provider

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: MIT Imports: 28 Imported by: 0

Documentation

Index

Constants

View Source 
const DefaultAppleIssuer = "https://appleid.apple.com"
View Source 
const IssuerAzureCommon = "https://login.microsoftonline.com/common/v2.0"
View Source 
const IssuerAzureMicrosoft = "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0"

IssuerAzureMicrosoft is the OIDC issuer for microsoft.com accounts: https://learn.microsoft.com/en-us/azure/active-directory/develop/id-token-claims-reference#payload-claims

View Source 
const IssuerAzureOrganizations = "https://login.microsoftonline.com/organizations/v2.0"
View Source 
const IssuerFacebook = "https://www.facebook.com"
View Source 
const IssuerGoogle = "https://accounts.google.com"
View Source 
const (
	IssuerKakao = "https://kauth.kakao.com"
)
View Source 
const (
	IssuerLinkedin = "https://www.linkedin.com/oauth"
)
View Source 
const IssuerSnapchat = "https://accounts.snapchat.com/accounts/oauth2/token"
View Source 
const (
	IssuerVercelMarketplace = "https://marketplace.vercel.com"
)
View Source 
const OtherAppleIssuer = "https://account.apple.com"
View Source 
const UserInfoEndpointGoogle = "https://www.googleapis.com/userinfo/v2/me"

Variables

View Source 
var OverrideClock func() time.Time

OverrideClock can be used to set a custom clock function to be used when parsing ID tokens. Should only be used in tests.

View Source 
var OverrideVerifiers = make(map[string]func(context.Context, *oidc.Config) *oidc.IDTokenVerifier)

OverrideVerifiers can be used to set a custom verifier for an OIDC provider (identified by the provider's Endpoint().AuthURL string). Should only be used in tests.

Functions

func DetectAppleIDTokenIssuer 

func DetectAppleIDTokenIssuer(ctx context.Context, idToken string) (string, error)

func DetectAzureIDTokenIssuer 

func DetectAzureIDTokenIssuer(ctx context.Context, idToken string) (string, error)

func GetName 

func GetName(name linkedinName) string

func IsAppleIssuer 

func IsAppleIssuer(issuer string) bool

func IsAzureCIAMIssuer 

func IsAzureCIAMIssuer(issuer string) bool

func IsAzureIssuer 

func IsAzureIssuer(issuer string) bool

func OverrideGoogleProvider 

func OverrideGoogleProvider(issuer, userInfo string)

OverrideGoogleProvider should only be used in tests!

func ResetGoogleProvider 

func ResetGoogleProvider()

ResetGoogleProvider should only be used in tests!

Types

type AppleIDTokenClaims 

type AppleIDTokenClaims struct {
	jwt.RegisteredClaims

	Email string `json:"email"`

	AuthTime       *float64        `json:"auth_time"`
	IsPrivateEmail *IsPrivateEmail `json:"is_private_email"`

	TransferSub string `json:"transfer_sub"`
}

type AppleProvider 

type AppleProvider struct {
	*oauth2.Config
	// contains filtered or unexported fields
}

AppleProvider stores the custom config for apple provider

func (AppleProvider) AuthCodeURL 

func (p AppleProvider) AuthCodeURL(state string, args ...oauth2.AuthCodeOption) string

func (AppleProvider) GetOAuthToken 

func (p AppleProvider) GetOAuthToken(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)

GetOAuthToken returns the apple provider access token

func (AppleProvider) GetUserData 

func (p AppleProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error)

GetUserData returns the user data fetched from the apple provider

func (AppleProvider) ParseUser 

func (p AppleProvider) ParseUser(data string, userData *UserProvidedData) error

ParseUser parses the apple user's info

func (AppleProvider) RequiresPKCE 

func (p AppleProvider) RequiresPKCE() bool

type AzureIDTokenClaims 

type AzureIDTokenClaims struct {
	jwt.RegisteredClaims

	Email                              string `json:"email"`
	Name                               string `json:"name"`
	PreferredUsername                  string `json:"preferred_username"`
	XMicrosoftEmailDomainOwnerVerified any    `json:"xms_edov"`
}

