Documentation
¶
Overview ¶
Package auth obtains service-to-service access tokens from Keycloak using the OAuth2 client_credentials grant.
Tokens are cached per audience. A cache hit never takes a lock and never waits on the network: once a token is warm, callers are served from an atomic read while refreshes happen in the background. Concurrent cold fetches for the same audience collapse into a single request; different audiences never block each other.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoToken = errors.New("keycloak returned no access token")
ErrNoToken reports that Keycloak returned a response without an access token.
Functions ¶
This section is empty.
Types ¶
type Options ¶ added in v2.8.28
type Options struct {
// TokenURL is the Keycloak token endpoint, taken from the rotator-managed
// secret (token_endpoint).
TokenURL string
// ClientID and ClientSecret authenticate this service against Keycloak.
ClientID string
ClientSecret string
// HTTPClient is used for token requests. Defaults to a client with a 5s
// timeout.
HTTPClient *http.Client
// Now defaults to clock.GlobalClock.Now.
Now func() time.Time
}
Options configures a TokenSource.
type TokenSource ¶ added in v2.8.28
type TokenSource struct {
// contains filtered or unexported fields
}
TokenSource issues and caches client_credentials tokens for one Keycloak client. It is safe for concurrent use and must be created with NewTokenSource.
func NewTokenSource ¶ added in v2.8.28
func NewTokenSource(ctx context.Context, opts Options) *TokenSource
NewTokenSource returns a TokenSource. ctx parents background refreshes, so pass the application context, not a request context.
func (*TokenSource) Token ¶ added in v2.8.28
Token returns an access token valid for audience. A warm token is returned without blocking; a token inside its refresh window is returned immediately while a refresh runs in the background. Only a cold or expired token makes the caller wait, and then only one caller per audience actually calls Keycloak.
type Transport ¶
type Transport struct {
// Source issues the tokens. Required.
Source *TokenSource
// Audience is the callee's Keycloak client id, which becomes the token's
// aud claim. Required.
Audience string
// Next defaults to http.DefaultTransport.
Next http.RoundTripper
}
Transport adds a client-credentials bearer token for one audience to every request it forwards. One Transport per callee audience; all of them should share a single TokenSource so the token cache is shared too.
Source Files