertion string, err error)
- func (c *Client) IntrospectToken(ctx context.Context, token string) (*o2models.IntrospectResponse, error)
- func (c *Client) Userinfo(token string) (body map[string]interface{}, err error)
- type Config
- type Developer
- type Fdx
- type Hub
- type Identity
- type IdentityRoot
- type IdentitySelf
- type IdentitySystem
- type JWTClaims
- type JWTConsumer
- type Ksa
- type LicensingAdmin
- type LicensingRoot
- type Oauth2
- type Obbr
- type Obuk
- type OpenbankingBrasil
- type OpenbankingUK
- type Opin
- type PARResponse
- type Public
- type Root
- type System
- type Token
- type Web
Constants ¶
View Source
const ( NonceLength = 20 StateLength = 8 VerifierLength = 43 )
View Source
const (
ErrorInvalidAccessToken = "invalid_access_token"
)
Variables ¶
This section is empty.
Functions ¶
func NewAuthenticator ¶
Types ¶
type Admin ¶
type Admin struct {
*adminClient.Acp
}
type AuthMethod ¶
type AuthMethod string
const ( ClientSecretBasicAuthnMethod AuthMethod = "client_secret_basic" ClientSecretPostAuthnMethod AuthMethod = "client_secret_post" ClientSecretJwtAuthnMethod AuthMethod = "client_secret_jwt" PrivateKeyJwtAuthnMethod AuthMethod = "private_key_jwt" SelfSignedTLSAuthnMethod AuthMethod = "self_signed_tls_client_auth" TLSClientAuthnMethod AuthMethod = "tls_client_auth" NoneAuthnMethod AuthMethod = "none" )
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
type AuthorizeOption ¶
type AuthorizeOption interface {
// contains filtered or unexported methods
}
func WithAuthorizationDetails ¶
func WithAuthorizationDetails(authorizationDetails string) AuthorizeOption
func WithOpenbankingACR ¶
func WithOpenbankingACR(acr []string) AuthorizeOption
func WithOpenbankingIntentID ¶
func WithOpenbankingIntentID(intentID string, acr []string) AuthorizeOption
func WithPAR ¶
func WithPAR(clientID string, requestURI string) AuthorizeOption
func WithPKCE ¶
func WithPKCE() AuthorizeOption
func WithRequestObjectEncryption ¶
func WithRequestObjectEncryption(key jose.JSONWebKey) AuthorizeOption
func WithResponseMode ¶
func WithResponseMode(responseMode string) AuthorizeOption
func WithResponseType ¶
func WithResponseType(responseTypes ...string) AuthorizeOption
func WithSignedRequestObject ¶
func WithSignedRequestObject(claims jwt.MapClaims) AuthorizeOption
type CSRF ¶
type CSRF struct {
// State is an opaque value used by the client to maintain
// state between the request and callback. The authorization
// server includes this value when redirecting the user-agent back
// to the client. The parameter SHOULD be used for preventing
// cross-site request forgery
State string
// Nonce is a string value used to associate a client session with
// an ID Token, and to mitigate replay attacks
Nonce string
// PKCE code verifier
Verifier string
}
CSRF contains state, nonce and/or PKCEverifier which are used to mitigate replay attacks and cross-site request forgery.
type ClaimRequest ¶
type ClaimRequests ¶
type ClaimRequests struct {
Userinfo map[string]*ClaimRequest `json:"userinfo"`
IDToken map[string]*ClaimRequest `json:"id_token"`
}
type Client ¶
type Client struct {
Oauth2 *Oauth2
Admin *Admin
Developer *Developer
Public *Public
System *System
Web *Web
Root *Root
Fdx *Fdx
Cdr *Cdr
Obuk *Obuk
Obbr *Obbr
Opin *Opin
Ksa *Ksa
Hub *Hub
*OpenbankingUK
*OpenbankingBrasil
Identity *Identity
IdentitySelf *IdentitySelf
IdentityRoot *IdentityRoot
IdentitySystem *IdentitySystem
LicensingRoot *LicensingRoot
LicensingAdmin *LicensingAdmin
// Client configuration
Config Config
// Tenant id read from the IssuerURL
TenantID string
// Authorization server id read from the IssuerURL
ServerID string
// Base path read from the IssuerURL
BasePath string
// contains filtered or unexported fields
}
Client provides a client to the ACP API
func (*Client) AuthorizeURL ¶
func (c *Client) AuthorizeURL(options ...AuthorizeOption) (authorizeURL string, csrf CSRF, err error)
func (*Client) AuthorizeURLWithPAR ¶
func (*Client) DoPAR ¶
func (c *Client) DoPAR(options ...AuthorizeOption) (pr PARResponse, csrf CSRF, err error)
func (*Client) GenerateClientAssertion ¶
func (*Client) IntrospectToken ¶
type Config ¶
type Config struct {
// ClientID is the application's ID.
