Documentation
¶
Overview ¶
Package oidc provides an OpenID Connect identity provider for the API Portal's IDP mode.
It serves HTTPS, because the portal only provisions organizations from claims that reached it over verified TLS, and it keeps no state. The caller of the authorization endpoint names the signed-in identity in the LoginHeader request header, standing in for the provider's own login session. The issued authorization code carries that identity, signed by the service, so the token endpoint needs no record of it and one shared instance serves every block.
Index ¶
Constants ¶
const ( EnvTLSCert = "TESTBENCH_OIDC_TLS_CERT" EnvTLSKey = "TESTBENCH_OIDC_TLS_KEY" )
EnvTLSCert and EnvTLSKey name the variables holding the PEM certificate and key the service serves HTTPS with. When both are unset the service generates a self-signed certificate.
const EnvIssuer = "TESTBENCH_OIDC_ISSUER"
EnvIssuer names the variable holding the issuer URL the service signs tokens with. When it is unset the issuer is derived from the request's host.
const LoginHeader = "X-Testbench-Login"
LoginHeader carries the signed-in identity on an authorization request: the base64url encoding of a JSON object whose members become the issued tokens' claims.
const OrgClaim = "org_id"
OrgClaim is the claim an authorization request's organization hint is matched against.
const Port = 3015
Port is the container port used by the testbench.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service implements testbench.Service and testbench.TLSService.
func FromEnvironment ¶
FromEnvironment builds the service from EnvTLSCert, EnvTLSKey and EnvIssuer.
func New ¶
New returns an identity provider serving HTTPS with the supplied PEM certificate and key, or with a generated self-signed certificate when both are empty. issuer is the issuer URL tokens are signed with; empty derives it from each request's host.
func (*Service) Handler ¶
Handler serves the authorization, token, key-set and token-minting endpoints.
Source Files