Documentation
¶
Overview ¶
Package auth provides server-side OIDC token verification.
Index ¶
- type ConnectorConfig
- type DexConfig
- type Handler
- func (h *Handler) HandleAuthorize(w http.ResponseWriter, r *http.Request)
- func (h *Handler) HandleCallback(w http.ResponseWriter, r *http.Request)
- func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request)
- func (h *Handler) HandleRefresh(w http.ResponseWriter, r *http.Request)
- func (h *Handler) HandleSessionBootstrap(w http.ResponseWriter, r *http.Request)
- func (h *Handler) HandleSessionHandoff(w http.ResponseWriter, r *http.Request)
- func (h *Handler) RateLimitMiddleware() func(http.HandlerFunc) http.HandlerFunc
- func (h *Handler) RegisterBrowserSessionRoutes(router *mux.Router)
- func (h *Handler) RegisterRoutes(router *mux.Router)
- func (h *Handler) SetBrowserIdentityResolver(resolve func(*http.Request) (browsersession.Identity, error))
- func (h *Handler) SetBrowserSessionStore(store *browsersession.Store)
- func (h *Handler) SetTrustedProxies(prefixes []netip.Prefix)
- func (h *Handler) Verifier() *oidc.IDTokenVerifier
- type OIDCConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ConnectorConfig ¶
type ConnectorConfig struct {
Type string `json:"type"` // github, google, ldap, etc.
ID string `json:"id"`
Name string `json:"name"`
Config map[string]interface{} `json:"config,omitempty"`
}
ConnectorConfig defines an identity provider connector.
type DexConfig ¶
type DexConfig struct {
// Connectors defines the identity provider connectors.
Connectors []ConnectorConfig `json:"connectors,omitempty"`
}
DexConfig holds Dex-specific configuration.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler provides OAuth2/OIDC authentication endpoints.
func NewBrowserSessionHandler ¶
func NewBrowserSessionHandler(store *browsersession.Store, resolve func(*http.Request) (browsersession.Identity, error)) *Handler
NewBrowserSessionHandler creates the session-only portion of auth for hubs running in static-token mode without an OIDC provider.
func NewHandler ¶
func NewHandler(ctx context.Context, config *OIDCConfig, railgridClient *railgridclient.Client, bootstrapper *kcp.Bootstrapper, hubExternalURL string, devMode bool) (*Handler, error)
NewHandler creates a new OIDC auth handler.
func (*Handler) HandleAuthorize ¶
func (h *Handler) HandleAuthorize(w http.ResponseWriter, r *http.Request)
HandleAuthorize redirects to the OIDC provider for authentication.
CLI mode: GET /auth/authorize?p=<port>&s=<sessionID>&v=<codeVerifier> Portal mode: GET /auth/authorize?redirect_uri=<url>&s=<sessionID>&v=<codeVerifier>
The CLI generates a PKCE code_verifier and passes it as "v". The hub stores it in the OAuth2 state and sends the corresponding S256 code_challenge to the OIDC provider. The verifier is recovered from state in HandleCallback and used to exchange the auth code — no client secret needed.
When redirect_uri is provided (portal flow), it is used as the callback URL instead of the CLI localhost callback. The redirect_uri must share the same origin as the hub external URL.
func (*Handler) HandleCallback ¶
func (h *Handler) HandleCallback(w http.ResponseWriter, r *http.Request)
HandleCallback handles the OIDC callback after authentication. GET /auth/callback?code=<code>&state=<state>
func (*Handler) HandleLogout ¶
func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request)
HandleLogout revokes the shared browser session and expires its cookie. It accepts GET for a browser navigation fallback and POST for the portal's normal same-origin action.
func (*Handler) HandleRefresh ¶
func (h *Handler) HandleRefresh(w http.ResponseWriter, r *http.Request)
HandleRefresh handles token refresh requests.
func (*Handler) HandleSessionBootstrap ¶
func (h *Handler) HandleSessionBootstrap(w http.ResponseWriter, r *http.Request)
HandleSessionBootstrap establishes or refreshes the hub-wide browser session from an already-authenticated portal bearer. The bearer is used only by the resolver and is never returned, persisted, or forwarded to an application. A valid shared cookie can also bootstrap a refreshed UI session without requiring the portal to expose its bearer again.
func (*Handler) HandleSessionHandoff ¶
func (h *Handler) HandleSessionHandoff(w http.ResponseWriter, r *http.Request)
HandleSessionHandoff moves an already-authenticated API caller into a fresh browser without putting its bearer credential in Chromium. POST mints a short-lived opaque handle; GET atomically consumes it and issues the normal host-only browser-session cookie. The handle is deliberately one-use and expires quickly if the browser never arrives.
func (*Handler) RateLimitMiddleware ¶
func (h *Handler) RateLimitMiddleware() func(http.HandlerFunc) http.HandlerFunc
RateLimitMiddleware exposes the auth rate limiter so auth-adjacent routes mounted outside this package (published-app authorize/exchange) share the same per-IP budget as the interactive auth endpoints.
func (*Handler) RegisterBrowserSessionRoutes ¶
RegisterBrowserSessionRoutes mounts only the shared session endpoints. It is used by static-token-only hubs that do not construct a full OIDC Handler.
func (*Handler) RegisterRoutes ¶
RegisterRoutes registers auth routes on the given gorilla/mux router. Auth endpoints are protected by per-IP rate limiting to prevent brute force attacks.
func (*Handler) SetBrowserIdentityResolver ¶
func (h *Handler) SetBrowserIdentityResolver(resolve func(*http.Request) (browsersession.Identity, error))
SetBrowserIdentityResolver wires the bearer validation seam used by the same-origin bootstrap endpoint. The resolver must return only a stable identity; it must never return a raw token.
func (*Handler) SetBrowserSessionStore ¶
func (h *Handler) SetBrowserSessionStore(store *browsersession.Store)
SetBrowserSessionStore wires the hub-owned opaque browser session store. Keeping this explicit lets static-only hubs use the same store even when no OIDC Handler is constructed.
func (*Handler) SetTrustedProxies ¶
SetTrustedProxies tells the auth rate limiter which connection peers are reverse proxies whose X-Forwarded-For may be believed (see proxy.ClientIP). Without it every request is keyed on the connection peer, so a hub behind a proxy throttles all of its clients as one address.
func (*Handler) Verifier ¶
func (h *Handler) Verifier() *oidc.IDTokenVerifier
Verifier returns the OIDC token verifier for use by other components (e.g., API proxy).
type OIDCConfig ¶
type OIDCConfig struct {
IssuerURL string
BrowserAuthURL string
ClientID string
RedirectURL string
Scopes []string
}
OIDCConfig holds OIDC provider configuration. ClientSecret is intentionally absent: railgrid uses PKCE (public client flow) so no client secret is required on the hub side.
func DefaultOIDCConfig ¶
func DefaultOIDCConfig() *OIDCConfig
DefaultOIDCConfig returns default OIDC configuration.
Source Files