Documentation
¶
Overview ¶
Package auth OIDC support: OpenID Connect (OIDC) provider integration for web UI sessions (issue #94). Okta serves as the primary IdP but any OIDC-compliant provider works.
Index ¶
- Constants
- func WithScope(ctx context.Context, s Scope) context.Context
- type OIDCAuth
- func (a *OIDCAuth) EndSessionEndpoint() string
- func (a *OIDCAuth) Exchange(ctx context.Context, code, nonce string) (*OIDCIdentity, string, error)
- func (a *OIDCAuth) LoginURL(state, nonce string) string
- func (a *OIDCAuth) NewSession(identity *OIDCIdentity, scope Scope, rawIDToken string) (string, error)
- func (a *OIDCAuth) ParseSession(sessionToken string) (*SessionClaims, error)
- func (a *OIDCAuth) RedirectOrigin() string
- func (a *OIDCAuth) ScopeForGroups(groups []string) Scope
- func (a *OIDCAuth) ScopeFromCookie(header http.Header) (Scope, bool)
- func (a *OIDCAuth) SessionFromCookie(header http.Header) (*SessionClaims, bool)
- func (a *OIDCAuth) SessionTTL() time.Duration
- func (a *OIDCAuth) TeamGroupPrefix() string
- type OIDCConfig
- type OIDCIdentity
- type Scope
- type SessionClaims
- type TeamFilter
Constants ¶
const ( SessionCookieName = "chetter_session" OAuthStateCookieName = "chetter_oauth_state" OAuthNonceCookieName = "chetter_oauth_nonce" OAuthStateCookieMaxAge = 10 * 60 // 10 minutes )
Cookie names used by the OIDC web flow.
const ( DefaultAdminGroup = "chetter-admin" DefaultTeamGroupPrefix = "chetter-" DefaultSessionTTL = 8 * time.Hour )
Default group mapping values. Groups are mapped to Chetter scopes:
- the admin group grants full admin scope
- any group with the team prefix maps to a team with that name (e.g. chetter-platform -> team "platform")
Variables ¶
This section is empty.
Functions ¶
Types ¶
type OIDCAuth ¶
type OIDCAuth struct {
// contains filtered or unexported fields
}
OIDCAuth wires together an OIDC provider, the OAuth2 client config, and the stateless session JWT signer. A nil *OIDCAuth (or one built from an empty config) disables OIDC authentication entirely.
func NewOIDCAuth ¶
func NewOIDCAuth(ctx context.Context, cfg OIDCConfig) (*OIDCAuth, error)
NewOIDCAuth performs provider discovery and builds the verifier. It returns an error if the provider cannot be reached or the config is incomplete.
func (*OIDCAuth) EndSessionEndpoint ¶
EndSessionEndpoint returns the IdP's end-session endpoint (Okta logout), if the provider advertises one.
func (*OIDCAuth) Exchange ¶
Exchange swaps an authorization code for an identity. The ID token is verified against the provider (signature, issuer, audience, and nonce). The raw ID token is returned so callers can pass it to the IdP's end-session endpoint on logout.
func (*OIDCAuth) NewSession ¶
func (a *OIDCAuth) NewSession(identity *OIDCIdentity, scope Scope, rawIDToken string) (string, error)
NewSession mints a short-lived session JWT for the given identity and scope. The raw ID token is embedded so logout can pass id_token_hint to the IdP.
func (*OIDCAuth) ParseSession ¶
func (a *OIDCAuth) ParseSession(sessionToken string) (*SessionClaims, error)
ParseSession validates a session JWT and returns its claims.
func (*OIDCAuth) RedirectOrigin ¶
RedirectOrigin returns the scheme://host of the configured redirect URL (OIDC_REDIRECT_URL). It is the externally visible origin registered with the IdP, so logout redirects never depend on request headers. It returns "" when the configured URL is missing or cannot be parsed.
func (*OIDCAuth) ScopeForGroups ¶
ScopeForGroups maps OIDC groups to a Chetter scope following the configured admin group and team group prefix. Team scopes carry the group-derived team names; the web API resolves them to real team IDs when present in the DB.
func (*OIDCAuth) ScopeFromCookie ¶
ScopeFromCookie extracts and validates the session cookie from an HTTP header set and returns the session scope. ok is false when the cookie is absent or the session is invalid/expired.
func (*OIDCAuth) SessionFromCookie ¶
func (a *OIDCAuth) SessionFromCookie(header http.Header) (*SessionClaims, bool)
SessionFromCookie extracts and validates the session cookie from an HTTP header set. ok is false when the cookie is absent or invalid/expired.
func (*OIDCAuth) SessionTTL ¶
SessionTTL returns the configured session lifetime.
func (*OIDCAuth) TeamGroupPrefix ¶
TeamGroupPrefix returns the configured team group prefix ("chetter-" by default). Group-to-team mapping strips it to derive the team name.
type OIDCConfig ¶
type OIDCConfig struct {
IssuerURL string
ClientID string
ClientSecret string
RedirectURL string
AdminGroup string
TeamGroupPrefix string
SessionSecret string
SessionTTL time.Duration
}
OIDCConfig holds the OIDC provider and session configuration. It is the auth-package view of the OIDC_* environment variables.
type OIDCIdentity ¶
OIDCIdentity is the verified identity extracted from an ID token.
type Scope ¶
type SessionClaims ¶
type SessionClaims struct {
Subject string `json:"sub"`
Email string `json:"email"`
Admin bool `json:"admin"`
TeamIDs []string `json:"teams,omitempty"`
IDToken string `json:"id_token,omitempty"`
jwt.RegisteredClaims
}
SessionClaims is the signed session JWT carried in the web session cookie.
func (SessionClaims) Scope ¶
func (c SessionClaims) Scope() Scope
Scope converts session claims back into an auth scope.
type TeamFilter ¶
TeamFilter describes the effective team filter for a request. An unconstrained filter is reserved for admins and callers without an auth scope; a scoped filter with no IDs means the request must return no rows.
func ResolveTeamFilter ¶
func ResolveTeamFilter(ctx context.Context, requested []string) TeamFilter
ResolveTeamFilter applies a requested team filter to the caller's scope. For non-admin callers, an empty intersection is an explicit no-result filter, never an instruction to omit the team predicate.
Source Files