Documentation
¶
Overview ¶
Package idp is a thin generic OIDC RP — authlet's AS uses it to forward user authentication to an upstream issuer (Google, another authlet, etc).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoUser = errors.New("idp: no matching user")
ErrNoUser indicates that the upstream claims did not resolve to a known internal user.
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
Issuer string `json:"iss"`
Subject string `json:"sub"`
Email string `json:"email"`
EmailVerified bool `json:"email_verified"`
Name string `json:"name"`
Picture string `json:"picture"`
Raw map[string]any
}
Claims is the subset of OIDC ID token claims authlet cares about.
type OIDCProvider ¶
type OIDCProvider struct {
// contains filtered or unexported fields
}
OIDCProvider is a configured upstream OIDC issuer. It pairs a verifier for inbound ID tokens with an oauth2 config used to drive the authorization code flow.
func NewForTest ¶
func NewForTest(issuerURL string) *OIDCProvider
NewForTest is a test-only helper that constructs an OIDCProvider with stub-but-non-nil internals so it satisfies Configured() without doing network discovery. Use from external test packages only.
func NewOIDC ¶
func NewOIDC(ctx context.Context, issuerURL, clientID, clientSecret, redirectURL string, scopes []string) (*OIDCProvider, error)
NewOIDC discovers the issuer's metadata and returns a configured provider.
func (*OIDCProvider) AuthURL ¶
func (p *OIDCProvider) AuthURL(state, nonce, codeVerifier string) string
AuthURL returns the upstream authorize URL for the given state, binding a per-flow nonce and a PKCE S256 challenge derived from codeVerifier. The nonce defends the upstream login leg against authorization-code injection (OIDC Core §3.1.2.1); the PKCE challenge binds the upstream code to the verifier presented at Exchange (OAuth 2.1 §7.6). Empty nonce / codeVerifier arguments are omitted so a zero-config test provider still produces a URL.
func (*OIDCProvider) Configured ¶
func (p *OIDCProvider) Configured() bool
Configured reports whether the provider was constructed via NewOIDC. A zero-valued *OIDCProvider is not configured and will panic if used, so callers (notably as.Config.validate) check this rather than just a nil pointer.
func (*OIDCProvider) Exchange ¶
func (p *OIDCProvider) Exchange(ctx context.Context, code, codeVerifier, expectedNonce string) (Claims, error)
Exchange exchanges an upstream authorization code for an ID token and returns the parsed claims. codeVerifier completes the PKCE handshake begun by AuthURL, and expectedNonce is matched byte-for-byte against the id_token's nonce claim: a missing or mismatched nonce fails the exchange, closing the upstream authorization-code injection vector (OIDC Core §3.1.3.7).
func (*OIDCProvider) Issuer ¶
func (p *OIDCProvider) Issuer() string
Issuer returns the upstream issuer URL this provider was configured with.
type UserResolver ¶
UserResolver maps upstream OIDC claims to an internal user ID. Apps implement this against their own user table.
type UserResolverFunc ¶
UserResolverFunc is a function adapter that lets a plain function satisfy the UserResolver interface.
Source Files