The highest tagged major version is
Documentation
¶
Overview ¶
Package oidc implements the OpenID Connect server endpoints.
Truster <https://truster.dev> Copyright The Truster Authors SPDX-License-Identifier: Apache-2.0
Index ¶
- func ValidatePKCE(codeVerifier, codeChallenge string) error
- type AuthCodeManager
- func (m *AuthCodeManager) DecodeState(stateToken string) (*OAuthState, error)
- func (m *AuthCodeManager) EncodeState(state OAuthState) (string, error)
- func (m *AuthCodeManager) GenerateCode(payload AuthCodePayload) (string, error)
- func (m *AuthCodeManager) Peek(code string) (*statedb.AuthCode, error)
- func (m *AuthCodeManager) PeekState(stateToken string) (*OAuthState, error)
- func (m *AuthCodeManager) ValidateAndExtract(code string) (*AuthCodePayload, error)
- type AuthCodePayload
- type OAuthState
- type Server
- func (s *Server) HandleAuthorize(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleConsent(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleDiscovery(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleEmailResend(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleEmailStart(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleEmailVerify(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleGrantRevoke(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleGrants(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleHealth(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleIdentitySelect(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleJWKS(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandlePAR(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleRevoke(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleSelect(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleToken(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleUserInfo(w http.ResponseWriter, r *http.Request)
- func (s *Server) LimitPublicEndpoints(next http.Handler) http.Handler
- func (s *Server) SecurityHeaders(next http.Handler) http.Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ValidatePKCE ¶
ValidatePKCE validates a PKCE code_verifier against the provided code_challenge using S256 method. It returns an error if the verifier or challenge is empty, or if the computed challenge does not match.
Types ¶
type AuthCodeManager ¶
type AuthCodeManager struct {
// contains filtered or unexported fields
}
AuthCodeManager handles authorization code creation and validation using the state database. It provides replay protection through single-use enforcement and automatic cleanup of expired codes.
func NewAuthCodeManager ¶
func NewAuthCodeManager(store *statedb.Store) (*AuthCodeManager, error)
NewAuthCodeManager creates and initializes an authorization code manager.
func (*AuthCodeManager) DecodeState ¶
func (m *AuthCodeManager) DecodeState(stateToken string) (*OAuthState, error)
DecodeState validates and retrieves a state token, extracting the OAuth state data. The state token is atomically retrieved and deleted to enforce single-use and prevent replay attacks.
func (*AuthCodeManager) EncodeState ¶
func (m *AuthCodeManager) EncodeState(state OAuthState) (string, error)
EncodeState creates a new random state token and stores the OAuth state data. The token expires in 10 minutes and is used to prevent CSRF attacks.
func (*AuthCodeManager) GenerateCode ¶
func (m *AuthCodeManager) GenerateCode(payload AuthCodePayload) (string, error)
GenerateCode creates a new authorization code containing the provided payload. The code is a cryptographically secure random token that expires in 5 minutes.
func (*AuthCodeManager) Peek ¶
func (m *AuthCodeManager) Peek(code string) (*statedb.AuthCode, error)
Peek validates an authorization code without consuming it.
func (*AuthCodeManager) PeekState ¶
func (m *AuthCodeManager) PeekState(stateToken string) (*OAuthState, error)
PeekState validates and retrieves a state token without consuming it.
func (*AuthCodeManager) ValidateAndExtract ¶
func (m *AuthCodeManager) ValidateAndExtract(code string) (*AuthCodePayload, error)
ValidateAndExtract validates an authorization code and extracts its payload. The code is atomically retrieved and deleted to enforce single-use.
type AuthCodePayload ¶
type AuthCodePayload struct {
ClientID string
RedirectURI string
CodeChallenge string
Email string
EmailVerified bool
Nonce string
Scopes string
RefreshMode string
AuthTime time.Time
ConnectorID string
UpstreamSubject string
OfflineConsent bool
DPoPJKT string
PushedAuthorization bool
}
AuthCodePayload contains the information embedded in an authorization code.
type OAuthState ¶
type OAuthState struct {
FlowID string
ConnectorID string
ClientID string
RedirectURI string
CodeChallenge string
Nonce string
OIDCState string
Scopes string
RefreshMode string
AuthTime time.Time
OfflineConsent bool
Purpose string
DPoPJKT string
PushedAuthorization bool
}
OAuthState represents the OAuth2 state parameter data. It contains client information and PKCE details that need to be preserved across the OAuth flow.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
func NewServer ¶
func NewServer(cfg *config.Config, connectors map[string]upstream.Connector, authCodeMgr *AuthCodeManager, signer *tokens.Signer, jwksData []byte, logger *slog.Logger, store *statedb.Store, tm *templates.Manager, mailer email.Sender, challengeVerifier challenge.Verifier, otpSecret, selectionKey, encryptionKey []byte, resolver policyResolver) *Server
NewServer creates an OIDC server with the provided dependencies.
