Help us shape the future of Go! Take the 2026 Go Developer Survey

oidc

package
v0.1.0-rc.41 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: BSD-3-Clause Imports: 25 Imported by: 0

Documentation

Overview

package oidcauth implements control-owned standard OIDC authentication.

Index

Constants

View Source 
const GitHubIssuer = "https://token.actions.githubusercontent.com"

Variables

View Source 
var (
	ErrUnauthenticated = errors.New("oidcauth: unauthenticated")
	ErrUnavailable     = errors.New("oidcauth: provider unavailable")
)

Functions

This section is empty.

Types

type AdmissionClaim 

type AdmissionClaim struct {
	Name  AdmissionClaimName `json:"name"`
	Value string             `json:"value"`
}

type AdmissionClaimName 

type AdmissionClaimName string
const (
	TenantClaim       AdmissionClaimName = "tid"
	HostedDomainClaim AdmissionClaimName = "hd"
	GroupClaim        AdmissionClaimName = "groups"
)

type AdmissionRule 

type AdmissionRule struct {
	Team     string          `json:"team"`
	SourceID string          `json:"source_id"`
	Subjects []string        `json:"subjects"`
	Claim    *AdmissionClaim `json:"claim,omitempty"`
}

AdmissionRule is operator-owned mapping from a verified direct OIDC identity to one configured company source. claims never assign a role or merge accounts.

func LoadAdmissions 

func LoadAdmissions(path string) ([]AdmissionRule, error)

func (AdmissionRule) Allows 

func (r AdmissionRule) Allows(i Identity) bool

type FlyExecution 

type FlyExecution struct {
	Org       string `json:"org_name"`
	OrgID     string `json:"org_id"`
	App       string `json:"app_name"`
	AppID     string `json:"app_id"`
	Machine   string `json:"machine_name"`
	MachineID string `json:"machine_id"`
}

type GitHubExecution 

type GitHubExecution struct {
	Subject           string   `json:"sub"`
	JTI               string   `json:"jti"`
	Repository        string   `json:"repository"`
	RepositoryID      string   `json:"repository_id"`
	RepositoryOwnerID string   `json:"repository_owner_id"`
	WorkflowRef       string   `json:"workflow_ref"`
	Ref               string   `json:"ref"`
	Event             string   `json:"event_name"`
	Environment       string   `json:"environment,omitempty"`
	JobWorkflowRef    string   `json:"job_workflow_ref,omitempty"`
	RunID             string   `json:"run_id"`
	RunAttempt        string   `json:"run_attempt"`
	CheckRunID        string   `json:"check_run_id"`
	IssuedAt          int64    `json:"iat"`
	NotBefore         int64    `json:"nbf"`
	ExpiresAt         int64    `json:"exp"`
	AssertionDigest   [32]byte `json:"-"`
}

GitHubExecution contains issuer-signed job provenance, never a human identity. check_run_id is GitHub's signed job boundary; GITHUB_JOB is not an identity.

func (GitHubExecution) Validate 

func (c GitHubExecution) Validate(now time.Time) error

type GitHubWorkloadVerifier 

type GitHubWorkloadVerifier struct {
	// contains filtered or unexported fields
}

func NewGitHubWorkloadVerifier 

func NewGitHubWorkloadVerifier(controlOrigin string, client *http.Client) (*GitHubWorkloadVerifier, error)

the canonical control origin is the audience. issuer and key URL are fixed; local tests inject an HTTP transport, never a runtime issuer override.

func (*GitHubWorkloadVerifier) Verify 

func (v *GitHubWorkloadVerifier) Verify(ctx context.Context, raw string) (GitHubExecution, error)

type Identity 

type Identity struct {
	Issuer                 string
	Subject                string
	DisplayName            string
	NormalizedEmail        string
	EmailVerified          bool
	Nonce                  string
	ExpiresAt              time.Time
	AssertionDigest        [32]byte
	AssertionID            string
	ClientID               string
	IssuedAt               time.Time
	TeamContexts           []TeamContext
	AuthenticatedAt        time.Time
	TenantID, HostedDomain string
	Groups                 []string
}

Identity contains the limited identity fields authenticated by an OIDC ID token.

