pkce

Documentation

Overview

Provides the setup required for the client to perform the "Authorization Code" flow with PKCE in order to obtain an access token for public/untrusted clients.

Index

• type Config
• type SimpleTokenSource
  • func (ts *SimpleTokenSource) Token() (*oauth2.Token, error)
• type TokenOrchestrator
  • func NewTokenOrchestrator(baseOrchestrator tokenorchestrator.BaseTokenOrchestrator, cfg Config) (TokenOrchestrator, error)
  • func (f TokenOrchestrator) FetchTokenFromAuthFlow(ctx context.Context) (*oauth2.Token, error)

Types

type Config

type Config struct {
	BrowserSessionTimeout   config.Duration `json:"timeout" pflag:",Amount of time the browser session would be active for authentication from client app."`
	TokenRefreshGracePeriod config.Duration `json:"refreshTime" pflag:",grace period from the token expiry after which it would refresh the token."`
}

Config defines settings used for PKCE flow.

type SimpleTokenSource

type SimpleTokenSource struct {
	CachedToken *oauth2.Token
}

SimpleTokenSource defines a simple token source that caches a token in memory.

func (*SimpleTokenSource) Token

func (ts *SimpleTokenSource) Token() (*oauth2.Token, error)

type TokenOrchestrator

type TokenOrchestrator struct {
	tokenorchestrator.BaseTokenOrchestrator
	Config Config
}

TokenOrchestrator implements the main logic to initiate Pkce flow to issue access token and refresh token as well as refreshing the access token if a refresh token is present.

func NewTokenOrchestrator

func NewTokenOrchestrator(baseOrchestrator tokenorchestrator.BaseTokenOrchestrator, cfg Config) (TokenOrchestrator, error)

NewTokenOrchestrator creates a new TokenOrchestrator that implements the main logic to initiate Pkce flow to issue access token and refresh token as well as refreshing the access token if a refresh token is present.

func (TokenOrchestrator) FetchTokenFromAuthFlow

func (f TokenOrchestrator) FetchTokenFromAuthFlow(ctx context.Context) (*oauth2.Token, error)

FetchTokenFromAuthFlow starts a webserver to listen to redirect callback from the authorization server at the end of the flow. It then launches the browser to authenticate the user.