gopenidclient

README

gopenidclient

This package is an attempt to provide nice OAuth2 / OpenID Connect (OIDC) interface.

OAuth2 integration is provided in the static package. An OpenID Connect (OIDC) provider is provided under coreos.

Documentation

Overview

package gopenidclient is an attempt to provide nice OAuth2 / OpenID Connect (OIDC) interface.

OAuth2 integration is provided in the "static" package. An OpenID Connect (OIDC) provider backed by github.com/coreos/go-oidc/v3/oidc is available under code.pfad.fr/gopenidclient/coreos.

Index

• type Assertion
• type CallbackResult
• type CookieManager
  • func (cm CookieManager) Clear(w http.ResponseWriter)
  • func (cm CookieManager) GetState(r *http.Request) (string, error)
  • func (cm CookieManager) SetState(w http.ResponseWriter, state string)
• type ExchangeHandler
  • func (s ExchangeHandler) HandleCallback(w http.ResponseWriter, r *http.Request, provider Provider) (cr CallbackResult, clearCookies func(), err error)
  • func (s ExchangeHandler) RedirectToAuthCodeURL(w http.ResponseWriter, r *http.Request, provider Provider) error
• type Provider

Types

type Assertion

type Assertion interface {
	Type() string
	Assert(aud string) (string, error)
}

Assertion allows the usage of client_assertion instead of client_secret for better security. The code.pfad.fr/gopenidclient/coreos provider supports it. See code.pfad.fr/gopenidclient/assertion.RS256 for an implementation based on RSA+SHA256.

type CallbackResult

type CallbackResult struct {
	// UnmarshalUser will unmarshal the JSON user returned by the provider
	//      var user struct {
	//      	ID    string `json:"sub"`
	//      	Email string `json:"email"`
	//      	Name  string `json:"name"`
	//      }
	//      err = UnmarshalUser(&user)
	UnmarshalUser func(interface{}) error
	Token         *oauth2.Token
	// IntendedPath contains the URL before the login flow took place
	IntendedPath string
}

CallbackResult is returned at the end of the login flow

type CookieManager

type CookieManager struct {
	Prefix    string
	Encrypter interface {
		Seal(name, cleartext string) string
		Open(name, cyphertext string) (string, error)
	}
}

func (CookieManager) Clear

func (cm CookieManager) Clear(w http.ResponseWriter)

func (CookieManager) GetState

func (cm CookieManager) GetState(r *http.Request) (string, error)

GetState gets the state cookie (which stores the intended URL of the user before authentication).

func (CookieManager) SetState

func (cm CookieManager) SetState(w http.ResponseWriter, state string)

SetState sets the state cookie (which stores the intended URL of the user before authentication).

type ExchangeHandler

type ExchangeHandler struct {
	CookieManager CookieManager
}

ExchangeHandler implements the exchange-code flow (including PKCE challenge).

func (ExchangeHandler) HandleCallback

func (s ExchangeHandler) HandleCallback(w http.ResponseWriter, r *http.Request, provider Provider) (cr CallbackResult, clearCookies func(), err error)

HandleCallback should be called after the user logged in at the provider.

func (ExchangeHandler) RedirectToAuthCodeURL

func (s ExchangeHandler) RedirectToAuthCodeURL(w http.ResponseWriter, r *http.Request, provider Provider) error

RedirectToAuthCodeURL should be called to redirect the user to the provider for login.

type Provider

type Provider interface {
	// SetRedirectURL sets the local callback URL.
	SetRedirectURL(url string)

	// AuthCodeURL returns the Provider URL to redirect the user to.
	AuthCodeURL(state string) (url, pkceVerifier string, err error)

	// Exchange exchanges the code and provides a way to unmarshal the user info.
	//
	//      var user struct {
	//      	ID    string `json:"sub"`
	//      	Email string `json:"email"`
	//      	Name  string `json:"name"`
	//      }
	//      err = unmarshalUser(&user)
	Exchange(code, pkceVerifier string) (token *oauth2.Token, unmarshalUser func(interface{}) error, err error)

	// EndSessionURL is a URL where the RP can perform a redirect to request that the End-User be logged out at the OP.
	EndSessionURL() (*url.URL, error)
}

Provider is an interface suitable for OAuth2 and OIDC flows.