Documentation
¶
Overview ¶
Package oidcclient contains target-independent host-side OIDC public-client mechanics.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrDiscovery reports rejected or unavailable exact-issuer metadata. ErrDiscovery = errors.New("oidcclient: discovery rejected") // ErrAuthorization reports a rejected browser callback or invalid client configuration. ErrAuthorization = errors.New("oidcclient: authorization rejected") // ErrToken reports an exchange or access-token profile rejection. ErrToken = errors.New("oidcclient: token rejected") // ErrStorage reports unavailable or corrupt protected local key material. ErrStorage = errors.New("oidcclient: protected storage unavailable") )
Functions ¶
func Revoke ¶
Revoke makes one RFC 7009 request. It never includes provider response text in its returned error.
func ValidateAccessToken ¶
ValidateAccessToken validates a refreshed access token against exact-issuer metadata. Callers that durably retain refresh-token rotation must invoke this only after committing the exchange result.
Types ¶
type Config ¶
type Config struct {
Issuer, ClientID, Audience, RedirectURI string
Scopes []string
HTTPClient *http.Client
Present func(context.Context, string) (oauthlogin.Result, error)
ValidateAccessToken func(context.Context, string) error
}
Config describes one exact-issuer public-client authorization-code exchange.
type Keyring ¶
type Keyring struct {
// contains filtered or unexported fields
}
Keyring supplies one credential-root-bound encryption key from the OS keyring.
func NewKeyring ¶
NewKeyring binds OS-keyring access to one explicit owner-only credential root.
type Token ¶
Token is the transient result of an authorization-code or refresh exchange.
func AuthorizationCode ¶
AuthorizationCode performs exact-issuer discovery and one PKCE-S256 exchange.
Source Files