Documentation
¶
Overview ¶
Package oidcadapter provides standard-library OIDC signing adapters.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ES256Signer ¶
type ES256Signer struct {
// contains filtered or unexported fields
}
ES256Signer implements credbound.OIDCSigner over one active ECDSA P-256 signing key and any retiring verification-only keys, published together in the issuer's JWKS so rotation never invalidates tokens signed under the previous key. Build one with NewES256KeyRing.
func NewES256KeyRing ¶
func NewES256KeyRing(kid string, key *ecdsa.PrivateKey, retiring ...ES256VerificationKey) (*ES256Signer, error)
NewES256KeyRing creates a signer with one active key and optional retiring verification keys. KIDs must be unique across the ring.
func NewES256Signer ¶
func NewES256Signer(kid string, key *ecdsa.PrivateKey) (*ES256Signer, error)
NewES256Signer creates a signer with a single active key and no retiring verification keys; it is NewES256KeyRing without a ring.
func (*ES256Signer) Algorithms ¶
func (*ES256Signer) Algorithms() []string
func (*ES256Signer) JWKS ¶
func (s *ES256Signer) JWKS(ctx context.Context) (json.RawMessage, error)
func (*ES256Signer) SignIDToken ¶
func (s *ES256Signer) SignIDToken(ctx context.Context, claims credbound.OIDCClaims) (string, error)
type ES256VerificationKey ¶
ES256VerificationKey is a retiring public key that remains discoverable during the maximum ID-token lifetime. It is never used for new signatures.
Source Files