Documentation
¶
Overview ¶
Package identity makes the server an OAuth resource server: it verifies the access tokens of MCP requests, serves the protected resource metadata that tells clients where to get them, and carries the verified caller to the code that serves the requests.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MetadataHandler ¶
MetadataHandler serves the protected resource metadata (RFC 9728) for a.
func MetadataPath ¶
MetadataPath returns the path of the protected resource metadata for resource, which the WWW-Authenticate challenge points to.
func RequireToken ¶
RequireToken returns a handler that serves a request with next only if it carries a valid access token from a's issuer that has each of a's required scopes in its scope or scp claim. A missing or invalid token gets a 401, and a valid token without a required scope a 403. Both get a WWW-Authenticate challenge that points to the protected resource metadata and lists the advertised scopes, with error="invalid_token" for an invalid token and error="insufficient_scope" for a missing scope. A token that cannot be checked yet gets a 500 with no challenge: when the issuer's discovery or signing keys are unavailable, or when the token's key is unknown and the request skipped fetching the keys because they were last fetched less than a minute before it, since the key may be newer than that fetch. When the request skipped fetching, an expired token gets a 401 instead, whether that last fetch succeeded or failed. Response bodies are fixed ("no bearer token", "invalid token", "insufficient scope", "cannot verify access tokens"); the reason for a rejected token or a 500 goes to logger.
Types ¶
type Caller ¶
type Caller struct {
Issuer string
Subject string
// Claims are the verified claims of the caller's access token.
Claims map[string]any
}
Caller is the verified identity behind a request, keyed by Issuer and Subject.
func CallerFrom ¶
CallerFrom returns the caller that ctx carries, or nil if it carries none, as when auth is not configured.
func CallerFromTokenInfo ¶
CallerFromTokenInfo returns the caller for ti, which must come from RequireToken.
Source Files