ClientID string `json:"client_id"`
// AuthMethod represents how requests for tokens are authenticated to the server.
AuthMethod AuthMethod
// ClientSecret is the application's secret.
ClientSecret string `json:"client_secret"`
// RedirectURL is the URL to redirect users after authentication.
RedirectURL *url.URL `json:"redirect_url"`
// IssuerURL is the authorization server's url.
// example: https://localhost:8443/default/default
IssuerURL *url.URL `json:"issuer_url"`
// TokenURL is the authorization server's token url.
// Optional if issuerURL provided
TokenURL *url.URL
// AuthorizeURL is the authorization server's authorize url.
// Optional if issuerURL provided
AuthorizeURL *url.URL
// PushedAuthorizationRequestEndpoint is URL of the pushed authorization request endpoint
// at which a client can post an authorization request to exchange
// for a "request_uri" value usable at the authorization server.
PushedAuthorizationRequestEndpoint *url.URL
// UserinfoURL is the authorization server's userinfo url.
// Optional if issuerURL provided
UserinfoURL *url.URL
// Scope specifies optional requested permissions.
Scopes []string `json:"scopes"`
// Path to the file with private key for signing request object.
RequestObjectSigningKeyFile string `json:"request_object_signing_key_file"`
// Request object signing algorithm
// If empty RS256 will be used
RequestObjectSigningAlg string `json:"request_object_signing_alg"`
// Path to the file with private key for private_key_jwt token authentication
ClientAssertionSigningKeyFile string `json:"client_assertion_signing_key_file"`
// Client assertion signing algorithm
// If empty RS256 will be used
ClientAssertionSigningAlg string `json:"client_assertion_signing_alg"`
// Path to the file with private key for encrypting request object.
RequestObjectEncryptionKeyFile string `json:"request_object_encryption_key_file"`
// Optional request object expiration time
// If not provided, it will be se to 1 minute
RequestObjectExpiration *time.Duration `json:"request_object_expiration"`
// Default HttpClient timeout.
// Ignored if HttpClient is provided.
Timeout time.Duration `json:"timeout"`
// Optional path to the file with certificate for tls authentication.
// Ignored if HttpClient is provided.
CertFile string `json:"cert_file"`
// Optional path to the file with private key for tls authentication.
// Ignored if HttpClient is provided.
KeyFile string `json:"key_file"`
// Optional path to the file with root CAs.
// Ignored if HttpClient is provided.
RootCA string `json:"root_ca"`
// HttpClient is the client to use. Default will be used if not provided.
HttpClient *http.Client `json:"-"`
// Optional vanity domain type, one of "", "tenant" or "server".
VanityDomainType string `json:"vanity_domain_type"`
// Tenant id required when VanityDomainType is "tenant" or "server"
TenantID string `json:"tenant_id"`
// Authorization server id required when VanityDomainType is "server".
ServerID string `json:"server_id"`
// If enabled, client credentials flow won't be applied
SkipClientCredentialsAuthn bool `json:"skip_client_credentials_authn"`
}
ACP client configuration
func (*Config) GetAuthorizeURL ¶
func (*Config) GetTokenURL ¶
func (*Config) GetUserinfoURL ¶
type Developer ¶
type Developer struct {
*developerClient.Acp
}
type IdentityRoot ¶
type IdentityRoot struct {
*identityroot.Acp
}
type IdentitySelf ¶
type IdentitySelf struct {
*identityself.Acp
}
type IdentitySystem ¶
type IdentitySystem struct {
*identitysystem.Acp
}
type JWTConsumer ¶
type JWTConsumer struct{}
type LicensingAdmin ¶
type LicensingAdmin struct {
*licensingadmin.Acp
}
type LicensingRoot ¶
type LicensingRoot struct {
*licensingroot.Acp
}
type OpenbankingBrasil ¶
type OpenbankingBrasil struct {
Consents *obbrConsents.OpenbankingBRClient
Payments *obbrPayments.OpenbankingBRClient
}
type OpenbankingUK ¶
type OpenbankingUK struct {
Accounts *obukAccounts.OpenbankingUKClient
Payments *obukPayments.OpenbankingUKClient
}
type PARResponse ¶
type Public ¶
type Public struct {
*publicClient.Acp
}
type Root ¶
type Root struct {
*rootClient.Acp
}
type System ¶
type System struct {
*systemClient.Acp
}
Click to show internal directories.
Click to hide internal directories.