func (*AzureIDTokenClaims) IsEmailVerified 

func (c *AzureIDTokenClaims) IsEmailVerified() bool

type Claims 

type Claims struct {
	// Reserved claims
	Issuer  string   `json:"iss,omitempty" structs:"iss,omitempty"`
	Subject string   `json:"sub,omitempty" structs:"sub,omitempty"`
	Aud     audience `json:"aud,omitempty" structs:"aud,omitempty"`
	Iat     float64  `json:"iat,omitempty" structs:"iat,omitempty"`
	Exp     float64  `json:"exp,omitempty" structs:"exp,omitempty"`

	// Default profile claims
	Name              string            `json:"name,omitempty" structs:"name,omitempty"`
	FamilyName        string            `json:"family_name,omitempty" structs:"family_name,omitempty"`
	GivenName         string            `json:"given_name,omitempty" structs:"given_name,omitempty"`
	MiddleName        string            `json:"middle_name,omitempty" structs:"middle_name,omitempty"`
	NickName          string            `json:"nickname,omitempty" structs:"nickname,omitempty"`
	PreferredUsername string            `json:"preferred_username,omitempty" structs:"preferred_username,omitempty"`
	Profile           string            `json:"profile,omitempty" structs:"profile,omitempty"`
	Picture           string            `json:"picture,omitempty" structs:"picture,omitempty"`
	Website           string            `json:"website,omitempty" structs:"website,omitempty"`
	Gender            string            `json:"gender,omitempty" structs:"gender,omitempty"`
	Birthdate         string            `json:"birthdate,omitempty" structs:"birthdate,omitempty"`
	ZoneInfo          string            `json:"zoneinfo,omitempty" structs:"zoneinfo,omitempty"`
	Locale            string            `json:"locale,omitempty" structs:"locale,omitempty"`
	UpdatedAt         *UnixTimeOrString `json:"updated_at,omitempty" structs:"updated_at,omitempty"`
	Email             string            `json:"email,omitempty" structs:"email,omitempty"`
	EmailVerified     bool              `json:"email_verified,omitempty" structs:"email_verified"`
	Phone             string            `json:"phone,omitempty" structs:"phone,omitempty"`
	PhoneVerified     bool              `json:"phone_verified,omitempty" structs:"phone_verified"`

	// Custom profile claims that are provider specific
	CustomClaims map[string]interface{} `json:"custom_claims,omitempty" structs:"custom_claims,omitempty"`

	// TODO: Deprecate in next major release
	FullName    string `json:"full_name,omitempty" structs:"full_name,omitempty"`
	AvatarURL   string `json:"avatar_url,omitempty" structs:"avatar_url,omitempty"`
	Slug        string `json:"slug,omitempty" structs:"slug,omitempty"`
	ProviderId  string `json:"provider_id,omitempty" structs:"provider_id,omitempty"`
	UserNameKey string `json:"user_name,omitempty" structs:"user_name,omitempty"`
}

type CustomOAuthProvider 

type CustomOAuthProvider struct {
	// contains filtered or unexported fields
}

CustomOAuthProvider implements OAuthProvider for custom OAuth2 providers

func NewCustomOAuthProvider 

func NewCustomOAuthProvider(
	clientID, clientSecret, authorizationURL, tokenURL, userinfoURL, redirectURL string,
	scopes []string,
	pkceEnabled bool,
	acceptableClientIDs []string,
	attributeMapping, authorizationParams map[string]interface{},
) *CustomOAuthProvider

NewCustomOAuthProvider creates a new custom OAuth provider

func (*CustomOAuthProvider) AuthCodeURL 

func (p *CustomOAuthProvider) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string

AuthCodeURL returns the authorization URL for the OAuth flow

func (*CustomOAuthProvider) GetOAuthToken 

func (p *CustomOAuthProvider) GetOAuthToken(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)

GetOAuthToken exchanges the authorization code for an access token

func (*CustomOAuthProvider) GetUserData 

func (p *CustomOAuthProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error)

