Documentation
¶
Index ¶
- func LegacyPKCEFactory(config fosite.Configurator, storage any, strategy any) any
- type Config
- type FositeStorage
- type Issuer
- func (i *Issuer) IssueAuthorizationCode(ctx context.Context, w http.ResponseWriter, ar fosite.AuthorizeRequester, ...) error
- func (i *Issuer) IssueFromFederationSession(ctx context.Context, w http.ResponseWriter, session *federation.Session, ...) error
- func (i *Issuer) WriteErrorFromFederationSession(ctx context.Context, w http.ResponseWriter, session *federation.Session, ...) error
- type LegacyPKCEHandler
- type Provider
- type Session
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LegacyPKCEFactory ¶
func LegacyPKCEFactory(config fosite.Configurator, storage any, strategy any) any
LegacyPKCEFactory satisfies the fosite compose.Factory signature. The storage and strategy parameters are interface{} because fosite's compose pipeline passes them untyped. The Factory signature does not allow returning an error, so incorrect wiring panics at startup with a clear message rather than silently producing a broken handler.
Types ¶
type Config ¶
type Config struct {
AccessTokenLifespan time.Duration
RefreshTokenLifespan time.Duration
AuthorizeCodeLifespan time.Duration
IDTokenLifespan time.Duration
HashCost int
HMACSecret []byte
AllowInsecureHTTP bool
EnforcePKCE bool
EnableOpenIDConnect bool
IssuerURL string
LoginURL string
ConsentURL string
// AccessTokenAudience identifies the resource server that consumes IAM-issued
// JWT access tokens. Set as the `aud` claim per RFC 9068 §2.2.
AccessTokenAudience string
ClientSecretsHasher fosite.Hasher
JwkProvider jwk.Provider
}
func NewOAuthConfigFromConfig ¶
func NewOAuthConfigFromConfig(cfg authconfig.OAuthServerConfig) *Config
type FositeStorage ¶
type FositeStorage interface {
fosite.ClientManager
oauth2.AuthorizeCodeStorage
oauth2.AccessTokenStorage
oauth2.RefreshTokenStorage
oauth2.TokenRevocationStorage
openid.OpenIDConnectRequestStorage
pkce.PKCERequestStorage
}
FositeStorage is the union of fosite storage interfaces that the OAuth provider needs to drive the authorize and token endpoints. It lives here (rather than in the concrete storage package) so the provider depends on the contract, not on a specific storage implementation.
type Issuer ¶
type Issuer struct {
// contains filtered or unexported fields
}
Issuer turns a resolved user identity into an OAuth authorization-code redirect. It is the small slice of the authorize flow that runs after the user has been authenticated — granting requested scopes, attaching a session to the request, and writing the response that carries the code back to the client.
Flows that already have a user identity in hand — notably the federated login callback — use the Issuer to emit a code directly, without round-tripping the user agent through /oauth2/authorize.
func (*Issuer) IssueAuthorizationCode ¶
func (i *Issuer) IssueAuthorizationCode(ctx context.Context, w http.ResponseWriter, ar fosite.AuthorizeRequester, userInfo identity.UserInfo) error
func (*Issuer) IssueFromFederationSession ¶
func (i *Issuer) IssueFromFederationSession(ctx context.Context, w http.ResponseWriter, session *federation.Session, userInfo identity.UserInfo, additionalParams map[string]string) error
IssueFromFederationSession synthesizes an authorize request from the stored federation session and issues an authorization code for userInfo. Callers use this to skip the extra /oauth2/authorize round trip that would otherwise be needed after a federated login completes.
func (*Issuer) WriteErrorFromFederationSession ¶ added in v1.10.0
func (i *Issuer) WriteErrorFromFederationSession(ctx context.Context, w http.ResponseWriter, session *federation.Session, err error) error
WriteErrorFromFederationSession synthesizes an authorize request from the stored federation session and asks fosite to write an RFC 6749 error response to w. In the normal case fosite emits a 303 redirect back to the session's redirect URI; if it cannot reconstruct a valid client and redirect URI on the AuthorizeRequester (e.g. the referenced client has since been removed), it degrades to a JSON body instead. That degradation is intentional — we accept it rather than re-implementing a parallel redirect path. The returned error, when non-nil, describes a failure encountered while preparing the response and is intended for the caller to log; the response itself is best-effort.
type LegacyPKCEHandler ¶
LegacyPKCEHandler replaces fosite's stock PKCE handler so the authorization code flow matches the doorkeeper provider IAM is replacing: doorkeeper is laxer than fosite's RFC 7636-strict checks and clients rely on that. The specific deviations are documented on the forked methods below.
It does not enforce PKCE; that belongs at the authorize endpoint via fosite's EnforcePKCE, which rejects a no-challenge request before a code is minted.
func (*LegacyPKCEHandler) HandleAuthorizeEndpointRequest ¶
func (c *LegacyPKCEHandler) HandleAuthorizeEndpointRequest(ctx context.Context, ar fosite.AuthorizeRequester, resp fosite.AuthorizeResponder) error
HandleAuthorizeEndpointRequest rejects a challenge that omits code_challenge_method before delegating to fosite: doorkeeper requires an explicit method (it does not default to "plain"), whereas fosite with plain enabled would treat an empty method as plain.
func (*LegacyPKCEHandler) HandleTokenEndpointRequest ¶
func (c *LegacyPKCEHandler) HandleTokenEndpointRequest(ctx context.Context, request fosite.AccessRequester) error
type Provider ¶
type Provider struct {
fosite.OAuth2Provider
// contains filtered or unexported fields
}
func NewOAuthProviderWithConfig ¶
func NewOAuthProviderWithConfig(store FositeStorage, oauthConfig *Config) (*Provider, error)
func (*Provider) AccessTokenAudience ¶ added in v1.10.0
AccessTokenAudience returns the resource-server identifier set as the `aud` claim on issued JWT access tokens (RFC 9068 §2.2).
func (*Provider) ClientSecretsHasher ¶ added in v1.2.1
ClientSecretsHasher returns the hasher used to verify client secrets.
func (*Provider) CreateSession ¶
type Session ¶
func NewEmptySession ¶
func NewEmptySession() *Session
NewEmptySession returns a zero-valued Session with nested pointer fields pre-allocated. It is used as the unmarshal target when restoring a stored session from the authorization-code store — the session type must implement JWTSessionContainer so fosite's JWT strategy can mint access tokens.
func NewSessionWithClaims ¶
func (*Session) Clone ¶ added in v1.39.0
Clone deep-copies the session while preserving the concrete *Session type, so the JWT access-token strategy still sees a JWTSessionContainer. Without it the embedded *openid.DefaultSession.Clone() is promoted and returns a bare *openid.DefaultSession, which breaks the refresh-token grant.
func (*Session) GetJWTClaims ¶
func (s *Session) GetJWTClaims() jwt.JWTClaimsContainer
Source Files