oauth2_provider

Documentation

Index

• Constants
• func GetOAuthGroupsForUser(ctx context.Context, user *user_model.User, onlyPublicGroups bool) ([]string, error)
• func GrantAdditionalScopes(grantScopes string) auth.AccessTokenScope
• func Init(ctx context.Context) error
• func InitSigningKey() error
• func NewAccessTokenResponse(ctx context.Context, grant *auth.OAuth2Grant, ...) (*AccessTokenResponse, *AccessTokenError)
• type AccessTokenError
  • func (err AccessTokenError) Error() string
• type AccessTokenErrorCode
• type AccessTokenResponse
• type ErrInvalidAlgorithmType
  • func (err ErrInvalidAlgorithmType) Error() string
• type JWTSigningKey
  • func CreateJWTSigningKey(algorithm string, key any) (JWTSigningKey, error)
• type OIDCToken
  • func (token *OIDCToken) SignToken(signingKey JWTSigningKey) (string, error)
• type Token
  • func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error)
  • func (token *Token) SignToken(signingKey JWTSigningKey) (string, error)
• type TokenKind
• type TokenType

Constants

const (
	// AccessTokenErrorCodeInvalidRequest represents an error code specified in RFC 6749
	AccessTokenErrorCodeInvalidRequest AccessTokenErrorCode = "invalid_request"
	// AccessTokenErrorCodeInvalidClient represents an error code specified in RFC 6749
	AccessTokenErrorCodeInvalidClient = "invalid_client"
	// AccessTokenErrorCodeInvalidGrant represents an error code specified in RFC 6749
	AccessTokenErrorCodeInvalidGrant = "invalid_grant"
	// AccessTokenErrorCodeUnauthorizedClient represents an error code specified in RFC 6749
	AccessTokenErrorCodeUnauthorizedClient = "unauthorized_client"
	// AccessTokenErrorCodeUnsupportedGrantType represents an error code specified in RFC 6749
	AccessTokenErrorCodeUnsupportedGrantType = "unsupported_grant_type"
	// AccessTokenErrorCodeInvalidScope represents an error code specified in RFC 6749
	AccessTokenErrorCodeInvalidScope = "invalid_scope"
)

Functions

func GetOAuthGroupsForUser

func GetOAuthGroupsForUser(ctx context.Context, user *user_model.User, onlyPublicGroups bool) ([]string, error)

returns a list of "org" and "org:team" strings, that the given user is a part of.

func GrantAdditionalScopes

func GrantAdditionalScopes(grantScopes string) auth.AccessTokenScope

GrantAdditionalScopes returns valid scopes coming from grant

func Init

func Init(ctx context.Context) error

Init initializes the oauth source

func InitSigningKey

func InitSigningKey() error

InitSigningKey creates the default signing key from settings or creates a random key.

func NewAccessTokenResponse

func NewAccessTokenResponse(ctx context.Context, grant *auth.OAuth2Grant, serverKey, clientKey JWTSigningKey) (*AccessTokenResponse, *AccessTokenError)

Types

type AccessTokenError

type AccessTokenError struct {
	ErrorCode        AccessTokenErrorCode `json:"error" form:"error"`
	ErrorDescription string               `json:"error_description"`
}

AccessTokenError represents an error response specified in RFC 6749 https://datatracker.ietf.org/doc/html/rfc6749#section-5.2

func (AccessTokenError) Error

func (err AccessTokenError) Error() string

Error returns the error message

type AccessTokenErrorCode

type AccessTokenErrorCode string

AccessTokenErrorCode represents an error code specified in RFC 6749 https://datatracker.ietf.org/doc/html/rfc6749#section-5.2

type AccessTokenResponse

type AccessTokenResponse struct {
	AccessToken  string    `json:"access_token"`
	TokenType    TokenType `json:"token_type"`
	ExpiresIn    int64     `json:"expires_in"`
	RefreshToken string    `json:"refresh_token"`
	IDToken      string    `json:"id_token,omitempty"`
}

AccessTokenResponse represents a successful access token response https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2

type ErrInvalidAlgorithmType

type ErrInvalidAlgorithmType struct {
	Algorithm string
}

ErrInvalidAlgorithmType represents an invalid algorithm error.

func (ErrInvalidAlgorithmType) Error

func (err ErrInvalidAlgorithmType) Error() string

type JWTSigningKey

type JWTSigningKey interface {
	IsSymmetric() bool
	SigningMethod() jwt.SigningMethod
	SignKey() any
	VerifyKey() any
	ToJWK() (map[string]string, error)
	PreProcessToken(*jwt.Token)
}

JWTSigningKey represents a algorithm/key pair to sign JWTs

var DefaultSigningKey JWTSigningKey

DefaultSigningKey is the default signing key for JWTs.

func CreateJWTSigningKey

func CreateJWTSigningKey(algorithm string, key any) (JWTSigningKey, error)

CreateJWTSigningKey creates a signing key from an algorithm / key pair.

type OIDCToken

type OIDCToken struct {
	jwt.RegisteredClaims
	Nonce string `json:"nonce,omitempty"`

	// Scope profile
	Name              string             `json:"name,omitempty"`
	PreferredUsername string             `json:"preferred_username,omitempty"`
	Profile           string             `json:"profile,omitempty"`
	Picture           string             `json:"picture,omitempty"`
	Website           string             `json:"website,omitempty"`
	Locale            string             `json:"locale,omitempty"`
	UpdatedAt         timeutil.TimeStamp `json:"updated_at,omitempty"`

	// Scope email
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`

	// Groups are generated by organization and team names
	Groups []string `json:"groups,omitempty"`
}

OIDCToken represents an OpenID Connect id_token

func (*OIDCToken) SignToken

func (token *OIDCToken) SignToken(signingKey JWTSigningKey) (string, error)

SignToken signs an id_token with the (symmetric) client secret key

type Token

type Token struct {
	GrantID int64     `json:"gnt"`
	Kind    TokenKind `json:"tt"`
	Counter int64     `json:"cnt,omitempty"`
	jwt.RegisteredClaims
}

Token represents a JWT token used to authenticate a client

func ParseToken

func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error)

ParseToken parses a signed jwt string

func (*Token) SignToken

func (token *Token) SignToken(signingKey JWTSigningKey) (string, error)

SignToken signs the token with the JWT secret

type TokenKind

type TokenKind int

TokenKind represents the type of token for an oauth application

const (
	// KindAccessToken is a token with short lifetime to access the api
	KindAccessToken TokenKind = 0
	// KindRefreshToken is token with long lifetime to refresh access tokens obtained by the client
	KindRefreshToken = iota
)

type TokenType

type TokenType string

TokenType specifies the kind of token

const (
	// TokenTypeBearer represents a token type specified in RFC 6749
	TokenTypeBearer TokenType = "bearer"
	// TokenTypeMAC represents a token type specified in RFC 6749
	TokenTypeMAC = "mac"
)