Documentation
¶
Overview ¶
Package oidc performs OIDC/OAuth2 authentication and returns an ID token. It is a plain library: callers own how the token state and user-facing progress are surfaced (the broker streams progress to ssh sessions; other callers may just discard it).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Scopes = []string{"openid", "profile", "email"}
Scopes is the fixed set requested during browser authentication. Policy maps a verified token to inventory using its configured identity mode.
Functions ¶
func Authenticate ¶ added in v0.18.0
func Authenticate(ctx context.Context, cfg Config, prev *oauth2.Token, out io.Writer) (idToken string, next *oauth2.Token, err error)
Authenticate returns a fresh ID token. prev carries refresh state from the previous call (nil on first use); the returned token is the next state. User-facing progress ("visit this URL…") is written to out.
Types ¶
type Config ¶
type Config struct {
IssuerURL string
ClientID string
ClientSecret string // Optional for PKCE.
TLSConfig tlsconfig.Config
}
Config holds OIDC authentication configuration.
type Verifier ¶ added in v0.27.0
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks ID tokens independently of inventory identity mapping. It can be shared by concurrent callers and caches the provider's signing keys.
func NewVerifier ¶ added in v0.27.0
NewVerifier discovers the configured issuer and prepares token verification.
Source Files