Documentation
¶
Index ¶
- Constants
- func IsErrorWithID(err error, id string) bool
- func NewOAuth2Error(id string, description string) utils.ErrorWithDescription
- func WriteWWWAuthenticateError(rw http.ResponseWriter, code int, err error)
- type EmailClaims
- type IDTokenClaims
- type OAuth2Error
- type ProfileClaims
- type ProviderMetadata
- type SessionClaims
- type UserInfoClaims
Constants ¶
const ( // ErrorCodeOAuth2InvalidTarget is the OAuth2 error code for a resource // indicator naming a resource this provider cannot issue a token for, as // defined in https://www.rfc-editor.org/rfc/rfc8707.html#section-2. It is // not defined by oidc-go. ErrorCodeOAuth2InvalidTarget = "invalid_target" // ErrorCodeOAuth2InvalidScope is the OAuth2 error code for a token request // asking for a scope which is unknown or exceeds the one the resource owner // granted, as defined in // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2. It is not // defined by oidc-go. ErrorCodeOAuth2InvalidScope = "invalid_scope" // ErrorCodeOAuth2InvalidClient is the OAuth2 error code for a token request // whose client is unknown or failed to authenticate, as defined in // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2. It is not // defined by oidc-go. ErrorCodeOAuth2InvalidClient = "invalid_client" )
const LibreGraphIDTokenSubjectSaltV1 = "lico-IDToken-v1"
LibreGraphIDTokenSubjectSaltV1 is the salt value used when hashing Subjects in ID tokens created by this application.
Variables ¶
This section is empty.
Functions ¶
func IsErrorWithID ¶
IsErrorWithID returns true if the given error is an OAuth2Error error with the given ID.
func NewOAuth2Error ¶
func NewOAuth2Error(id string, description string) utils.ErrorWithDescription
NewOAuth2Error creates a new error with id and description.
func WriteWWWAuthenticateError ¶
func WriteWWWAuthenticateError(rw http.ResponseWriter, code int, err error)
WriteWWWAuthenticateError writes the provided error with the provided http status code to the provided http response writer as a WWW-Authenticate header with comma separated fields for id and description.
Types ¶
type EmailClaims ¶
type EmailClaims struct {
jwt.RegisteredClaims
Email string `json:"email,omitempty"`
EmailVerified bool `json:"email_verified"`
}
EmailClaims define the claims for the OIDC email scope. https://openid.net/specs/openid-connect-basic-1_0.html#Scopes
func NewEmailClaims ¶
func NewEmailClaims(claims jwt.Claims) *EmailClaims
NewEmailClaims return a new EmailClaims set from the provided jwt.Claims or nil.
type IDTokenClaims ¶
type IDTokenClaims struct {
jwt.RegisteredClaims
Nonce string `json:"nonce,omitempty"`
AuthTime int64 `json:"auth_time,omitempty"`
AccessTokenHash string `json:"at_hash,omitempty"`
CodeHash string `json:"c_hash,omitempty"`
*ProfileClaims
*EmailClaims
*SessionClaims
}
IDTokenClaims define the claims found in OIDC ID Tokens.
type OAuth2Error ¶
type OAuth2Error struct {
ErrorID string `json:"error"`
ErrorDescription string `json:"error_description"`
}
OAuth2Error defines a general OAuth2 error with id and decription.
func (*OAuth2Error) Description ¶
func (err *OAuth2Error) Description() string
Description implements the ErrorWithDescription interface.
func (*OAuth2Error) Error ¶
func (err *OAuth2Error) Error() string
Error implements the error interface.
type ProfileClaims ¶
type ProfileClaims struct {
jwt.RegisteredClaims
Name string `json:"name,omitempty"`
FamilyName string `json:"family_name,omitempty"`
GivenName string `json:"given_name,omitempty"`
PreferredUsername string `json:"preferred_username,omitempty"`
}
ProfileClaims define the claims for the OIDC profile scope. https://openid.net/specs/openid-connect-basic-1_0.html#Scopes
func NewProfileClaims ¶
func NewProfileClaims(claims jwt.Claims) *ProfileClaims
NewProfileClaims return a new ProfileClaims set from the provided jwt.Claims or nil.
type ProviderMetadata ¶ added in v0.69.0
type ProviderMetadata struct {
*oidcgo.WellKnown
// GrantTypesSupported is https://datatracker.ietf.org/doc/html/rfc8414#section-2.
// Omitting it means authorization_code and implicit per OpenID Connect
// Discovery 1.0, which is not what the token endpoint implements.
GrantTypesSupported []string `json:"grant_types_supported,omitempty"`
// ResponseModesSupported is https://datatracker.ietf.org/doc/html/rfc8414#section-2.
ResponseModesSupported []string `json:"response_modes_supported,omitempty"`
// CodeChallengeMethodsSupported is https://datatracker.ietf.org/doc/html/rfc8414#section-2.
// A client which requires PKCE has no other way to discover support for it
// and must refuse to continue when this is absent.
CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
// AuthorizationResponseIssParameterSupported is
// https://datatracker.ietf.org/doc/html/rfc9207#section-2.3. It must only
// be set when authorization responses actually carry the iss parameter.
AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported,omitempty"`
// ClientIDMetadataDocumentSupported announces that a client may use the
// HTTPS URL of its own metadata document as client_id, as specified at
// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-02.
ClientIDMetadataDocumentSupported bool `json:"client_id_metadata_document_supported,omitempty"`
}
ProviderMetadata is the OpenID Connect Discovery 1.0 provider meta data document as specified at https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata, extended with the OAuth 2.0 Authorization Server Metadata (RFC 8414) fields this provider supports but oidcgo.WellKnown does not define. The embedded document is a pointer so this type stays a view onto an existing meta data document rather than a copy of it, and the fields it defines are promoted into the same flat JSON object when serialized.
The fields below are the ones a client needs to use this provider with the Model Context Protocol authorization flow, which requires OAuth 2.1 with PKCE and rejects a provider that does not advertise its code challenge methods.
type SessionClaims ¶
type SessionClaims struct {
SessionID string `json:"sid,omitempty"`
}
SessionClaims define claims related to front end sessions, for example as specified by https://openid.net/specs/openid-connect-frontchannel-1_0.html
type UserInfoClaims ¶
type UserInfoClaims struct {
Subject string `json:"sub,omitempty"`
}
UserInfoClaims define the claims defined by the OIDC UserInfo endpoint.
Source Files
Directories