Documentation
¶
Overview ¶
Package oauth2client holds the configuration model and registry for OAuth2 and OpenID Connect identity-provider clients, looked up by provider id, email or email domain, and a helper to build token-endpoint requests. It does not run the authorization-code flow itself.
Index ¶
- type Client
- func (p *Client) Config() *ClientConfig
- func (p *Client) CreateTokenRequest(v url.Values, authStyle oauth2.AuthStyle) (*http.Request, error)
- func (p *Client) CreateTokenRequestWithContext(ctx context.Context, v url.Values, authStyle oauth2.AuthStyle) (*http.Request, error)
- func (p *Client) PublicKey() *rsa.PublicKey
- func (p *Client) SetClientSecret(s string) *Client
- func (p *Client) SetPubKey(newPubKey *rsa.PublicKey)
- type ClientConfig
- type Config
- type IDPParam
- type Provider
- func (p *Provider) Client(provider string) *Client
- func (p *Provider) ClientForDomain(domain string) *Client
- func (p *Provider) ClientForEmail(email string) *Client
- func (p *Provider) ClientForProvider(provider string) *Client
- func (p *Provider) ClientNames() []string
- func (p *Provider) Domains() []string
- func (p *Provider) Emails() []string
- func (p *Provider) RegisterClient(c *ClientConfig, override bool) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client of OAuth2.
A Client owns a copy of the ClientConfig given to New: later changes to the caller's struct are not seen, and Config returns a copy. After New only the client secret (SetClientSecret) and the issuer public key (SetPubKey) change. A Client is safe for concurrent use.
func LoadClient ¶
LoadClient returns a single `Client` loaded from config
func New ¶
func New(cfg *ClientConfig) (*Client, error)
New returns a Client for a copy of cfg. A PubKey that is not a PEM-encoded RSA public key is an error.
func (*Client) Config ¶
func (p *Client) Config() *ClientConfig
Config returns a copy of the OAuth2 configuration, with the current client secret. Changing the copy does not change the Client.
func (*Client) CreateTokenRequest ¶
func (p *Client) CreateTokenRequest(v url.Values, authStyle oauth2.AuthStyle) (*http.Request, error)
CreateTokenRequest returns a new *http.Request to retrieve a new token from tokenURL using the provided clientID, clientSecret, and POST body parameters.
func (*Client) CreateTokenRequestWithContext ¶ added in v0.29.306
func (p *Client) CreateTokenRequestWithContext(ctx context.Context, v url.Values, authStyle oauth2.AuthStyle) (*http.Request, error)
CreateTokenRequestWithContext is like CreateTokenRequest but binds the request to ctx so the caller can cancel or time out the token exchange.
func (*Client) PublicKey ¶ added in v1.0.310
PublicKey returns the JWT issuer public key parsed from the PubKey setting or given to SetPubKey, or nil. This package does not verify tokens with it; pass it to a verifier, for example in jwt.StaticKeySet.PublicKeys.
func (*Client) SetClientSecret ¶
SetClientSecret sets the client secret used by later token requests
type ClientConfig ¶
type ClientConfig struct {
// Disabled specifies if the client is disabled
Disabled bool `json:"disabled" yaml:"disabled"`
// ProviderID specifies Auth.Provider ID
ProviderID string `json:"provider_id" yaml:"provider_id"`
// ClientID specifies client ID
ClientID string `json:"client_id" yaml:"client_id"`
// ClientSecret specifies client secret
ClientSecret string `json:"client_secret" yaml:"client_secret"`
// Scopes specifies the list of scopes
Scopes []string `json:"scopes" yaml:"scopes"`
// ResponseType specifies the response type, default is "code"
ResponseType string `json:"response_type" yaml:"response_type"`
// JwksURL specifies the JWKS URL of the JWT issuer. This package does
// not fetch it; it is kept for callers that verify the issuer's tokens,
// for example with jwt.NewParser and ParserConfig.JWKSURI
JwksURL string `json:"jwks_url" yaml:"jwks_url"`
// AuthURL specifies auth URL
AuthURL string `json:"auth_url" yaml:"auth_url"`
// TokenURL specifies token URL
TokenURL string `json:"token_url" yaml:"token_url"`
// UserinfoURL specifies userinfo URL
UserinfoURL string `json:"userinfo_url" yaml:"userinfo_url"`
// WellknownURL specifies URL for wellknown info
WellknownURL string `json:"wellknown" yaml:"wellknown"`
// RedirectURL specifies redirect URL
RedirectURL string `json:"redirect_url" yaml:"redirect_url"`
// PubKey specifies PEM encoded RSA Public Key of the JWT issuer. New
// parses it and Client.PublicKey returns it; this package does not
// verify tokens with it
PubKey string `json:"pubkey" yaml:"pubkey"`
// Prompt parameter, such as `consent`
Prompt string `json:"prompt" yaml:"prompt"`
// Audience of JWT token
Audience string `json:"audience" yaml:"audience"`
// Issuer of JWT token
Issuer string `json:"issuer" yaml:"issuer"`
// IDPParam specifies the IDP parameters
IDPParam *IDPParam `json:"idp_param" yaml:"idp_param"`
// Domains specifies the list of domains to filter by
Domains []string `json:"domains" yaml:"domains"`
// Emails specifies the list of emails to filter by
Emails []string `json:"emails" yaml:"emails"`
}
ClientConfig provides OAuth2 configuration
type Config ¶
type Config struct {
// Clients provides a list of supported clients
Clients []*ClientConfig `json:"clients" yaml:"clients"`
}
Config provides OAuth2 configuration for supported clients
func LoadConfig ¶
LoadConfig returns configuration loaded from a file
type IDPParam ¶ added in v0.9.0
type IDPParam struct {
// Name specifies the name of the IDP parameter: idpuser.email|identity_provider
Name string `json:"name" yaml:"name"`
// Value specifies the value the IDP parameter: email|domain|{value}
Value string `json:"value" yaml:"value"`
}
IDPParam is a struct for IDP parameter
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is a registry of OAuth2 clients looked up by provider id, domain or email. It is safe for concurrent use: a registration is published to every index at once, and a rejected one leaves the registry unchanged. The zero value is an empty registry.
func LoadProvider ¶
LoadProvider returns Provider
func NewProvider ¶ added in v0.9.0
NewProvider returns Provider
func (*Provider) ClientForDomain ¶ added in v0.9.0
ClientForDomain returns Client by domain
func (*Provider) ClientForEmail ¶ added in v0.10.0
ClientForEmail returns Client by email, falling back to the client configured for the email's domain. It returns nil for a value that is not an address of the form local@domain.
func (*Provider) ClientForProvider ¶ added in v0.9.0
ClientForProvider returns Client by provider
func (*Provider) ClientNames ¶ added in v0.5.0
ClientNames returns list of supported clients
func (*Provider) RegisterClient ¶ added in v0.9.0
func (p *Provider) RegisterClient(c *ClientConfig, override bool) error
RegisterClient registers a new client under its provider id, domains and emails. Without override, a provider id, domain or email that is already registered is an error and nothing is registered. With override, the previous client of the same provider id is removed from every index, and a domain or email registered by another client is taken over.
Source Files