Documentation
¶
Index ¶
- Constants
- func GeneratePKCE() (verifier string, challenge string, err error)
- func NewAppleClientSecretProvider(cfg AppleSecretConfig) (func(ctx context.Context) (string, error), error)
- func OutboundHTTPClient() *http.Client
- func SetOutboundHTTPClientForTest(c *http.Client)
- type AppleSecretConfig
- type Claims
- type Manager
- func (m *Manager) Begin(ctx context.Context, provider, state, nonce, codeChallenge, redirectURI string) (string, error)
- func (m *Manager) BeginWithAuthParams(ctx context.Context, provider, state, nonce, codeChallenge, redirectURI string, ...) (string, error)
- func (m *Manager) GetRPWithRedirect(ctx context.Context, provider, redirectURI string) (rp.RelyingParty, error)
- func (m *Manager) IssuerFor(provider string) (string, bool)
- func (m *Manager) Provider(name string) (RPClient, bool)
- type RPClient
- type RPConfig
- type StateCache
- type StateData
Constants ¶
const DefaultOutboundTimeout = 30 * time.Second
DefaultOutboundTimeout bounds OIDC discovery, JWKS fetch, and token exchange.
const DefaultRPCacheTTL = time.Hour
DefaultRPCacheTTL is how long static-secret relying parties are cached after discovery.
Variables ¶
This section is empty.
Functions ¶
func GeneratePKCE ¶
GeneratePKCE returns a verifier and S256 challenge suitable for the auth request.
func NewAppleClientSecretProvider ¶
func NewAppleClientSecretProvider(cfg AppleSecretConfig) (func(ctx context.Context) (string, error), error)
NewAppleClientSecretProvider returns a function that mints a fresh ES256 JWT for client_secret on each call.
func OutboundHTTPClient ¶
OutboundHTTPClient returns the HTTP client used for zitadel RP discovery and token calls.
func SetOutboundHTTPClientForTest ¶
SetOutboundHTTPClientForTest overrides the outbound client (tests only).
Types ¶
type AppleSecretConfig ¶
type AppleSecretConfig struct {
TeamID string // Apple Developer Team ID (iss)
KeyID string // Key ID (kid in header)
ClientID string // Service ID / App ID (sub)
PrivateKeyPEM []byte // contents of the .p8 private key
TTL time.Duration // default 5 minutes if <= 0 (Apple allows up to 6 months)
}
AppleSecretConfig holds details needed to mint an Apple client_secret JWT. See: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
type Claims ¶
type Claims struct {
Subject string
Email *string
EmailVerified *bool
Name *string
PreferredUsername *string
AuthTime time.Time
RawIDToken string
}
Claims is a minimal set of user identity fields extracted from the ID token/userinfo.
func DefaultExchanger ¶
func DefaultExchanger(ctx context.Context, rpClient rp.RelyingParty, provider, code, verifier, nonce string) (Claims, error)
DefaultExchanger exchanges an authorization code using PKCE and extracts minimal claims.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager builds provider RPs and helps construct auth URLs with PKCE.
func NewManager ¶
NewManager initializes the RP clients lazily on first use.
func NewManagerFromProviders ¶
func NewManagerFromProviders(providers map[string]authprovider.Provider) *Manager
func (*Manager) Begin ¶
func (m *Manager) Begin(ctx context.Context, provider, state, nonce, codeChallenge, redirectURI string) (string, error)
Begin returns an authorization URL for the given provider using PKCE and state/nonce you supply. The caller should persist state+verifier (e.g., Redis) and redirect the user to the returned URL.
func (*Manager) BeginWithAuthParams ¶
func (*Manager) GetRPWithRedirect ¶
func (m *Manager) GetRPWithRedirect(ctx context.Context, provider, redirectURI string) (rp.RelyingParty, error)
GetRP exposes the relying party for a configured provider.
type RPClient ¶
type RPClient struct {
Issuer string
ClientID string
ClientSecret string // For Apple, supply a generated JWT client secret
// ClientSecretProvider, if set, is called to obtain a fresh client_secret
// whenever an RP is constructed (e.g., for Apple where the secret is a short‑lived ES256 JWT).
ClientSecretProvider func(ctx context.Context) (string, error)
Scopes []string
// Optional: additional auth params (e.g., response_mode)
ExtraAuthParams map[string]string
PKCE bool
}
RPClient holds issuer-based OIDC settings for a single IdP (internal RP wiring).
func RPClientFromProvider ¶
func RPClientFromProvider(provider authprovider.Provider) (RPClient, error)
type RPConfig ¶
type RPConfig struct {
ClientID string
ClientSecret string
// Optional: dynamic secret minting
SecretProvider func(ctx context.Context) (string, error)
// Optional: additional/override scopes. "openid" will be ensured.
Scopes []string
}
RPConfig describes an IdP (Relying Party) with minimal fields. If ClientSecret is empty and SecretProvider is set, the manager will call it to obtain a short‑lived client_secret (e.g., Apple’s ES256 JWT).
type StateCache ¶
type StateCache interface {
Put(ctx context.Context, state string, data StateData) error
Get(ctx context.Context, state string) (StateData, bool, error)
Del(ctx context.Context, state string) error
}
StateCache stores ephemeral OIDC state/PKCE data (backed by Redis in the app).
type StateData ¶
type StateData struct {
Provider string
Verifier string
Nonce string
RedirectURI string
LinkUserID string
ReturnTo string
AccountInviteToken string
// StepUp* fields identify a step-up authentication flow for an existing
// session. Login/link flows leave these empty.
StepUpUserID string
StepUpSessionID string
StepUpReturnTo string
StepUpStartedAt time.Time
UI string // "popup" to trigger popup HTML callback; else redirect
PopupNonce string // echoed in popup postMessage for opener validation
}
StateData is what we persist for a pending OIDC login.
Source Files