Documentation
¶
Overview ¶
Package federation is the optional identity provider surface for other systems (OIDC/OAuth 2.0, SCIM, discovery). See schema.go.
Package federation is the optional identity provider surface this application exposes to other systems (OIDC/OAuth 2.0, SCIM, discovery). It has no mandatory core: it is exactly the features the composition root selects. Remove its registration line to build a pure internal-identity binary.
Index ¶
Constants ¶
const ModuleName = "federation"
ModuleName identifies the federation module in the registry.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type APIFeature ¶
type APIFeature interface {
Feature
APIRoutes(r chi.Router, g RouteGroups)
}
APIFeature mounts endpoints inside the shared /api group.
type Feature ¶
type Feature interface {
Name() string
}
Feature is one mounted unit chosen at the composition root. A feature left out of New does not exist: no routes, no storage, no lifecycle.
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the federation surface: the explicitly wired provider features, mounted in construction order. There is no feature discovery or late registration.
func New ¶
func New(provider ProviderFeature, scim APIFeature, keys StartableFeature, discovery RootRoutableFeature) *Module
New wires the federation surface. The signing-key service is mandatory; a nil one is a wiring bug.
func (*Module) APIRoutes ¶
func (m *Module) APIRoutes(r chi.Router, g RouteGroups)
APIRoutes mounts the provider feature endpoints inside the shared /api group.
func (*Module) Routes ¶
Routes mounts the root-router routes (OIDC /authorize, discovery) outside /api.
type ProviderFeature ¶
type ProviderFeature interface {
APIFeature
RootRoutableFeature
}
ProviderFeature is the OIDC surface: protocol routes on the root router plus client/token management inside /api.
type RootRoutableFeature ¶
RootRoutableFeature mounts routes on the root router, outside /api — e.g. the OIDC /authorize endpoint.
type RouteGroups ¶
type RouteGroups struct {
Admin kernel.Guard // session auth + admin requirement
Self kernel.Guard // session auth (cookie)
}
RouteGroups carries the authentication middleware chains a feature applies at mount time; the composition root builds each chain once. A nil group leaves its guarded routes unmounted (fail closed).
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package discovery serves RFC 8615 endpoints: /.well-known/openid-configuration and /.well-known/jwks.json.
|
Package discovery serves RFC 8615 endpoints: /.well-known/openid-configuration and /.well-known/jwks.json. |
|
Package jwks owns signing key material: generation, encrypted storage, rotation with overlap, and the JWKS key provider consumed by token issuance and the discovery endpoints.
|
Package jwks owns signing key material: generation, encrypted storage, rotation with overlap, and the JWKS key provider consumed by token issuance and the discovery endpoints. |
|
Package oidc is the OpenID Connect / OAuth 2.0 provider surface: /authorize + PAR (root router), /api/oidc/token, userinfo, introspect, revoke, end_session.
|
Package oidc is the OpenID Connect / OAuth 2.0 provider surface: /authorize + PAR (root router), /api/oidc/token, userinfo, introspect, revoke, end_session. |
|
Package scimsync provisions users and groups to a remote SCIM server.
|
Package scimsync provisions users and groups to a remote SCIM server. |