Documentation
¶
Overview ¶
Package oidc 实现 OIDC 单点登录（P2，stdlib-only，无第三方依赖）。
流程（Authorization Code）：
- GET /api/v1/user/oidc/login → 302 到 IdP 授权页（state 为 HMAC 签名时间戳，防 CSRF）
- IdP 回调 GET /api/v1/user/oidc/callback?code&state → 验 state → 换 token → 拉 userinfo
- 按 (issuer, sub) 匹配本地用户，其次按 email，未命中且允许注册则建号
- 签发本站 JWT，302 回前端 /#/oidc/callback?token=xxx
Index ¶
- type Config
- type Service
- func (s *Service) Enabled() bool
- func (s *Service) ExchangeCallback(ctx context.Context, baseURL, code, state string) (string, error)
- func (s *Service) FrontendCallback() string
- func (s *Service) LoginURL(ctx context.Context, baseURL string) (string, error)
- func (s *Service) RedirectURI(baseURL string) string
- func (s *Service) TestDiscovery(ctx context.Context) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Enabled bool `mapstructure:"enabled"`
Issuer string `mapstructure:"issuer"` // 如 https://idp.example.com/realms/fcb
ClientID string `mapstructure:"client_id"`
ClientSecret string `mapstructure:"client_secret"`
Scopes string `mapstructure:"scopes"` // 默认 "openid profile email"
FrontendCallback string `mapstructure:"frontend_callback"` // 默认 /#/oidc/callback
}
Config OIDC 配置（conf.SecurityConfig.OIDC）
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service OIDC 登录服务
func (*Service) ExchangeCallback ¶
func (s *Service) ExchangeCallback(ctx context.Context, baseURL, code, state string) (string, error)
ExchangeCallback 处理回调：code → token → userinfo → 本地用户 → JWT
func (*Service) FrontendCallback ¶
FrontendCallback 前端回调地址（带 token= 前缀；hash 路由 query）
func (*Service) RedirectURI ¶
RedirectURI 回调地址（本站）
Source Files
Click to show internal directories.
Click to hide internal directories.