oidc

Documentation

Overview

Package oidc provide OpenID Connect integration for cacheroach.

Index

• Constants
• Variables
• type Connector
  • func ProvideConnector(ctx context.Context, auto promauto.Factory, bt *bootstrap.Bootstrapper, ...) (*Connector, error)
  • func (c *Connector) Receive(w http.ResponseWriter, r *http.Request)
  • func (c *Connector) Redirect(w http.ResponseWriter, r *http.Request, dest *url.URL) bool
  • func (c *Connector) Validate(ctx context.Context, pID *principal.ID) error

Constants

const (
	AuthorizationCookie = "authorization"
	DestinationCookie   = "cacheroach-destination"
	NonceCookie         = "cacheroach-oidc-nonce"
	StateCookie         = "cacheroach-oidc-state"
)

These cookies are used during the authentication flow.

const ReceivePath = "/_/oidc/receive"

ReceivePath will be added to the redirect path.

Variables

var ErrPermanentFailure = errors.New("OIDC refresh needed")

ErrPermanentFailure indicates that the principal must be reauthorized by the OIDC provider in order to be usable.

var Set = wire.NewSet(
	ProvideConnector,
)

Set is used by wire.

Types

type Connector

type Connector struct {
	// contains filtered or unexported fields
}

Connector encapsulates the OIDC integration.

func ProvideConnector

func ProvideConnector(
	ctx context.Context,
	auto promauto.Factory,
	bt *bootstrap.Bootstrapper,
	cfg *common.Config,
	logger *log.Logger,
	principals principal.PrincipalsServer,
	tokens token.TokensServer,
) (*Connector, error)

ProvideConnector is called by wire.

func (*Connector) Receive

func (c *Connector) Receive(w http.ResponseWriter, r *http.Request)

Receive a JWT token from the OIDC provider to create a principal and issue a session token.

func (*Connector) Redirect

func (c *Connector) Redirect(w http.ResponseWriter, r *http.Request, dest *url.URL) bool

Redirect implements an endpoint to redirect a caller to the OIDC provider. Once the flow has been successfully completed, the caller will be redirected to the given destination.

This method returns true if it was able to generate a response.

func (*Connector) Validate

func (c *Connector) Validate(ctx context.Context, pID *principal.ID) error

Validate ensures that the Principal is still valid, according to the OIDC provider.