func (*Server) HandleAuthorize ¶
func (s *Server) HandleAuthorize(w http.ResponseWriter, r *http.Request)
HandleAuthorize validates a downstream authorization request and starts connector selection.
func (*Server) HandleCallback ¶
func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
HandleCallback handles an OAuth callback and selects or accepts an upstream email.
func (*Server) HandleConsent ¶
func (s *Server) HandleConsent(w http.ResponseWriter, r *http.Request)
HandleConsent accepts or denies explicit offline-access consent.
func (*Server) HandleDiscovery ¶
func (s *Server) HandleDiscovery(w http.ResponseWriter, r *http.Request)
HandleDiscovery handles the OIDC discovery endpoint (/.well-known/openid-configuration). It returns the OpenID Connect provider metadata.
func (*Server) HandleEmailResend ¶
func (s *Server) HandleEmailResend(w http.ResponseWriter, r *http.Request)
HandleEmailResend replaces and sends the code for an active challenge.
func (*Server) HandleEmailStart ¶
func (s *Server) HandleEmailStart(w http.ResponseWriter, r *http.Request)
HandleEmailStart validates an email sign-in request and begins OTP verification.
func (*Server) HandleEmailVerify ¶
func (s *Server) HandleEmailVerify(w http.ResponseWriter, r *http.Request)
HandleEmailVerify consumes an OTP and completes authorization.
func (*Server) HandleGrantRevoke ¶
func (s *Server) HandleGrantRevoke(w http.ResponseWriter, r *http.Request)
HandleGrantRevoke atomically consumes a CSRF action and revokes its bound grant.
func (*Server) HandleGrants ¶
func (s *Server) HandleGrants(w http.ResponseWriter, r *http.Request)
HandleGrants starts a dedicated authentication flow that cannot issue tokens.
func (*Server) HandleHealth ¶
func (s *Server) HandleHealth(w http.ResponseWriter, r *http.Request)
HandleHealth handles the health check endpoint (/healthz). It returns HTTP 200 OK to indicate the server is running.
func (*Server) HandleIdentitySelect ¶
func (s *Server) HandleIdentitySelect(w http.ResponseWriter, r *http.Request)
HandleIdentitySelect consumes a selection and its original OAuth state exactly once.
func (*Server) HandleJWKS ¶
func (s *Server) HandleJWKS(w http.ResponseWriter, r *http.Request)
HandleJWKS handles the JWKS endpoint (/jwks). It returns the JSON Web Key Set containing the public keys for token verification.
func (*Server) HandlePAR ¶
func (s *Server) HandlePAR(w http.ResponseWriter, r *http.Request)
HandlePAR validates and stores an RFC 9126 pushed authorization request.
func (*Server) HandleRevoke ¶
func (s *Server) HandleRevoke(w http.ResponseWriter, r *http.Request)
HandleRevoke implements client-policy-first, non-enumerating RFC 7009 family revocation.
func (*Server) HandleSelect ¶
func (s *Server) HandleSelect(w http.ResponseWriter, r *http.Request)
HandleSelect binds an upstream connector to authorization state.
func (*Server) HandleToken ¶
func (s *Server) HandleToken(w http.ResponseWriter, r *http.Request)
HandleToken handles the OAuth 2.0 token endpoint (/token). It exchanges authorization codes using PKCE or rotates refresh tokens, then issues access and ID tokens.
func (*Server) HandleUserInfo ¶
func (s *Server) HandleUserInfo(w http.ResponseWriter, r *http.Request)
HandleUserInfo handles the OIDC userinfo endpoint through the shared access verifier.
func (*Server) LimitPublicEndpoints ¶
LimitPublicEndpoints rate-limits expensive public endpoints before handler work.
Source Files
¶
- authcode.go
- doc.go
- dpop_binding.go
- handle_authorize.go
- handle_callback.go
- handle_discovery.go
- handle_email.go
- handle_grants.go
- handle_health.go
- handle_identity.go
- handle_jwks.go
- handle_par.go
- handle_revoke.go
- handle_selector.go
- handle_token.go
- handle_token_exchange.go
- handle_userinfo.go
- pkce.go
- request_limits.go
- server.go
- state.go