oidc

package
v0.0.0-...-cda7d01 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 21, 2025 License: Apache-2.0 Imports: 20 Imported by: 74

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AuthCodeURL

func AuthCodeURL(state string) (string, error)

AuthCodeURL returns the URL for OIDC provider's consent page. The state should be verified when user is redirected back to Harbor.

func GroupsFromClaims

func GroupsFromClaims(gp claimsProvider, k string) ([]string, bool)

GroupsFromClaims fetches the group name list from claimprovider, such as decoded ID token. If the claims does not have the claim defined as k, the second return value will be false, otherwise true

func SetHardcodeVerifierForTest

func SetHardcodeVerifierForTest(s string)

SetHardcodeVerifierForTest overwrite the default secret manager for testing. Be reminded this is for testing only.

func TestEndpoint

func TestEndpoint(conn Conn) error

TestEndpoint tests whether the endpoint is a valid OIDC endpoint. The nil return value indicates the success of the test

func VerifySecret

func VerifySecret(ctx context.Context, name string, secret string) (*models.User, error)

VerifySecret calls the manager to verify the secret.

func VerifyToken

func VerifyToken(ctx context.Context, rawIDToken string) (*gooidc.IDToken, error)

VerifyToken verifies the ID token based on the OIDC settings

Types

type Conn

type Conn struct {
	URL        string `json:"url"`
	VerifyCert bool   `json:"verify_cert"`
}

Conn wraps connection info of an OIDC endpoint

type SecretManager

type SecretManager interface {
	// VerifySecret verifies the secret and the token associated with it, it refreshes the token in the DB if it's
	// refreshed during the verification.  It returns a populated user model based on the ID token associated with the secret.
	VerifySecret(ctx context.Context, username string, secret string) (*models.User, error)
}

SecretManager is the interface for store and verify the secret

type SecretVerifyError

type SecretVerifyError struct {
	// contains filtered or unexported fields
}

SecretVerifyError wraps the different errors happened when verifying a secret for OIDC user. When seeing this error, the caller should consider this an authentication error.

func (*SecretVerifyError) Error

func (se *SecretVerifyError) Error() string

type Token

type Token struct {
	oauth2.Token
	RawIDToken string `json:"id_token,omitempty"`
}

Token wraps the attributes of a oauth2 token plus the attribute of ID token

func ExchangeToken

func ExchangeToken(ctx context.Context, code string) (*Token, error)

ExchangeToken get the token from token provider via the code

type UserInfo

type UserInfo struct {
	Issuer   string   `json:"iss"`
	Subject  string   `json:"sub"`
	Username string   `json:"name"`
	Email    string   `json:"email"`
	Groups   []string `json:"groups"`
	// contains filtered or unexported fields
}

UserInfo wraps the information that is extracted via token. It will be transformed to data object that is persisted in the DB

func UserInfoFromToken

func UserInfoFromToken(ctx context.Context, token *Token) (*UserInfo, error)

UserInfoFromToken tries to call the UserInfo endpoint of the OIDC provider, and consolidate with ID token to generate a UserInfo object, if the ID token is not in the input token struct, some attributes will be empty

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL