acpclient

README

Cloudentity ACP OpenAPI Go Client

This repository contains a generated OpenAPI client for Go

It's generated from OpenAPI 2.0 specification.

Sample usage

Client secret basic or client secret post authentication

import "github.com/cloudentity/acp-client-go"

var client = acpclient.New(acpclient.Config{
    ClientID:     "your-clients-id",
    ClientSecret: "your-clients-secret",
    AuthMethod:   acpclient.ClientSecretBasicAuthnMethod,
    IssuerURL:    "https://localhost:8443/default/default",
    Scopes:       []string{"introspect_tokens"},
})

Client secret basic or client secret post authentication with per-tenant vanity domain

import "github.com/cloudentity/acp-client-go"

var client = acpclient.New(acpclient.Config{
    ClientID:          "your-clients-id",
    ClientSecret:      "your-clients-secret",
    AuthMethod:        acpclient.ClientSecretBasicAuthnMethod,
    IssuerURL:         "https://acp.local:8443/default",
    VanityDomainType:  "tenant",
    TenantID:          "default",
    Scopes:            []string{"introspect_tokens"},
})

Client secret basic or client secret post authentication with per-server vanity domain

import "github.com/cloudentity/acp-client-go"

var client = acpclient.New(acpclient.Config{
    ClientID:          "your-clients-id",
    ClientSecret:      "your-clients-secret",
    AuthMethod:        acpclient.ClientSecretBasicAuthnMethod,
    IssuerURL:         "https://default.acp.local:8443",
    VanityDomainType:  "server",
    TenantID:          "default",
    ServerID:          "default",
    Scopes:            []string{"introspect_tokens"},
})

TLS client authentication

import "github.com/cloudentity/acp-client-go"

var client = acpclient.New(acpclient.Config{
    ClientID:  "your-clients-id",
    AuthMethod: acpclient.TLSClientAuthnMethod,
    IssuerURL: "https://localhost:8443/default/default",
    CertFile:  "./cert.pem",
    KeyFile:   "./key.pem",
    RootCA:    "./ca.pem",
    Scopes:    []string{"accounts"},
})

Documentation

Index

• Constants
• func NewAuthenticator(config clientcredentials.Config, client *http.Client) *http.Client
• type Admin
• type AuthMethod
• type Authenticator
  • func (t *Authenticator) RoundTrip(req *http.Request) (res *http.Response, err error)
• type AuthorizeOption
  • func WithAuthorizationDetails(authorizationDetails string) AuthorizeOption
  • func WithOpenbankingACR(acr []string) AuthorizeOption
  • func WithOpenbankingIntentID(intentID string, acr []string) AuthorizeOption
  • func WithPAR(clientID string, requestURI string) AuthorizeOption
  • func WithPKCE() AuthorizeOption
  • func WithRequestObjectEncryption(key jose.JSONWebKey) AuthorizeOption
  • func WithResponseMode(responseMode string) AuthorizeOption
  • func WithResponseType(responseTypes ...string) AuthorizeOption
  • func WithSignedRequestObject(claims jwt.MapClaims) AuthorizeOption
• type CSRF
  • func NewCSRF() (csrf CSRF, err error)
• type Cdr
• type ClaimRequest
• type ClaimRequests
• type Client
  • func New(cfg Config) (c Client, err error)
  • func (c *Client) AuthorizeURL(options ...AuthorizeOption) (authorizeURL string, csrf CSRF, err error)
  • func (c *Client) AuthorizeURLWithPAR(requestURI string) (authorizeURL string, err error)
  • func (c *Client) DoPAR(options ...AuthorizeOption) (pr PARResponse, csrf CSRF, err error)
  • func (c *Client) DoRequest(request *http.Request) (*http.Response, error)
  • func (c *Client) Exchange(code string, state string, csrf CSRF) (token Token, err error)
  • func (c *Client) GenerateClientAssertion() (assertion string, err error)
  • func (c *Client) IntrospectToken(ctx context.Context, token string) (*o2models.IntrospectResponse, error)
  • func (c *Client) Userinfo(token string) (body map[string]interface{}, err error)
• type Config
  • func (c *Config) GetAuthorizeURL() string
  • func (c *Config) GetPARURL() string
  • func (c *Config) GetTokenURL() string
  • func (c *Config) GetUserinfoURL() string
• type Developer
• type Fdx
• type Hub
• type Identity
• type IdentityRoot
• type IdentitySelf
• type IdentitySystem
• type JWTClaims
  • func (j *JWTClaims) Valid() error
• type JWTConsumer
  • func (c *JWTConsumer) Consume(r io.Reader, out interface{}) error
• type Ksa
• type Oauth2
• type Obbr
• type Obuk
• type OpenbankingBrasil
• type OpenbankingUK
• type Opin
• type PARResponse
• type Public
• type Root
• type System
• type Token
• type Web

Constants

const (
	NonceLength    = 20
	StateLength    = 8
	VerifierLength = 43
)

Functions

func NewAuthenticator

func NewAuthenticator(config clientcredentials.Config, client *http.Client) *http.Client

Types

type Admin

type Admin struct {
	*adminClient.Acp
}

type AuthMethod

type AuthMethod string

const (
	ClientSecretBasicAuthnMethod AuthMethod = "client_secret_basic"
	ClientSecretPostAuthnMethod  AuthMethod = "client_secret_post"
	ClientSecretJwtAuthnMethod   AuthMethod = "client_secret_jwt"
	PrivateKeyJwtAuthnMethod     AuthMethod = "private_key_jwt"
	SelfSignedTLSAuthnMethod     AuthMethod = "self_signed_tls_client_auth"
	TLSClientAuthnMethod         AuthMethod = "tls_client_auth"
	NoneAuthnMethod              AuthMethod = "none"
)

type Authenticator

type Authenticator struct {
	// contains filtered or unexported fields
}

func (*Authenticator) RoundTrip

func (t *Authenticator) RoundTrip(req *http.Request) (res *http.Response, err error)

type AuthorizeOption

type AuthorizeOption interface {
	// contains filtered or unexported methods
}

func WithAuthorizationDetails

func WithAuthorizationDetails(authorizationDetails string) AuthorizeOption

func WithOpenbankingACR

func WithOpenbankingACR(acr []string) AuthorizeOption

func WithOpenbankingIntentID

func WithOpenbankingIntentID(intentID string, acr []string) AuthorizeOption

func WithPAR

func WithPAR(clientID string, requestURI string) AuthorizeOption

func WithPKCE

func WithPKCE() AuthorizeOption

func WithRequestObjectEncryption

func WithRequestObjectEncryption(key jose.JSONWebKey) AuthorizeOption

func WithResponseMode

func WithResponseMode(responseMode string) AuthorizeOption

func WithResponseType

func WithResponseType(responseTypes ...string) AuthorizeOption

func WithSignedRequestObject

func WithSignedRequestObject(claims jwt.MapClaims) AuthorizeOption

type CSRF

type CSRF struct {
	// State is an opaque value used by the client to maintain
	// state between the request and callback.  The authorization
	// server includes this value when redirecting the user-agent back
	// to the client.  The parameter SHOULD be used for preventing
	// cross-site request forgery
	State string

	// Nonce is a string value used to associate a client session with
	// an ID Token, and to mitigate replay attacks
	Nonce string

	// PKCE code verifier
	Verifier string
}

CSRF contains state, nonce and/or PKCEverifier which are used to mitigate replay attacks and cross-site request forgery.

func NewCSRF

func NewCSRF() (csrf CSRF, err error)

type Cdr

type Cdr struct {
	*cdr.Acp
}

type ClaimRequest

type ClaimRequest struct {
	Essential bool     `json:"essential"`
	Value     string   `json:"value"`
	Values    []string `json:"values"`
}

type ClaimRequests

type ClaimRequests struct {
	Userinfo map[string]*ClaimRequest `json:"userinfo"`
	IDToken  map[string]*ClaimRequest `json:"id_token"`
}

type Client

type Client struct {
	Oauth2    *Oauth2
	Admin     *Admin
	Developer *Developer
	Public    *Public
	System    *System
	Web       *Web
	Root      *Root
	Fdx       *Fdx
	Cdr       *Cdr
	Obuk      *Obuk
	Obbr      *Obbr
	Opin      *Opin
	Ksa       *Ksa
	Hub       *Hub

	*OpenbankingUK
	*OpenbankingBrasil

	Identity       *Identity
	IdentitySelf   *IdentitySelf
	IdentityRoot   *IdentityRoot
	IdentitySystem *IdentitySystem

	// Client configuration
	Config Config

	// Tenant id read from the IssuerURL
	TenantID string

	// Authorization server id read from the IssuerURL
	ServerID string

	// Base path read from the IssuerURL
	BasePath string
	// contains filtered or unexported fields
}

Client provides a client to the ACP API

func New

func New(cfg Config) (c Client, err error)

Create a new ACP client instance based on config.

func (*Client) AuthorizeURL

func (c *Client) AuthorizeURL(options ...AuthorizeOption) (authorizeURL string, csrf CSRF, err error)

func (*Client) AuthorizeURLWithPAR

func (c *Client) AuthorizeURLWithPAR(requestURI string) (authorizeURL string, err error)

func (*Client) DoPAR

func (c *Client) DoPAR(options ...AuthorizeOption) (pr PARResponse, csrf CSRF, err error)

func (*Client) DoRequest

func (c *Client) DoRequest(request *http.Request) (*http.Response, error)

func (*Client) Exchange

func (c *Client) Exchange(code string, state string, csrf CSRF) (token Token, err error)

func (*Client) GenerateClientAssertion

func (c *Client) GenerateClientAssertion() (assertion string, err error)

func (*Client) IntrospectToken

func (c *Client) IntrospectToken(ctx context.Context, token string) (*o2models.IntrospectResponse, error)

func (*Client) Userinfo

func (c *Client) Userinfo(token string) (body map[string]interface{}, err error)

type Config

type Config struct {
	// ClientID is the application's ID.
	ClientID string `json:"client_id"`

	// AuthMethod represents how requests for tokens are authenticated to the server.
	AuthMethod AuthMethod

	// ClientSecret is the application's secret.
	ClientSecret string `json:"client_secret"`

	// RedirectURL is the URL to redirect users after authentication.
	RedirectURL *url.URL `json:"redirect_url"`

	// IssuerURL is the authorization server's url.
	// example: https://localhost:8443/default/default
	IssuerURL *url.URL `json:"issuer_url"`

	// TokenURL is the authorization server's token url.
	// Optional if issuerURL provided
	TokenURL *url.URL

	// AuthorizeURL is the authorization server's authorize url.
	// Optional if issuerURL provided
	AuthorizeURL *url.URL

	// PushedAuthorizationRequestEndpoint is URL of the pushed authorization request endpoint
	// at which a client can post an authorization request to exchange
	// for a "request_uri" value usable at the authorization server.
	PushedAuthorizationRequestEndpoint *url.URL

	// UserinfoURL is the authorization server's userinfo url.
	// Optional if issuerURL provided
	UserinfoURL *url.URL

	// Scope specifies optional requested permissions.
	Scopes []string `json:"scopes"`

	// Path to the file with private key for signing request object.
	RequestObjectSigningKeyFile string `json:"request_object_signing_key_file"`

	// Request object signing algorithm
	// If empty RS256 will be used
	RequestObjectSigningAlg string `json:"request_object_signing_alg"`

	// Path to the file with private key for private_key_jwt token authentication
	ClientAssertionSigningKeyFile string `json:"client_assertion_signing_key_file"`

	// Client assertion signing algorithm
	// If empty RS256 will be used
	ClientAssertionSigningAlg string `json:"client_assertion_signing_alg"`

	// Path to the file with private key for encrypting request object.
	RequestObjectEncryptionKeyFile string `json:"request_object_encryption_key_file"`

	// Optional request object expiration time
	// If not provided, it will be se to 1 minute
	RequestObjectExpiration *time.Duration `json:"request_object_expiration"`

	// Default HttpClient timeout.
	// Ignored if HttpClient is provided.
	Timeout time.Duration `json:"timeout"`

	// Optional path to the file with certificate for tls authentication.
	// Ignored if HttpClient is provided.
	CertFile string `json:"cert_file"`

	// Optional path to the file with private key for tls authentication.
	// Ignored if HttpClient is provided.
	KeyFile string `json:"key_file"`

	// Optional path to the file with root CAs.
	// Ignored if HttpClient is provided.
	RootCA string `json:"root_ca"`

	// HttpClient is the client to use. Default will be used if not provided.
	HttpClient *http.Client `json:"-"`

	// Optional vanity domain type, one of "", "tenant" or "server".
	VanityDomainType string `json:"vanity_domain_type"`

	// Tenant id required when VanityDomainType is "tenant" or "server"
	TenantID string `json:"tenant_id"`

	// Authorization server id required when VanityDomainType is "server".
	ServerID string `json:"server_id"`

	// If enabled, client credentials flow won't be applied
	SkipClientCredentialsAuthn bool `json:"skip_client_credentials_authn"`
}

ACP client configuration

func (*Config) GetAuthorizeURL

func (c *Config) GetAuthorizeURL() string

func (*Config) GetPARURL

func (c *Config) GetPARURL() string

func (*Config) GetTokenURL

func (c *Config) GetTokenURL() string

func (*Config) GetUserinfoURL

func (c *Config) GetUserinfoURL() string

type Developer

type Developer struct {
	*developerClient.Acp
}

type Fdx

type Fdx struct {
	*fdx.Acp
}

type Hub

type Hub struct {
	*hub.Acp
}

type Identity

type Identity struct {
	*identity.Acp
}

type IdentityRoot

type IdentityRoot struct {
	*identityroot.Acp
}

type IdentitySelf

type IdentitySelf struct {
	*identityself.Acp
}

type IdentitySystem

type IdentitySystem struct {
	*identitysystem.Acp
}

type JWTClaims

type JWTClaims map[string]interface{}

func (*JWTClaims) Valid

func (j *JWTClaims) Valid() error

type JWTConsumer

type JWTConsumer struct{}

func (*JWTConsumer) Consume

func (c *JWTConsumer) Consume(r io.Reader, out interface{}) error

type Ksa

type Ksa struct {
	*ksa.Acp
}

type Oauth2

type Oauth2 struct {
	*o2Client.Acp
}

type Obbr

type Obbr struct {
	*obbr.Acp
}

type Obuk

type Obuk struct {
	*obuk.Acp
}

type OpenbankingBrasil

type OpenbankingBrasil struct {
	Consents *obbrConsents.OpenbankingBRClient
	Payments *obbrPayments.OpenbankingBRClient
}

type OpenbankingUK

type OpenbankingUK struct {
	Accounts *obukAccounts.OpenbankingUKClient
	Payments *obukPayments.OpenbankingUKClient
}

type Opin

type Opin struct {
	*opin.Acp
}

type PARResponse

type PARResponse struct {
	ExpiresIn  int64  `json:"expires_in,omitempty"`
	RequestURI string `json:"request_uri,omitempty"`
}

type Public

type Public struct {
	*publicClient.Acp
}

type Root

type Root struct {
	*rootClient.Acp
}

type System

type System struct {
	*systemClient.Acp
}

type Token

type Token struct {
	AccessToken  string `json:"access_token"`
	IDToken      string `json:"id_token"`
	RefreshToken string `json:"refresh_token"`
	TokenType    string `json:"token_type"`
	Scope        string `json:"scope"`
	ExpiresIn    int    `json:"expires_in"`
	GrantID      string `json:"grant_id,omitempty"`
}

type Web

type Web struct {
	*webClient.Acp
}