oidc

package

Go to main page

Versions in this module

v0

v0.4.0

May 6, 2026

Changes in this version

+ func ClaimsFromContext(ctx context.Context) any

+ type AWSCustomClaims = aws.CustomClaims

+ type FlyIOCustomClaims = flyio.CustomClaims

+ type GitHubActionsCustomClaims = githubactions.CustomClaims

type IntrospectionResponse

+ Organisations []string

type ValidatorConfig

+ HMACSecret string

v0.3.3

Apr 18, 2026

v0.3.2

Apr 18, 2026

v0.3.1

Apr 3, 2026

v0.3.0

Apr 3, 2026

Changes in this version

type ClientConfig

+ TLSClient tls.ClientConfig

v0.2.1

Mar 5, 2026

Changes in this version

+ var ErrNoIdentity = fmt.Errorf("no identity information found in config")

v0.2.0

Mar 5, 2026

v0.1.0

Mar 1, 2026

Changes in this version

+ var ErrInvalidClaims = errors.New("invalid claims format")

+ var ErrInvalidToken = errors.New("invalid token")

+ var ErrTokenValidation = errors.New("token validation failed")

+ func DefaultTokenSourceFactories() map[string]TokenSourceFactory

+ func DeviceCodeUIConsoleQR(deviceCode *oauth2.DeviceAuthResponse) error

+ func DeviceCodeUIConsoleText(deviceCode *oauth2.DeviceAuthResponse) error

+ func ExtractClaims[T jwtvalidator.CustomClaims](claims any) (jwtvalidator.RegisteredClaims, T, error)

+ func NewHTTPClientFromConfig(cfg *ClientConfig) (*http.Client, error)

+ func NewMultiValidatorFromConfig(configs []ValidatorConfig, opts ...validator.Option) (jwt.TokenValidator, error)

+ func NewTokenSourceFromConfig(cfg ClientConfig) oauth2.TokenSource

+ func NewTokenSourceFromConfigWithFactories(cfg ClientConfig, factories map[string]TokenSourceFactory, store TokenStore, ...) (oauth2.TokenSource, error)

+ func NewValidatorDebugger(v jwt.TokenValidator, opts ...DebuggerOpt) jwt.TokenValidator

+ func NewValidatorFromConfig(cfg *ValidatorConfig) (jwt.TokenValidator, error)

+ func NewValidatorFromConfigWithOptions(cfg *ValidatorConfig, opts ...ValidatorOpt) (jwt.TokenValidator, error)

+ func NewWaitingTokenSource(ctx context.Context, source oauth2.TokenSource, ...) oauth2.TokenSource

+ func NewWaitingTokenSourceFromConfig(ctx context.Context, cfg ClientConfig, interval, timeout time.Duration) (oauth2.TokenSource, error)

+ func ResolveTokenFromFile(filePath string) (*oauth2.Token, error)

+ func SaveTokenToFile(token *oauth2.Token, filePath string) error

+ func WithCustomClaims[T jwtvalidator.CustomClaims](t T) func(e Endpoint)

+ type Client struct

+ func NewClient(endpoint Endpoint, opts ...ClientOpt) *Client

+ func NewClientFromConfig(config *ClientConfig) (*Client, error)

+ func (c *Client) AuthorizationCodeRedirectFlow(ctx context.Context, state string, scopes []string, redirectURI string, ...) (string, error)

+ func (c *Client) AuthorizationCodeToken(ctx context.Context, code string, redirect_uri string, opts ...RequestOpt) (*oauth2.Token, error)

+ func (c *Client) ClientCredentialsToken(ctx context.Context, opts ...RequestOpt) (*oauth2.Token, error)

+ func (c *Client) DeviceToken(ctx context.Context, scopes ...string) (*oauth2.Token, error)

+ func (c *Client) Endpoint() Endpoint

+ func (c *Client) GothProvider(callbackURL *url.URL, scopes ...string) (goth.Provider, error)

+ func (c *Client) HTTPClient(ctx context.Context, t *oauth2.Token) (*http.Client, error)

+ func (c *Client) IntrospectToken(ctx context.Context, token string) (*IntrospectionResponse, error)

+ func (c *Client) RefreshToken(ctx context.Context, refreshToken string, opts ...RequestOpt) (*oauth2.Token, error)

+ func (c *Client) RefreshingClientCredentialsToken(ctx context.Context, opts ...RequestOpt) (oauth2.TokenSource, error)

