Documentation
¶
Overview ¶
Package oidc provides a minimal OpenID Connect client used by GraphJin's built-in login flow. It performs OIDC discovery, exchanges an authorization code for tokens via golang.org/x/oauth2, and verifies the ID token using the JWKS from the discovery document.
It intentionally does not depend on github.com/coreos/go-oidc to keep the module's transitive dependency set small — JWKS verification reuses the lestrrat-go/jwx library already pulled in by auth/provider.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// IssuerURL is the OIDC issuer — discovery happens at
// <IssuerURL>/.well-known/openid-configuration.
IssuerURL string
// ClientID / ClientSecret are the registered OAuth client credentials.
ClientID string
ClientSecret string
// RedirectURI registered with the IdP. If empty, the caller is expected to
// override it per-request (useful when the server listens on multiple
// hostnames).
RedirectURI string
// Scopes requested. Defaults to ["openid", "email", "profile"] when empty.
Scopes []string
// AllowedEmails / AllowedDomains are optional allow-lists applied after a
// successful OIDC sign-in. If both are empty, any verified identity is
// accepted.
AllowedEmails []string
AllowedDomains []string
}
Config describes a single OIDC identity provider. It works for any OIDC-compliant issuer (Google, Okta, Keycloak, Azure AD, Auth0-as-IdP, ...).
type Identity ¶
type Identity struct {
Subject string
Email string
EmailVerified bool
Name string
Issuer string
Raw jwt.MapClaims
}
Identity is the minimum user info extracted from a verified ID token.
func (Identity) NamespacedSubject ¶
NamespacedSubject returns a stable identifier combining issuer and subject, safe to use as the `sub` claim of a locally-minted JWT when multiple IdPs share the same subject namespace.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is a configured OIDC client.
func NewProvider ¶
NewProvider fetches the OIDC discovery document and returns a ready-to-use Provider.
func (*Provider) AuthCodeURL ¶
AuthCodeURL returns the IdP URL the browser should be redirected to. `state` must be opaque and verified on the callback. `redirectURI` overrides the configured one if non-empty (useful when the callback host is derived from the request).
Source Files