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server is the confidential (or public PKCE) client owned by control. provider tokens never cross the CLI boundary.

func NewServer 

func NewServer(c ServerConfig) (*Server, error)

func (*Server) AuthorizationURL 

func (s *Server) AuthorizationURL(ctx context.Context, state, nonce, verifier string) (string, error)

func (*Server) CompanyAuthorizationURL 

func (s *Server) CompanyAuthorizationURL(ctx context.Context, state, nonce, verifier, intent, binding string) (string, error)

func (*Server) Redeem 

func (s *Server) Redeem(ctx context.Context, code, nonce, verifier string) (_ Identity, retErr error)

type ServerConfig 

type ServerConfig struct {
	Issuer, ClientID, ClientSecret, RedirectURL string
	Scopes                                      []string
	HTTPClient                                  *http.Client
}

type TeamContext 

type TeamContext struct {
	TeamID               string `json:"team_id"`
	IdentityConnectionID string `json:"identity_connection_id"`
	ConnectionRevision   int64  `json:"connection_revision"`
	Subject              string `json:"subject"`
	SourceID             string `json:"source_id"`
	AuthenticatedAt      int64  `json:"authenticated_at"`
}

TeamContext is issuer-signed company authentication, not directory membership. control binds it to its exact connection revision, eligibility and new session.

type VercelExecution 

type VercelExecution struct {
	Owner       string `json:"owner"`
	OwnerID     string `json:"owner_id"`
	Project     string `json:"project"`
	ProjectID   string `json:"project_id"`
	Environment string `json:"environment"`
}

type Verifier 

type Verifier interface {
	Verify(context.Context, string) (Identity, error)
}

Verifier verifies ID tokens from one exact OIDC issuer for one client.

func NewVerifier 

func NewVerifier(config VerifierConfig) (Verifier, error)

NewVerifier validates configuration without contacting the provider.

type VerifierConfig 

type VerifierConfig struct {
	Issuer     string
	ClientID   string
	HTTPClient *http.Client
}

type WorkloadExecution 

type WorkloadExecution struct {
	Provider        string            `json:"provider"`
	Issuer          string            `json:"issuer"`
	Subject         string            `json:"subject"`
	Audience        string            `json:"audience"`
	TrustDigest     string            `json:"trust_digest"`
	IssuedAt        int64             `json:"iat"`
	NotBefore       int64             `json:"nbf"`
	ExpiresAt       int64             `json:"exp"`
	GitHub          *GitHubExecution  `json:"github,omitempty"`
	Vercel          *VercelExecution  `json:"vercel,omitempty"`
	Fly             *FlyExecution     `json:"fly,omitempty"`
	Claims          map[string]string `json:"claims,omitempty"`
	AssertionDigest [32]byte          `json:"-"`
}

func (WorkloadExecution) IdentityDigest 

func (c WorkloadExecution) IdentityDigest() string

IdentityDigest is called only with verifier-produced executions. assertion timestamps and JTI rotate; immutable provider identity and job provenance do not.

func (WorkloadExecution) Matches 

func (c WorkloadExecution) Matches(p WorkloadTrust) bool

func (WorkloadExecution) Validate 

func (c WorkloadExecution) Validate(now time.Time) error

type WorkloadTrust 

type WorkloadTrust struct {
	Provider string            `json:"provider"`
	Issuer   string            `json:"issuer"`
	JWKSURL  string            `json:"jwks_url"`
	Audience string            `json:"audience"`
	Claims   map[string]string `json:"claims"`
}

workload trust is supplied by saved manager policy, never assertion claims.

func (WorkloadTrust) Digest 

func (p WorkloadTrust) Digest() string

type WorkloadVerifier 

type WorkloadVerifier struct {
	// contains filtered or unexported fields
}

func NewWorkloadVerifier 

func NewWorkloadVerifier(origin string, client *http.Client) (*WorkloadVerifier, error)

func (*WorkloadVerifier) Verify 

func (v *WorkloadVerifier) Verify(ctx context.Context, p WorkloadTrust, raw string) (c WorkloadExecution, err error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.