README
Documentation
¶
Index ¶
- Variables
- func DefaultWriteHeaders(hw http.ResponseWriter, ishttps bool)
- type Config
- type EventFunc
- type FailedFunc
- type HandleFunc
- type JawsAuth
- type OAuth2CallbackError
- type Server
- func (srv *Server) GetAdmins() (emails []string)
- func (srv *Server) HandleAuthResponse(hw http.ResponseWriter, hr *http.Request)
- func (srv *Server) HandleLogin(hw http.ResponseWriter, hr *http.Request)
- func (srv *Server) HandleLogout(hw http.ResponseWriter, hr *http.Request)
- func (srv *Server) Handler(name string, dot any) http.Handler
- func (srv *Server) HandlerAdmin(name string, dot any) http.Handler
- func (srv *Server) IsAdmin(email string) (yes bool)
- func (srv *Server) Set403Handler(h http.Handler)
- func (srv *Server) SetAdmins(emails []string)
- func (srv *Server) Valid() bool
- func (srv *Server) Wrap(h http.Handler) (rh http.Handler)
- func (srv *Server) WrapAdmin(h http.Handler) (rh http.Handler)
Constants ¶
This section is empty.
Variables ¶
var ErrConfigURLMissingHost = errors.New("url host is missing")
var ErrConfigURLNotAbsolute = errors.New("url is not absolute")
var ErrInconsistentState = errors.New("oauth2 inconsistent state")
var ErrOAuth2Callback = errors.New("oauth2 callback error")
ErrOAuth2Callback matches OAuth2 callback errors returned by the identity provider.
var ErrOAuth2MissingIssuer = errors.New("oauth2 missing issuer")
ErrOAuth2MissingIssuer means the callback did not include the required "iss" parameter.
var ErrOAuth2MissingSession = errors.New("oauth2 missing session")
var ErrOAuth2MissingState = errors.New("oauth2 missing state")
var ErrOAuth2NotConfigured = errors.New("oauth2 not configured")
var ErrOAuth2WrongIssuer = errors.New("oauth2 wrong issuer")
ErrOAuth2WrongIssuer means the callback "iss" parameter does not match the expected issuer.
var ErrOAuth2WrongState = errors.New("oauth2 wrong state")
var WriteHeaders = DefaultWriteHeaders
WriteHeaders is called to write HTTP headers for all OAuth endpoint responses
Functions ¶
func DefaultWriteHeaders ¶ added in v1.0.1
func DefaultWriteHeaders(hw http.ResponseWriter, ishttps bool)
Types ¶
type Config ¶
type Config struct {
RedirectURL string // e.g. "https://application.example.com/oauth2/callback"
AuthURL string // e.g. "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/authorize"
TokenURL string // e.g. "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token"
Issuer string // e.g. "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0": optional, if empty callback "iss" is ignored
UserInfoURL string // e.g. "https://graph.microsoft.com/v1.0/me?$select=displayName,mail"
Scopes []string // e.g. []string{"user.read"}
ClientID string
//gosec:disable G117
ClientSecret string
}
type FailedFunc ¶ added in v0.9.0
type HandleFunc ¶
type OAuth2CallbackError ¶ added in v1.0.0
type OAuth2CallbackError struct {
Code string // OAuth2 error code from the callback.
Description string // Optional error description from the callback.
URI string // Optional URI with details about the callback error.
}
OAuth2CallbackError describes an OAuth2 callback error response.
func (*OAuth2CallbackError) Error ¶ added in v1.0.0
func (err *OAuth2CallbackError) Error() string
func (*OAuth2CallbackError) Is ¶ added in v1.0.0
func (err *OAuth2CallbackError) Is(target error) bool
type Server ¶
type Server struct {
Jaws *jaws.Jaws
//gosec:disable G117
SessionKey string // default is "oauth2userinfo", value will be of type map[string]any // #nosec G117
SessionTokenKey string // default is "oauth2token", value will be of type oauth2.TokenSource
SessionEmailKey string // default is "email", value will be of type string
HandledPaths map[string]struct{} // URI paths we have registered handlers for
LoginEvent EventFunc // if not nil, called after a successful login
LogoutEvent EventFunc // if not nil, called before logout
LoginFailed FailedFunc // if not nil, called on failed login
Options []oauth2.AuthCodeOption // options to use, see https://pkg.go.dev/golang.org/x/oauth2#AuthCodeOption
PKCE bool // if true, use RFC 7636 PKCE with S256 challenge/verifier
// contains filtered or unexported fields
}
func (*Server) GetAdmins ¶ added in v0.6.0
GetAdmins returns a sorted list of the administrator emails. If empty, everyone is considered an administrator.
func (*Server) HandleAuthResponse ¶
func (srv *Server) HandleAuthResponse(hw http.ResponseWriter, hr *http.Request)
func (*Server) HandleLogin ¶
func (srv *Server) HandleLogin(hw http.ResponseWriter, hr *http.Request)
func (*Server) HandleLogout ¶
func (srv *Server) HandleLogout(hw http.ResponseWriter, hr *http.Request)
func (*Server) Handler ¶
Handler returns a http.Handler using a jaws.Template that requires an authenticated user. Sets the jaws Session value srv.SessionKey to what UserInfoURL returned.
func (*Server) HandlerAdmin ¶ added in v0.6.0
HandlerAdmin returns a http.Handler using a jaws.Template that requires an authenticated user having an email set using SetAdmins() before invoking h. Sets the jaws Session value srv.SessionKey to what UserInfoURL returned.
func (*Server) IsAdmin ¶ added in v0.6.0
IsAdmin returns true if email belongs to an admin or if the list of admins is empty or the server is not valod.
func (*Server) Set403Handler ¶ added in v0.6.0
func (*Server) SetAdmins ¶ added in v0.6.0
SetAdmins sets the emails of administrators. If empty, everyone is considered an administrator.
func (*Server) Wrap ¶
Wrap returns a http.Handler that requires an authenticated user before invoking h. Sets the jaws Session value srv.SessionKey to what UserInfoURL returned. If the Server is not Valid, returns h.
Source Files
Directories