Documentation
¶
Overview ¶
Package idtoken verifies ID tokens that an external OpenID Connect provider, typically a CI system, signed: the subject tokens of the Access OIDC token exchange (POST /access/api/v1/oidc/token, research 21). Signing keys come from the provider's discovery document and JWKS, cached per provider.
Index ¶
Constants ¶
View Source
const ( // DefaultKeyTTL is how long fetched keys are trusted before they are // fetched again. Providers rotate keys with overlap, and a key a token // names that is not cached triggers an early fetch anyway. DefaultKeyTTL = 15 * time.Minute // DefaultTimeout bounds one discovery or JWKS fetch. DefaultTimeout = 10 * time.Second )
Defaults for the zero Options fields.
Variables ¶
View Source
var ( // ErrInvalid reports a token that does not verify: malformed, signed by // no key the provider publishes, from another issuer, for another // audience, or outside its validity. ErrInvalid = errors.New("the subject token does not verify") // ErrKeys reports a provider whose signing keys cannot be fetched, so no // token of it can be verified for now. ErrKeys = errors.New("the provider's signing keys are unavailable") )
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// Client fetches discovery documents and keys when the provider asks for
// the default proxy, and Direct when it does not. nil means a client
// with DefaultTimeout that takes its proxy from the environment, and one
// that uses none.
Client, Direct *http.Client
KeyTTL time.Duration
// Now supplies the time; nil means time.Now.
Now func() time.Time
}
Options configures a Verifier.
type Provider ¶
type Provider struct {
// URL is the provider's issuer URL; its discovery document is at
// URL/.well-known/openid-configuration.
URL string
// Issuer is the iss a token must carry; empty means URL.
Issuer string
// Audience, when set, must be among the token's aud.
Audience string
// AppID, for Azure, asks the JWKS for an application's custom signing
// keys (the appid query parameter).
AppID string
// UseProxy fetches through the proxy from the environment.
UseProxy bool
}
Provider is what a token must agree with.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package idtokentest is a fake OpenID Connect provider for tests: it serves a discovery document and a JWKS, as GitHub Actions, GitLab and other CI systems do, and mints ID tokens signed with its current key.
|
Package idtokentest is a fake OpenID Connect provider for tests: it serves a discovery document and a JWKS, as GitHub Actions, GitLab and other CI systems do, and mints ID tokens signed with its current key. |
Click to show internal directories.
Click to hide internal directories.