GetUserData fetches user data from the provider's userinfo endpoint

func (*CustomOAuthProvider) RequiresPKCE 

func (p *CustomOAuthProvider) RequiresPKCE() bool

RequiresPKCE returns whether this provider requires PKCE

type CustomOIDCProvider 

type CustomOIDCProvider struct {
	// contains filtered or unexported fields
}

CustomOIDCProvider implements OAuthProvider for custom OIDC providers

func NewCustomOIDCProvider 

func NewCustomOIDCProvider(
	ctx context.Context,
	clientID, clientSecret, redirectURL string,
	scopes []string,
	issuer string,
	pkceEnabled bool,
	acceptableClientIDs []string,
	attributeMapping, authorizationParams map[string]interface{},
	cache *OIDCProviderCache,
) (*CustomOIDCProvider, error)

NewCustomOIDCProvider creates a new custom OIDC provider

func (*CustomOIDCProvider) AuthCodeURL 

func (p *CustomOIDCProvider) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string

AuthCodeURL returns the authorization URL for the OIDC flow

func (*CustomOIDCProvider) Config 

func (p *CustomOIDCProvider) Config() *oauth2.Config

Config returns the OAuth2 config for accessing endpoints

func (*CustomOIDCProvider) GetOAuthToken 

func (p *CustomOIDCProvider) GetOAuthToken(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)

GetOAuthToken exchanges the authorization code for an access token

func (*CustomOIDCProvider) GetUserData 

func (p *CustomOIDCProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error)

GetUserData fetches user data from the provider's userinfo endpoint or ID token

func (*CustomOIDCProvider) RequiresPKCE 

func (p *CustomOIDCProvider) RequiresPKCE() bool

RequiresPKCE returns whether this provider requires PKCE

type Email 

type Email struct {
	Email    string
	Verified bool
	Primary  bool
}

Email is a struct that provides information on whether an email is verified or is the primary email address

type FacebookIDTokenClaims 

type FacebookIDTokenClaims struct {
	jwt.RegisteredClaims
	Email   string `json:"email"`
	Name    string `json:"name"`
	Picture string `json:"picture"`
	Nonce   string `json:"nonce,omitempty"`
}

FacebookIDTokenClaims represents the claims in a Facebook Limited Login ID token

type HTTPError 

type HTTPError struct {
	Code            int    `json:"code"`
	Message         string `json:"msg"`
	InternalError   error  `json:"-"`
	InternalMessage string `json:"-"`
	ErrorID         string `json:"error_id,omitempty"`
}

func (*HTTPError) Cause 

func (e *HTTPError) Cause() error

Cause returns the root cause error

func (*HTTPError) Error 

func (e *HTTPError) Error() string

func (*HTTPError) Is 

func (e *HTTPError) Is(target error) bool

func (*HTTPError) WithInternalError 

func (e *HTTPError) WithInternalError(err error) *HTTPError

WithInternalError adds internal error information to the error

func (*HTTPError) WithInternalMessage 

func (e *HTTPError) WithInternalMessage(fmtString string, args ...interface{}) *HTTPError

WithInternalMessage adds internal message information to the error

type IsPrivateEmail 

type IsPrivateEmail bool

func (*IsPrivateEmail) UnmarshalJSON 

func (b *IsPrivateEmail) UnmarshalJSON(data []byte) error

Apple returns an is_private_email field that could be a string or boolean value so we need to implement a custom unmarshaler https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple

type KakaoIDTokenClaims 

type KakaoIDTokenClaims struct {
	jwt.RegisteredClaims

	Email    string `json:"email"`
	Nickname string `json:"nickname"`
	Picture  string `json:"picture"`
}

type LinkedinIDTokenClaims 

type LinkedinIDTokenClaims struct {
	jwt.RegisteredClaims

	Email         string `json:"email"`
	EmailVerified string `json:"email_verified"`
	FamilyName    string `json:"family_name"`
	GivenName     string `json:"given_name"`
	Locale        string `json:"locale"`
	Picture       string `json:"picture"`
}

type OAuthProvider 

type OAuthProvider interface {
	AuthCodeURL(string, ...oauth2.AuthCodeOption) string
	GetUserData(context.Context, *oauth2.Token) (*UserProvidedData, error)
	GetOAuthToken(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
	RequiresPKCE() bool
}