+ func (c *Client) TokenSource(t *oauth2.Token) (oauth2.TokenSource, error)

+ func (c *Client) ValidateToken(ctx context.Context, token string, audiences []string) (*jwtvalidator.ValidatedClaims, error)

+ type ClientConfig struct

+ Audience string

+ ClientID string

+ ClientSecret util.MaskedString

+ TLSConfig tls.ClientConfig

+ TokenFile string

+ type ClientOpt func(c *Client)

+ func WithClientID(clientID string) ClientOpt

+ func WithClientIDAndSecret(clientID, clientSecret string) ClientOpt

+ func WithClock(clock Clock) ClientOpt

+ func WithDeviceCodeUI(ui DeviceCodeUI) ClientOpt

+ func WithHTTPClient(doer HTTPDoer) ClientOpt

+ func WithJWKSProvider(provider *jwks.CachingProvider) ClientOpt

+ func WithKeyCacheTTL(ttl time.Duration) ClientOpt

+ func WithKeyFunc(keyFunc func(context.Context) (any, error)) ClientOpt

+ func WithValidatingSignatureAlgorithm(algorithm jwtvalidator.SignatureAlgorithm) ClientOpt

+ type Clock interface

+ Now func() time.Time

+ type Config struct

+ ProviderMap ProviderMap

+ type DebuggerOpt func(*validatorDebugger)

+ func WithLogger(logger zerolog.Logger) DebuggerOpt

+ type DeviceCodeUI func(deviceCode *oauth2.DeviceAuthResponse) error

+ type Endpoint interface

+ DiscoveredConfiguration func() (*OpenIDConfiguration, error)

+ DiscoveryEndpoint func() (*url.URL, error)

+ OAuth2Endpoint func() (oauth2.Endpoint, error)

+ URL func() *url.URL

+ func NewEndpoint(baseURL string, opts ...EndpointOption) (Endpoint, error)

+ func NewEndpointFromConfig(config *EndpointConfig) (Endpoint, error)

+ func NewGitHubActionsEndpoint(baseURL string) (Endpoint, error)

+ func NewGitHubEndpoint(baseURL string) (Endpoint, error)

+ func NewKeycloakRealmEndpoint(baseURLStr, realm string, opts ...EndpointOption) (Endpoint, error)

+ type EndpointConfig struct

+ KeycloakRealm string

+ Type string

+ URL string

+ type EndpointOption func(e Endpoint)

+ func WithHTTPDoer(doer HTTPDoer) EndpointOption

+ type FileTokenStore struct

+ func NewFileTokenStore(path string) *FileTokenStore

+ func (s *FileTokenStore) LoadToken(_ context.Context) (*oauth2.Token, error)

+ func (s *FileTokenStore) SaveToken(_ context.Context, token *oauth2.Token) error

+ type GitHubActionsEndpoint struct

+ func (e *GitHubActionsEndpoint) DiscoveredConfiguration() (*OpenIDConfiguration, error)

+ func (e *GitHubActionsEndpoint) DiscoveryEndpoint() (*url.URL, error)

+ func (e *GitHubActionsEndpoint) OAuth2Endpoint() (oauth2.Endpoint, error)

+ func (e *GitHubActionsEndpoint) URL() *url.URL

+ type GitHubEndpoint struct

+ func (e *GitHubEndpoint) DiscoveredConfiguration() (*OpenIDConfiguration, error)

+ func (e *GitHubEndpoint) DiscoveryEndpoint() (*url.URL, error)

+ func (e *GitHubEndpoint) GothProvider(clientID, clientSecret string, callbackURL *url.URL, scopes ...string) (goth.Provider, error)

+ func (e *GitHubEndpoint) OAuth2Endpoint() (oauth2.Endpoint, error)

+ func (e *GitHubEndpoint) URL() *url.URL

+ type GothEndpoint interface

+ GothProvider func(clientID, clientSecret string, callbackURL *url.URL, scopes ...string) (goth.Provider, error)

+ type HTTPDoer interface

+ Do func(req *http.Request) (*http.Response, error)

