The highest tagged major version is
Documentation
¶
Overview ¶
Package tokens signs tokens and resolves group claims.
Index ¶
- func DPoPThumbprint(token jwt.Token) (string, error)
- func ExtractUsername(email string) string
- func GenerateJWKS(signingKey *SigningKey, kid string) ([]byte, error)
- func GenerateKeyID(signingKey *SigningKey) (string, error)
- func HasAudience(token jwt.Token, required string) bool
- func NormalizeEmail(email string) string
- type Signer
- func (s *Signer) SignIDToken(email string, emailVerified bool, clientID string, groups []string, ...) (string, error)
- func (s *Signer) SignTokenPair(context TokenContext) (string, string, error)
- func (s *Signer) SignTrustedIDToken(context TrustedTokenContext) (string, error)
- func (s *Signer) VerifyAccessToken(raw string) (jwt.Token, error)
- func (s *Signer) VerifyToken(token string) (jwt.Token, error)
- type SigningKey
- type TokenContext
- type TrustedTokenContext
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DPoPThumbprint ¶
DPoPThumbprint returns a strictly typed cnf.jkt from a verified JWT.
func ExtractUsername ¶
ExtractUsername extracts the username (local part) from an email address. If the email has no @ symbol, the full email is returned.
func GenerateJWKS ¶
func GenerateJWKS(signingKey *SigningKey, kid string) ([]byte, error)
GenerateJWKS generates a JSON Web Key Set from a key pair and key ID. The resulting JWKS can be served at the /jwks endpoint for token verification.
func GenerateKeyID ¶
func GenerateKeyID(signingKey *SigningKey) (string, error)
GenerateKeyID generates a key ID from the public key fingerprint. It uses the SHA-256 hash of the public key, base64-encoded (URL-safe, no padding). This creates a stable, unique identifier for the key.
func HasAudience ¶
HasAudience reports whether a verified token has exactly the required audience among its audiences.
func NormalizeEmail ¶
NormalizeEmail normalizes an email address to lowercase and trims whitespace.
Types ¶
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer signs OpenID Connect ID tokens.
func NewSigner ¶
func NewSigner(signingKey *SigningKey, kid, issuerURL string, tokenTTL time.Duration) *Signer
NewSigner creates a new token signer with the provided signing key, key ID, issuer URL, and token TTL.
func (*Signer) SignIDToken ¶
func (s *Signer) SignIDToken(email string, emailVerified bool, clientID string, groups []string, nonce string) (string, error)
SignIDToken signs an OpenID Connect ID token with the provided claims. The email is normalized and used as the subject (sub) claim.
func (*Signer) SignTokenPair ¶
func (s *Signer) SignTokenPair(context TokenContext) (string, string, error)
SignTokenPair issues distinct ID and access JWTs with independent claims and expiries.
func (*Signer) SignTrustedIDToken ¶
func (s *Signer) SignTrustedIDToken(context TrustedTokenContext) (string, error)
SignTrustedIDToken signs an exchanged ID token without session or refresh claims.
func (*Signer) VerifyAccessToken ¶
VerifyAccessToken verifies signature, issuer, expiry, audience shape, and access-token purpose.
type SigningKey ¶
type SigningKey struct {
Algorithm jwa.SignatureAlgorithm
PrivateKey crypto.Signer
PublicKey crypto.PublicKey
}
SigningKey holds a validated private key and its signing algorithm.
func ParsePrivateKey ¶
func ParsePrivateKey(pemData, algorithm string) (*SigningKey, error)
ParsePrivateKey parses a PKCS8 PEM private key and validates that its type matches algorithm.
type TokenContext ¶
type TokenContext struct {
Email string
EmailVerified bool
ClientID string
Groups []string
Nonce string
SID string
Scopes string
AuthTime time.Time
IDExpiry time.Time
AccessExpiry time.Time
DPoPJKT string
}
TokenContext contains claims shared by separately signed ID and access tokens.
Source Files