OAuthProvider specifies additional methods needed for providers using OAuth

func NewAppleProvider 

func NewAppleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration, cache *OIDCProviderCache) (OAuthProvider, error)

NewAppleProvider creates a Apple account provider.

func NewAzureProvider 

func NewAzureProvider(ext conf.OAuthProviderConfiguration, scopes string, cache *OIDCProviderCache) (OAuthProvider, error)

NewAzureProvider creates a Azure account provider.

func NewBitbucketProvider 

func NewBitbucketProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, error)

NewBitbucketProvider creates a Bitbucket account provider.

func NewDiscordProvider 

func NewDiscordProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewDiscordProvider creates a Discord account provider.

func NewFacebookProvider 

func NewFacebookProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewFacebookProvider creates a Facebook account provider.

func NewFigmaProvider 

func NewFigmaProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewFigmaProvider creates a Figma account provider.

func NewFlyProvider 

func NewFlyProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewFlyProvider creates a Fly oauth provider.

func NewGithubProvider 

func NewGithubProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewGithubProvider creates a Github account provider.

func NewGitlabProvider 

func NewGitlabProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewGitlabProvider creates a Gitlab account provider.

func NewGoogleProvider 

func NewGoogleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration, scopes string, cache *OIDCProviderCache) (OAuthProvider, error)

NewGoogleProvider creates a Google OAuth2 identity provider.

func NewKakaoProvider 

func NewKakaoProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

func NewKeycloakProvider 

func NewKeycloakProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewKeycloakProvider creates a Keycloak account provider.

func NewLinkedinOIDCProvider 

func NewLinkedinOIDCProvider(ctx context.Context, ext conf.OAuthProviderConfiguration, scopes string, cache *OIDCProviderCache) (OAuthProvider, error)

NewLinkedinOIDCProvider creates a Linkedin account provider via OIDC.

func NewLinkedinProvider 

func NewLinkedinProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewLinkedinProvider creates a Linkedin account provider.

func NewNotionProvider 

func NewNotionProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, error)

NewNotionProvider creates a Notion account provider.

func NewSlackOIDCProvider 

func NewSlackOIDCProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewSlackOIDCProvider creates a Slack account provider with Sign in with Slack.

func NewSlackProvider 

func NewSlackProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewSlackProvider creates a Slack account provider with Legacy Slack OAuth.

func NewSnapchatProvider 

func NewSnapchatProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewSnapchatProvider creates a Snapchat account provider.

func NewSpotifyProvider 

func NewSpotifyProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewSpotifyProvider creates a Spotify account provider.

func NewTwitchProvider 

func NewTwitchProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewTwitchProvider creates a Twitch account provider.

func NewTwitterProvider 

func NewTwitterProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewTwitterProvider creates a Twitter account provider.

func NewVercelMarketplaceProvider 

func NewVercelMarketplaceProvider(ctx context.Context, ext conf.OAuthProviderConfiguration, scopes string, cache *OIDCProviderCache) (OAuthProvider, error)

NewVercelMarketplaceProvider creates a VercelMarketplace account provider via OIDC.

func NewWorkOSProvider 

func NewWorkOSProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, error)

NewWorkOSProvider creates a WorkOS account provider.

func NewXProvider 

func NewXProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error)

NewXProvider creates an X (formerly Twitter) v2 OAuth 2.0 provider. This uses OAuth 2.0 with PKCE instead of OAuth 1.0a. See: https://developer.x.com/en/docs/authentication/oauth-2-0/authorization-code

func NewZoomProvider 

func NewZoomProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, error)

NewZoomProvider creates a Zoom account provider.

type OIDCProviderCache 

type OIDCProviderCache struct {
	// contains filtered or unexported fields
}

OIDCProviderCache caches *oidc.Provider objects keyed by issuer URL. This avoids re-fetching the OIDC discovery document on every request. JWKS fetching/caching is handled separately by the oidc library itself, it lazy-loads the key set on the first call to Verify and manages its own cache. It uses singleflight to deduplicate concurrent fetches for the same issuer.

