Documentation
¶
Overview ¶
Package oidc ...
Package oidc provides functionality related OIDC based IDPs.
Index ¶
Constants ¶
const (
// WellKnownPath is the path to the well-known OIDC configuration.
WellKnownPath = "/.well-known/openid-configuration"
)
Variables ¶
var ErrUnexpectedSatusCode = fmt.Errorf("unexpected status code")
ErrUnexpectedSatusCode is returned when HTTP 200 is not returned.
Functions ¶
func ValidateClientID ¶ added in v1.5.0
ValidateClientID checks if the provided client ID is valid.
func ValidateScopes ¶ added in v1.5.0
ValidateScopes checks if the provided scopes are valid.
func ValidateURL ¶ added in v1.5.0
ValidateURL checks if the provided URL is valid.
Types ¶
type Config ¶
type Config struct {
// KubeconfigPath is a path to a kubeconfig
KubeconfigPath string
// Pretty print the output.
Pretty bool
// IssuerURL OIDC issuer url.
IssuerURL string
// ClientID ID of the client OIDC app.
ClientID string
// Scopes requested scopes.
Scopes []string
}
Config stores configuration for the OIDC command.
func (*Config) PopulateClientID ¶ added in v1.5.0
PopulateClientID function to fill the configuration with the required ClientID. This function shall be called only in cases when there is no other way to obtain value for ClientID. User will be asked to provide the ClientID in interactive mode. Provided by user value will be parsed, validated and stored in the ClientID property. Note: in case ClientID is not empty - it will be overwritten by user's input.
func (*Config) PopulateIssuerURL ¶ added in v1.5.0
PopulateIssuerURL function to fill the configuration with the required IssuerURL. This function shall be called only in cases when there is no other way to obtain value for IssuerURL. User will be asked to provide the IssuerURL in interactive mode. The URL provided by the user will be parsed, validated and stored in the IssuerURL property. Note: in case IssuerURL is not empty - it will be overwritten by user's input.
type OIDC ¶
type OIDC struct {
// contains filtered or unexported fields
}
OIDC describes the command to configure OIDC settings.
type ProviderConfig ¶
type ProviderConfig struct {
OriginalIssuer string `json:"OriginalIssuer"`
Issuer string `json:"issuer"`
AuthURL string `json:"authorization_endpoint"`
TokenURL string `json:"token_endpoint"`
DeviceAuthURL string `json:"device_authorization_endpoint"`
JWKSURL string `json:"jwks_uri"`
UserInfoURL string `json:"userinfo_endpoint"`
Algorithms []string `json:"id_token_signing_alg_values_supported"`
}
ProviderConfig contains the configuration of an OIDC provider.
func NewProviderConfig ¶ added in v1.6.0
func NewProviderConfig(ctx context.Context, issuer string) (ProviderConfig, error)
NewProviderConfig fetches the OIDC provider configuration from the issuer's well-known endpoint and returns it as a ProviderConfig.
func (*ProviderConfig) NewKeyFunc ¶ added in v1.6.0
NewKeyFunc returns a new function for getting the public JWK keys from the OIDC provider at the given issuer URL.
type StringList ¶ added in v1.17.0
type StringList []string
StringList decodes a claim that IdPs emit either as a single string or as an array. Non-string array items are skipped, so an unexpected shape never fails the login.
func (*StringList) UnmarshalJSON ¶ added in v1.17.0
func (s *StringList) UnmarshalJSON(data []byte) error
UnmarshalJSON implements json.Unmarshaler.
type UserInfo ¶ added in v1.17.0
type UserInfo struct {
Subject string `json:"sub"`
Email string `json:"email"`
Name string `json:"name"`
PreferredUsername string `json:"preferred_username"`
Groups StringList `json:"groups"`
}
UserInfo contains the subset of identity claims Everest reads from the OIDC provider, either from its UserInfo endpoint or from a verified JWT access token. Name and PreferredUsername are only present when the `profile` scope was granted.
func FetchUserInfo ¶ added in v1.17.0
FetchUserInfo calls the OIDC provider's UserInfo endpoint with the given access token and returns the user information. It works with both JWT and opaque access tokens, since the provider (not Everest) is responsible for interpreting the token.
func UserInfoFromJWT ¶ added in v1.17.0
UserInfoFromJWT verifies a JWT access token against the provider's signing keys and returns the identity claims it carries. It fails for opaque tokens and for JWTs that can't be verified locally; callers fall back to FetchUserInfo in that case.
Source Files