Documentation
¶
Index ¶
Constants ¶
const DefaultSubjectClaim = "sub"
DefaultSubjectClaim is the token claim used to identify the data owner when no SubjectClaim is configured.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type JSONWebKey ¶
type JSONWebKey struct {
Kid string `json:"kid"` // Key ID
Kty string `json:"kty"` // Key Type (e.g., "RSA")
Use string `json:"use"` // Key Use (e.g., "sig")
N string `json:"n"` // Modulus
E string `json:"e"` // Exponent
}
JSONWebKey represents a single key in the JWKS
type JWKS ¶
type JWKS struct {
Keys []JSONWebKey `json:"keys"`
}
JWKS represents the JSON Web Key Set structure
type JWTVerifier ¶
type JWTVerifier struct {
// contains filtered or unexported fields
}
JWTVerifier handles JWT token verification
func NewJWTVerifier ¶
func NewJWTVerifier(config JWTVerifierConfig) (*JWTVerifier, error)
NewJWTVerifier creates a new JWT verifier instance
func (*JWTVerifier) VerifyToken ¶
func (jv *JWTVerifier) VerifyToken(tokenString string) (*jwt.Token, error)
VerifyToken verifies a JWT token and returns the parsed token.
Standard registered claims are validated by the jwt/v5 parser: the RS256 signing method, the signature (via the JWKS key func), expiry/not-before, and — when configured — the issuer and audience. Audience validation natively accepts both the string and array (RFC 7519) forms. The only non-standard, optional check is client_id; there is deliberately no IdP-specific claim (e.g. organization) so the verifier stays generic across identity providers.
func (*JWTVerifier) VerifyTokenAndExtractSubject ¶
func (jv *JWTVerifier) VerifyTokenAndExtractSubject(tokenString string) (string, error)
VerifyTokenAndExtractSubject verifies the token and extracts the data owner's canonical UID from the configured SubjectClaim (defaulting to the standard OIDC "sub"). This is the identifier matched against the consent record's owner_id during portal authorization.
type JWTVerifierConfig ¶
type JWTVerifierConfig struct {
JWKSUrl string
Issuer string
Audience string
ClientID string
// SubjectClaim is the token claim whose value is the data owner's canonical
// UID (matched against the consent record's owner_id). It lets each identity
// provider declare which claim carries the UID (e.g. "sub", "email",
// "individual_id"). When empty it defaults to the standard OIDC "sub".
SubjectClaim string
// InsecureSkipVerify disables TLS certificate verification for the JWKS
// fetch. Intended only for local/dev IdPs using self-signed certs; leave
// false in production.
InsecureSkipVerify bool
}
JWTVerifierConfig holds configuration for the JWT verifier. Each check is applied only when its value is configured (non-empty), so the verifier stays generic across identity providers.
Source Files