func NewOIDCProviderCache 

func NewOIDCProviderCache(ttl time.Duration) *OIDCProviderCache

NewOIDCProviderCache creates a new cache with the given TTL.

func (*OIDCProviderCache) Clear 

func (c *OIDCProviderCache) Clear()

Clear removes all cached providers.

func (*OIDCProviderCache) GetProvider 

func (c *OIDCProviderCache) GetProvider(ctx context.Context, issuer string) (*oidc.Provider, error)

GetProvider returns a cached *oidc.Provider for the given issuer, fetching it via oidc.NewProvider if not cached or expired. Concurrent requests for the same issuer are deduplicated via singleflight.

func (*OIDCProviderCache) Invalidate 

func (c *OIDCProviderCache) Invalidate(issuer string)

Invalidate removes a cached provider for the given issuer.

type ParseIDTokenOptions 

type ParseIDTokenOptions struct {
	SkipAccessTokenCheck bool
	AccessToken          string
}

type Provider 

type Provider interface {
	AuthCodeURL(string, ...oauth2.AuthCodeOption) string
}

Provider is an interface for interacting with external account providers

type TwitterProvider 

type TwitterProvider struct {
	ClientKey     string
	Secret        string
	CallbackURL   string
	AuthURL       string
	RequestToken  *oauth.RequestToken
	OauthVerifier string
	Consumer      *oauth.Consumer
	UserInfoURL   string
}

TwitterProvider stores the custom config for twitter provider

func (*TwitterProvider) AuthCodeURL 

func (t *TwitterProvider) AuthCodeURL(state string, args ...oauth2.AuthCodeOption) string

AuthCodeURL fetches the request token from the twitter provider

func (TwitterProvider) FetchUserData 

func (t TwitterProvider) FetchUserData(ctx context.Context, tok *oauth.AccessToken) (*UserProvidedData, error)

FetchUserData retrieves the user's data from the twitter provider

func (TwitterProvider) GetOAuthToken 

func (t TwitterProvider) GetOAuthToken(_ context.Context, _ string, _ ...oauth2.AuthCodeOption) (*oauth2.Token, error)

GetOAuthToken is a stub method for OAuthProvider interface, unused in OAuth1.0 protocol

func (TwitterProvider) GetUserData 

func (t TwitterProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error)

GetUserData is a stub method for OAuthProvider interface, unused in OAuth1.0 protocol

func (TwitterProvider) Marshal 

func (t TwitterProvider) Marshal() string

Marshal encodes the twitter request token

func (TwitterProvider) RequiresPKCE 

func (t TwitterProvider) RequiresPKCE() bool

func (TwitterProvider) Unmarshal 

func (t TwitterProvider) Unmarshal(data string) (*oauth.RequestToken, error)

Unmarshal decodes the twitter request token

type UnixTimeOrString 

type UnixTimeOrString time.Time

UnixTimeOrString accepts either: - number: seconds since epoch (OIDC NumericDate) - string: RFC3339 timestamp

func (UnixTimeOrString) MarshalJSON 

func (t UnixTimeOrString) MarshalJSON() ([]byte, error)

func (*UnixTimeOrString) UnmarshalJSON 

func (t *UnixTimeOrString) UnmarshalJSON(b []byte) error

type UserProvidedData 

type UserProvidedData struct {
	Emails   []Email
	Metadata *Claims
}

UserProvidedData is a struct that contains the user's data returned from the oauth provider

func ParseIDToken 

func ParseIDToken(ctx context.Context, provider *oidc.Provider, config *oidc.Config, idToken string, options ParseIDTokenOptions) (*oidc.IDToken, *UserProvidedData, error)

type VercelMarketplaceIDTokenClaims 

type VercelMarketplaceIDTokenClaims struct {
	jwt.RegisteredClaims

	GlobalUserID  string `json:"global_user_id"`
	UserEmail     string `json:"user_email"`
	UserName      string `json:"user_name"`
	UserAvatarUrl string `json:"user_avatar_url"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.