Documentation
¶
Overview ¶
Package oidc performs OIDC/OAuth2 authentication and returns an ID token. It is a plain library: callers own how the token state and user-facing progress are surfaced (the broker streams progress to ssh sessions; other callers may just discard it).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDeviceAuthorizationUnsupported = errors.New("OIDC issuer does not advertise device authorization")
ErrDeviceAuthorizationUnsupported means the issuer did not advertise the RFC 8628 endpoint required for device login.
var Scopes = []string{"openid", "profile", "email"}
Scopes is the fixed set requested during browser authentication. Policy maps a verified token to inventory using its configured identity mode.
Functions ¶
func Authenticate ¶ added in v0.18.0
func Authenticate(ctx context.Context, cfg Config, prev *oauth2.Token, out io.Writer) (idToken string, next *oauth2.Token, err error)
Authenticate returns a fresh ID token. prev carries refresh state from the previous call (nil on first use); the returned token is the next state. User-facing progress ("visit this URL…") is written to out.
Types ¶
type Config ¶
type Config struct {
IssuerURL string
ClientID string
ClientSecret string // Optional for PKCE.
TLSConfig tlsconfig.Config
LoginMethod LoginMethod
}
Config holds OIDC authentication configuration.
type LoginMethod ¶ added in v0.33.0
type LoginMethod uint8
LoginMethod selects the interactive operation used when neither a valid token nor a working refresh token is available. Its zero value preserves the browser-based behavior used before device authorization was added.
const ( LoginBrowser LoginMethod = iota LoginDevice )
type Verifier ¶ added in v0.27.0
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks ID tokens independently of inventory identity mapping. It can be shared by concurrent callers and caches the provider's signing keys.
func NewVerifier ¶ added in v0.27.0
NewVerifier discovers the configured issuer and prepares token verification.
Source Files