Documentation
¶
Overview ¶
Package oidc implements OIDC token handling in a multi-tenant environment. For this a Handler is created, which holds the Providers for validating tokens. You can either register providers in a static manner, or inject a client to query providers during runtime.
Index ¶
- Variables
- type Handler
- func (handler *Handler) Introspect(ctx context.Context, issuer, bearerToken, introspectToken string, ...) (Introspection, error)
- func (handler *Handler) ParseAndValidate(ctx context.Context, rawToken string, userclaims any, useCache bool) error
- func (handler *Handler) ProviderFor(ctx context.Context, issuer string) (*Provider, error)
- func (handler *Handler) RegisterStaticProvider(provider *Provider)
- type HandlerOption
- func WithFeatureGates(fg *commoncfg.FeatureGates) HandlerOption
- func WithIssuerClaimKeys(issuerClaimKeys ...string) HandlerOption
- func WithProviderCacheExpiration(expiration, cleanup time.Duration) HandlerOption
- func WithProviderClient(providerClient ProviderClient) HandlerOption
- func WithStaticProvider(provider *Provider) HandlerOption
- type Introspection
- type Provider
- type ProviderClient
- type ProviderOption
- type ProviderSource
- type ProviderSourceOption
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidToken = errors.New("invalid token") ErrNoProvider = errors.New("no provider") )
var (
DefaultIssuerClaims = []string{"iss"}
)
Functions ¶
This section is empty.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler tracks the set of identity providers to support multi tenancy.
func NewHandler ¶
func NewHandler(opts ...HandlerOption) (*Handler, error)
NewHandler creates a new handler and applies the given options.
func (*Handler) Introspect ¶
func (handler *Handler) Introspect(ctx context.Context, issuer, bearerToken, introspectToken string, useCache bool) (Introspection, error)
Introspect an access or refresh token with the given issuer.
func (*Handler) ParseAndValidate ¶
func (*Handler) ProviderFor ¶
ProviderFor returns the provider for the given issuer. It either looks up the provider in the internal cache or queries the provider client.
func (*Handler) RegisterStaticProvider ¶ added in v0.5.4
RegisterStaticProvider registers a provider with the handler.
type HandlerOption ¶
HandlerOption is used to configure a handler.
func WithFeatureGates ¶ added in v0.7.0
func WithFeatureGates(fg *commoncfg.FeatureGates) HandlerOption
func WithIssuerClaimKeys ¶
func WithIssuerClaimKeys(issuerClaimKeys ...string) HandlerOption
WithIssuerClaimKeys configures the behavior of a certain provider.
func WithProviderCacheExpiration ¶
func WithProviderCacheExpiration(expiration, cleanup time.Duration) HandlerOption
WithProviderCacheExpiration configures the expiration of cached providers.
func WithProviderClient ¶
func WithProviderClient(providerClient ProviderClient) HandlerOption
func WithStaticProvider ¶ added in v0.5.4
func WithStaticProvider(provider *Provider) HandlerOption
WithStaticProvider registers the given provider.
type Introspection ¶
type Introspection struct {
Active bool `json:"active"` // Required. Indicator of whether the presented token is currently active.
}
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider represents a specific OIDC provider.
func NewProvider ¶
NewProvider creates a new provider and applies the given options.
func (*Provider) SigningKeyFor ¶
func (provider *Provider) SigningKeyFor(ctx context.Context, keyID string) (*jose.JSONWebKey, error)
SigningKeyFor returns the key for the given key.
type ProviderClient ¶
ProviderClient is an interface for looking up providers for the issuer.
type ProviderOption ¶
ProviderOption is used to configure a provider.
func WithClient ¶
func WithClient(c *http.Client) ProviderOption
WithClient configures a dedicated http client.
func WithCustomJWKSURI ¶
func WithCustomJWKSURI(jwksURI *url.URL) ProviderOption
WithCustomJWKSURI configures a custom JWKS URI.
func WithIntrospectTokenURL ¶
func WithIntrospectTokenURL(introspectURL *url.URL) ProviderOption
WithIntrospectTokenURL configures a token introspection endpoint.
func WithSigningKeyCacheExpiration ¶
func WithSigningKeyCacheExpiration(expiration, cleanup time.Duration) ProviderOption
WithSigningKeyCacheExpiration configures the expiration of cached signing keys. A cach miss will result in a new request to the JWKS URI.
func WithoutCache ¶
func WithoutCache() ProviderOption
type ProviderSource ¶
type ProviderSource struct {
// contains filtered or unexported fields
}
func NewProviderSource ¶
func NewProviderSource(opts ...ProviderSourceOption) (*ProviderSource, error)
NewProviderSource creates a new OIDC provider and applies the given options.
type ProviderSourceOption ¶
type ProviderSourceOption func(*ProviderSource) error
ProviderSourceOption is used to configure an OIDC provider source.
func WithGRPCConn ¶
func WithGRPCConn(grpcConn *grpc.ClientConn) ProviderSourceOption
Source Files