Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ResolveUserIDClaim ¶
ResolveUserIDClaim uses only the configured issuer, never unverified token contents. Entra defaults apply to tenant-specific v1 and v2 issuer URLs. Other providers, including Google and Okta, default to the standard sub.
Types ¶
type Claims ¶
type Claims struct {
// Issuer is the configured issuer against which the token was verified.
Issuer string
// Subject is the stable, case-sensitive identifier within this issuer.
Subject string
// UserID is the verified claim value used to look up the inventory user.
UserID string
// ExpiresAt is when the token expires.
ExpiresAt time.Time
}
Claims represents the claims extracted from an OIDC token.
type Config ¶
type Config struct {
// Issuer is the OIDC provider issuer URL (e.g., "https://accounts.google.com").
Issuer string
// ClientID is the expected audience claim. Required: without it, any
// token issued by the provider for any client would be accepted.
ClientID string
// IdentityMode selects how verified claims resolve to an inventory ID.
IdentityMode IdentityMode
// UserIDClaim selects a top-level string claim to map to inventory ID.
// Empty selects the provider default (oid for Entra, sub otherwise).
UserIDClaim string
// TLSConfig configures TLS for OIDC provider connections.
TLSConfig tlsconfig.Config
}
Config configures the OIDC validator.
type IdentityMode ¶
type IdentityMode string
IdentityMode defines how a verified ID token maps to an inventory user.
const ( StableID IdentityMode = "stable-id" VerifiedEmail IdentityMode = "verified-email" )
func ResolveIdentity ¶
func ResolveIdentity(issuer string, mode IdentityMode, override string) (IdentityMode, string, error)
ResolveIdentity validates identity settings without network access. Empty mode defaults to stable-id. Claim overrides, including email, are administrator choices and receive no special email-verification checks in stable-id mode.
type Validator ¶
type Validator struct {
// contains filtered or unexported fields
}
Validator validates OIDC JWT tokens.
func NewValidator ¶
NewValidator creates a new OIDC token validator. It performs OIDC discovery to fetch the provider's JWKS (public keys).
Source Files