Documentation
¶
Overview ¶
Package oidc is the generic OpenID Connect identity adapter (R-043).
One adapter for every provider that speaks OpenID Connect — Okta, Microsoft Entra ID, Google Workspace, Keycloak, Authentik — configured by its issuer. What differs between them is which claim carries what, and that is configuration with presets, not a kind per vendor.
Authentication only (R-044). The adapter turns a callback into a Subject and nothing else: it does not know what an account is, what a group may do, or whether this person has signed in before. Core decides all of that.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Authenticate(ctx context.Context, c api.Credential) (api.Subject, error)
- func (a *Adapter) Begin(ctx context.Context, req api.BeginRequest) (*api.Redirect, error)
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) ServiceMetadata(context.Context, api.Endpoints) (*api.Metadata, error)
- func (a *Adapter) SessionPolicy() api.SessionPolicy
- func (a *Adapter) SupportsPush() bool
- func (a *Adapter) WithGraphURL(u string) *Adapter
- func (a *Adapter) WithHTTPClient(c *http.Client) *Adapter
- type Config
Constants ¶
const DefaultSessionLifetime = 12 * time.Hour
DefaultSessionLifetime is how long a session lasts when the configuration does not say. It is also the revocation window when no SCIM client pushes changes (R-050), which is why it is not longer.
const Kind = "oidc"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
func Info ¶
Info describes this kind of adapter for the console and CLI forms.
The presets are where each provider's quirks live, stated once: Entra's sub claim differs per application, so it matches on oid; Google sends no groups and admits any Google account unless the domain is fixed. A preset is only settings — choosing one is the same as typing them.
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter is the OIDC identity adapter.
func (*Adapter) Authenticate ¶
Authenticate exchanges the code and verifies the ID token: signature, issuer, audience, expiry and nonce. The state was matched by core before this is called — that is how core found the flow.
func (*Adapter) Begin ¶
Begin builds the authorization request: code flow, PKCE S256, a nonce, and core's state.
func (*Adapter) Configure ¶
Configure validates settings without contacting the provider, so a configuration can be saved while the provider is unreachable. HealthCheck and the first sign-in find out whether it answers.
func (*Adapter) HealthCheck ¶
HealthCheck fetches the provider's discovery document.
func (*Adapter) ServiceMetadata ¶
ServiceMetadata returns nil: an OpenID Connect provider is given a redirect URI, which core shows, and nothing else.
func (*Adapter) SessionPolicy ¶
func (a *Adapter) SessionPolicy() api.SessionPolicy
SessionPolicy declares this adapter's session behavior (R-047).
Expiry-only on its own: Pando does not keep the provider's tokens, so there is nothing to refresh and nothing that would learn of a revocation. When the installation turns SCIM on for this provider, core reports push instead, because a deprovisioning then ends sessions immediately (R-048, R-050).
func (*Adapter) SupportsPush ¶
SupportsPush is true: every provider this adapter targets can provision through SCIM, which core accepts on its behalf.
func (*Adapter) WithGraphURL ¶ added in v0.10.0
WithGraphURL replaces the Microsoft Graph address used to read the groups an Entra ID token left out, for tests.
type Config ¶
type Config struct {
Issuer string `json:"issuer"`
ClientID string `json:"client_id"`
// Scopes, space- or comma-separated. openid is always requested.
Scopes string `json:"scopes,omitempty"`
// Which claim carries what. Empty is the standard claim.
SubjectClaim string `json:"subject_claim,omitempty"`
UsernameClaim string `json:"username_claim,omitempty"`
EmailClaim string `json:"email_claim,omitempty"`
NameClaim string `json:"name_claim,omitempty"`
GroupsClaim string `json:"groups_claim,omitempty"`
// HostedDomain restricts sign-in to one Google Workspace domain, by the
// hd claim Google sets. Without it, a Google provider lets in anyone with
// a Google account.
HostedDomain string `json:"hosted_domain,omitempty"`
// DisableUserinfo skips the userinfo endpoint. By default its claims fill
// in what the ID token left out: several providers put groups or email
// only there.
DisableUserinfo bool `json:"disable_userinfo,omitempty"`
// Prompt is sent as the prompt parameter: "login" to always ask for
// credentials, "select_account" to always offer a choice.
Prompt string `json:"prompt,omitempty"`
SessionMaxLifetime string `json:"session_max_lifetime,omitempty"`
Credentials struct {
ClientSecret string `json:"client_secret,omitempty"`
} `json:"credentials,omitempty"`
}
Config is what an administrator sets.
Source Files