+ type IntrospectionResponse struct

+ Active bool

+ AllowedOrigins []string

+ Audience string

+ AuthTime int

+ AuthenticationContextClassReference string

+ AuthorizedParty string

+ ClientId string

+ Email string

+ EmailVerified bool

+ ExpiresAt int

+ FamilyName string

+ GivenName string

+ Groups []string

+ ID string

+ IssuedAt int

+ Issuer string

+ Name string

+ Organisation []string

+ PreferredUsername string

+ RealmAccess struct{ ... }

+ ResourceAccess struct{ ... }

+ Scope string

+ SessionID string

+ Subject string

+ TokenType string

+ Type string

+ UserPrincipalName string

+ Username string

+ Website string

+ func (c *IntrospectionResponse) Validate(_ context.Context) error

+ type KeycloakEndpoint struct

+ func NewKeycloakEndpoint(baseURLStr string) (*KeycloakEndpoint, error)

+ func (e *KeycloakEndpoint) RealmEndpoint(realm string, opts ...EndpointOption) (Endpoint, error)

+ type OpenIDConfiguration struct

+ AcrValuesSupported []string

+ AuthorizationEncryptionAlgValuesSupported []string

+ AuthorizationEncryptionEncValuesSupported []string

+ AuthorizationEndpoint string

+ AuthorizationResponseIssParameterSupported bool

+ AuthorizationSigningAlgValuesSupported []string

+ BackchannelAuthenticationEndpoint string

+ BackchannelAuthenticationRequestSigningAlgValuesSupported []string

+ BackchannelLogoutSessionSupported bool

+ BackchannelLogoutSupported bool

+ BackchannelTokenDeliveryModesSupported []string

+ CheckSessionIframe string

+ ClaimTypesSupported []string

+ ClaimsParameterSupported bool

+ ClaimsSupported []string

+ CodeChallengeMethodsSupported []string

+ DeviceAuthorizationEndpoint string

+ EndSessionEndpoint string

+ FrontchannelLogoutSessionSupported bool

+ FrontchannelLogoutSupported bool

+ GrantTypesSupported []string

+ IDTokenEncryptionAlgValuesSupported []string

+ IDTokenEncryptionEncValuesSupported []string

+ IDTokenSigningAlgValuesSupported []string

+ IntrospectionEndpoint string

+ IntrospectionEndpointAuthMethodsSupported []string

+ IntrospectionEndpointAuthSigningAlgValuesSupported []string

+ Issuer string

+ JWKSURI string

+ MTLSEndpointAliases struct{ ... }

+ PushedAuthorizationRequestEndpoint string

+ RegistrationEndpoint string

+ RequestObjectEncryptionAlgValuesSupported []string

+ RequestObjectEncryptionEncValuesSupported []string

+ RequestObjectSigningAlgValuesSupported []string

+ RequestParameterSupported bool

+ RequestURIParameterSupported bool

+ RequirePushedAuthorizationRequests bool

+ RequireRequestURIRegistration bool

+ ResponseModesSupported []string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ RevocationEndpointAuthMethodsSupported []string

+ RevocationEndpointAuthSigningAlgValuesSupported []string

+ ScopesSupported []string

+ SubjectTypesSupported []string

+ TLSClientCertificateBoundAccessTokens bool

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ TokenEndpointAuthSigningAlgValuesSupported []string

+ UserinfoEncryptionAlgValuesSupported []string

+ UserinfoEncryptionEncValuesSupported []string

+ UserinfoEndpoint string

+ UserinfoSigningAlgValuesSupported []string

+ type ProviderConfig struct

+ Callback string

+ ClientID string

+ ClientSecret string

+ type ProviderMap map[string]ProviderConfig

+ type RefreshingClientCredentialsTokenSource struct

+ func (ts *RefreshingClientCredentialsTokenSource) Token() (*oauth2.Token, error)

+ type RequestOpt func(url.Values)

+ func WithAudience(audience string) RequestOpt

+ type TokenSourceFactory func(cfg ClientConfig) (oauth2.TokenSource, error)

+ type TokenStore interface

+ LoadToken func(ctx context.Context) (*oauth2.Token, error)

+ SaveToken func(ctx context.Context, token *oauth2.Token) error

+ type TokenValidator = jwt.TokenValidator

+ type TrustConfig struct

+ Verifiers []ValidatorConfig

+ type ValidatorConfig struct

+ AllowedClockSkew int

+ Audiences []string

+ CacheTTL int

+ ClaimPredicate map[string]any

+ Debug bool

+ Issuer string

+ SignatureAlgorithm string

+ type ValidatorOpt func(*validatorOptions)

+ func WithValidatorJWKSProvider(provider *jwks.CachingProvider) ValidatorOpt

+ func WithValidatorKeyFunc(keyFunc func(context.Context) (any, error)) ValidatorOpt

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL