consent

package
v1.0.0-beta.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 29, 2018 License: Apache-2.0 Imports: 30 Imported by: 49

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrAbortOAuth2Request = errors.New("The OAuth 2.0 Authorization request must be aborted")

Functions

This section is empty.

Types

type AuthenticationRequest 

type AuthenticationRequest struct {
	// Challenge is the identifier ("authentication challenge") of the consent authentication request. It is used to
	// identify the session.
	Challenge string `json:"challenge"`

	// RequestedScope contains all scopes requested by the OAuth 2.0 client.
	RequestedScope []string `json:"requested_scope"`

	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
	// If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.
	//
	// This feature allows you to update / set session information.
	Skip bool `json:"skip"`

	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
	// requested by the OAuth 2.0 client.
	Subject string `json:"subject"`

	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context"`

	// Client is the OAuth 2.0 Client that initiated the request.
	Client *client.Client `json:"client"`

	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
	// might come in handy if you want to deal with additional request parameters.
	RequestURL string `json:"request_url"`

	Verifier        string    `json:"-"`
	CSRF            string    `json:"-"`
	AuthenticatedAt time.Time `json:"-"`
	RequestedAt     time.Time `json:"-"`
}

Contains information on an ongoing login request.

swagger:model loginRequest

type AuthenticationSession 

type AuthenticationSession struct {
	ID              string    `db:"id"`
	AuthenticatedAt time.Time `db:"authenticated_at"`
	Subject         string    `db:"subject"`
}

type ConsentRequest 

type ConsentRequest struct {
	// Challenge is the identifier ("authorization challenge") of the consent authorization request. It is used to
	// identify the session.
	Challenge string `json:"challenge"`

	// RequestedScope contains all scopes requested by the OAuth 2.0 client.
	RequestedScope []string `json:"requested_scope"`

	// Skip, if true, implies that the client has requested the same scopes from the same user previously.
	// If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the
	// consent request using the usual API call.
	Skip bool `json:"skip"`

	// Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
	// requested by the OAuth 2.0 client.
	Subject string `json:"subject"`

	// OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
	// values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
	OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context"`

	// Client is the OAuth 2.0 Client that initiated the request.
	Client *client.Client `json:"client"`

	// RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
	// initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
	// might come in handy if you want to deal with additional request parameters.
	RequestURL string `json:"request_url"`

	Verifier        string    `json:"-"`
	CSRF            string    `json:"-"`
	AuthenticatedAt time.Time `json:"-"`
	RequestedAt     time.Time `json:"-"`
}

Contains information on an ongoing consent request.

swagger:model consentRequest

type ConsentRequestSessionData 

type ConsentRequestSessionData struct {
	// AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the
	// refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.
	// If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties
	// can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
	AccessToken map[string]interface{} `json:"access_token"`

	// IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable
	// by anyone that has access to the ID Challenge. Use with care!
	IDToken map[string]interface{} `json:"id_token"`
}

Used to pass session data to a consent request.

swagger:model consentRequestSession

type DefaultStrategy 

type DefaultStrategy struct {
	AuthenticationURL             string
	ConsentURL                    string
	IssuerURL                     string
	OAuth2AuthURL                 string
	M                             Manager
	CookieStore                   sessions.Store
	ScopeStrategy                 fosite.ScopeStrategy
	RunsHTTPS                     bool
	RequestMaxAge                 time.Duration
	JWTStrategy                   jwt.JWTStrategy
	OpenIDConnectRequestValidator *openid.OpenIDConnectRequestValidator
}

func NewStrategy 

func NewStrategy(
	authenticationURL string,
	consentURL string,
	issuerURL string,
	oAuth2AuthURL string,
	m Manager,
	cookieStore sessions.Store,
	scopeStrategy fosite.ScopeStrategy,
	runsHTTPS bool,
	requestMaxAge time.Duration,
	jwtStrategy jwt.JWTStrategy,
	openIDConnectRequestValidator *openid.OpenIDConnectRequestValidator,
) *DefaultStrategy

func (*DefaultStrategy) HandleOAuth2AuthorizationRequest 

func (s *DefaultStrategy) HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)

type HandledAuthenticationRequest 

type HandledAuthenticationRequest struct {
	// Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store
	// a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she
	// will not be asked to log in again.
	Remember bool `json:"remember"`

	// RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the
	// authorization will be remembered indefinitely.
	RememberFor int `json:"remember_for"`

	// ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
	// to express that, for example, a user authenticated using two factor authentication.
	ACR string `json:"acr"`

	// Subject is the user ID of the end-user that authenticated.
	Subject string `json:"subject"`

	AuthenticationRequest *AuthenticationRequest `json:"-"`
	Error                 *RequestDeniedError    `json:"-"`
	Challenge             string                 `json:"-"`
	RequestedAt           time.Time              `json:"-"`
	AuthenticatedAt       time.Time              `json:"-"`
	WasUsed               bool                   `json:"-"`
}

The request payload used to accept a login request.

swagger:model acceptLoginRequest

type HandledConsentRequest 

type HandledConsentRequest struct {
	// GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`
	GrantedScope []string `json:"grant_scope"`

	// Session allows you to set (optional) session data for access and ID tokens.
	Session *ConsentRequestSessionData `json:"session"`

	// Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
	// client asks the same user for the same, or a subset of, scope.
	Remember bool `json:"remember"`

	// RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
	// authorization will be remembered indefinitely.
	RememberFor int `json:"remember_for"`

	ConsentRequest  *ConsentRequest     `json:"-"`
	Error           *RequestDeniedError `json:"-"`
	Challenge       string              `json:"-"`
	RequestedAt     time.Time           `json:"-"`
	AuthenticatedAt time.Time           `json:"-"`
	WasUsed         bool                `json:"-"`
}

The request payload used to accept a consent request.

swagger:model acceptConsentRequest

type Handler 

type Handler struct {
	H             herodot.Writer
	M             Manager
	RequestMaxAge time.Duration
}

func NewHandler 

func NewHandler(
	h herodot.Writer,
	m Manager,
) *Handler

func (*Handler) AcceptConsentRequest 

func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/consent/{challenge}/accept oAuth2 acceptConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the user and then tell ORY Hydra now about it. If the user authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the user's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a user interface which asks the user to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the user's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the user accepted or rejected the request.

This endpoint tells ORY Hydra that the user has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests.

The response contains a redirect URL which the consent provider should redirect the user-agent to. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  401: genericError
  500: genericError

func (*Handler) AcceptLoginRequest 

func (h *Handler) AcceptLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/login/{challenge}/accept oAuth2 acceptLoginRequest

Accept an login request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the user and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the user a login screen") a user (in OAuth2 the proper name for user is "resource owner").

The authentication challenge is appended to the login provider URL to which the user's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells ORY Hydra that the user has successfully authenticated and includes additional information such as the user's ID and if ORY Hydra should remember the user's user agent for future authentication attempts by setting a cookie.

The response contains a redirect URL which the login provider should redirect the user-agent to. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  401: genericError
  500: genericError

func (*Handler) GetConsentRequest 

func (h *Handler) GetConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/requests/consent/{challenge} oAuth2 getConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the user and then tell ORY Hydra now about it. If the user authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the user's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a user interface which asks the user to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the user's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the user accepted or rejected the request. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: consentRequest
  401: genericError
  500: genericError

func (*Handler) GetLoginRequest 

func (h *Handler) GetLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/requests/login/{challenge} oAuth2 getLoginRequest

Get an login request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the user and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the user a login screen") a user (in OAuth2 the proper name for user is "resource owner").

The authentication challenge is appended to the login provider URL to which the user's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: loginRequest
  401: genericError
  500: genericError

func (*Handler) RejectConsentRequest 

func (h *Handler) RejectConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/consent/{challenge}/reject oAuth2 rejectConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the user and then tell ORY Hydra now about it. If the user authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the user's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a user interface which asks the user to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the user's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the user accepted or rejected the request.

This endpoint tells ORY Hydra that the user has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted.

The response contains a redirect URL which the consent provider should redirect the user-agent to. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  401: genericError
  500: genericError

func (*Handler) RejectLoginRequest 

func (h *Handler) RejectLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/login/{challenge}/reject oAuth2 rejectLoginRequest

Reject an logout request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the user and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the user a login screen") a user (in OAuth2 the proper name for user is "resource owner").

The authentication challenge is appended to the login provider URL to which the user's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells ORY Hydra that the user has not authenticated and includes a reason why the authentication was be denied.

The response contains a redirect URL which the login provider should redirect the user-agent to. 

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  401: genericError
  500: genericError

func (*Handler) SetRoutes 

func (h *Handler) SetRoutes(r *httprouter.Router)

type Manager 

type Manager interface {
	CreateConsentRequest(*ConsentRequest) error
	GetConsentRequest(challenge string) (*ConsentRequest, error)
	HandleConsentRequest(challenge string, r *HandledConsentRequest) (*ConsentRequest, error)

	VerifyAndInvalidateConsentRequest(verifier string) (*HandledConsentRequest, error)
	FindPreviouslyGrantedConsentRequests(client string, user string) ([]HandledConsentRequest, error)

	// Cookie management
	GetAuthenticationSession(id string) (*AuthenticationSession, error)
	CreateAuthenticationSession(*AuthenticationSession) error
	DeleteAuthenticationSession(id string) error

	CreateAuthenticationRequest(*AuthenticationRequest) error
	GetAuthenticationRequest(challenge string) (*AuthenticationRequest, error)
	HandleAuthenticationRequest(challenge string, r *HandledAuthenticationRequest) (*AuthenticationRequest, error)
	VerifyAndInvalidateAuthenticationRequest(verifier string) (*HandledAuthenticationRequest, error)
}

type MemoryManager 

type MemoryManager struct {
	// contains filtered or unexported fields
}

func NewMemoryManager 

func NewMemoryManager() *MemoryManager

func (*MemoryManager) CreateAuthenticationRequest 

func (m *MemoryManager) CreateAuthenticationRequest(a *AuthenticationRequest) error

func (*MemoryManager) CreateAuthenticationSession 

func (m *MemoryManager) CreateAuthenticationSession(a *AuthenticationSession) error

func (*MemoryManager) CreateConsentRequest 

func (m *MemoryManager) CreateConsentRequest(c *ConsentRequest) error

func (*MemoryManager) DeleteAuthenticationSession 

func (m *MemoryManager) DeleteAuthenticationSession(id string) error

func (*MemoryManager) FindPreviouslyGrantedConsentRequests 

func (m *MemoryManager) FindPreviouslyGrantedConsentRequests(client string, subject string) ([]HandledConsentRequest, error)

func (*MemoryManager) GetAuthenticationRequest 

func (m *MemoryManager) GetAuthenticationRequest(challenge string) (*AuthenticationRequest, error)

func (*MemoryManager) GetAuthenticationSession 

func (m *MemoryManager) GetAuthenticationSession(id string) (*AuthenticationSession, error)

func (*MemoryManager) GetConsentRequest 

func (m *MemoryManager) GetConsentRequest(challenge string) (*ConsentRequest, error)

func (*MemoryManager) HandleAuthenticationRequest 

func (m *MemoryManager) HandleAuthenticationRequest(challenge string, r *HandledAuthenticationRequest) (*AuthenticationRequest, error)

func (*MemoryManager) HandleConsentRequest 

func (m *MemoryManager) HandleConsentRequest(challenge string, r *HandledConsentRequest) (*ConsentRequest, error)

func (*MemoryManager) VerifyAndInvalidateAuthenticationRequest 

func (m *MemoryManager) VerifyAndInvalidateAuthenticationRequest(verifier string) (*HandledAuthenticationRequest, error)

func (*MemoryManager) VerifyAndInvalidateConsentRequest 

func (m *MemoryManager) VerifyAndInvalidateConsentRequest(verifier string) (*HandledConsentRequest, error)

type OpenIDConnectContext 

type OpenIDConnectContext struct {
	// ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.
	// It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.
	//
	// OpenID Connect defines it as follows:
	// > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values
	// that the Authorization Server is being requested to use for processing this Authentication Request, with the
	// values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication
	// performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a
	// Voluntary Claim by this parameter.
	ACRValues []string `json:"acr_values,omitempty"`

	// UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a
	// space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value
	// "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),
	// followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested
	// locales are not supported by the OpenID Provider.
	UILocales []string `json:"ui_locales,omitempty"`

	// Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
	// The defined values are:
	// - page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
	// - popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
	// - touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
	// - wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
	//
	// The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.
	Display string `json:"display,omitempty"`

	// IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the
	// End-User's current or past authenticated session with the Client.
	IDTokenHintClaims map[string]interface{} `json:"id_token_hint_claims,omitempty"`

	// LoginHint hints about the login identifier the End-User might use to log in (if necessary).
	// This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)
	// and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a
	// phone number in the format specified for the phone_number Claim. The use of this parameter is optional.
	LoginHint string `json:"login_hint,omitempty"`
}

Contains optional information about the OpenID Connect request.

swagger:model openIDConnectContext

type RequestDeniedError 

type RequestDeniedError struct {
	Name        string `json:"error"`
	Description string `json:"error_description"`
	Hint        string `json:"error_hint,omitempty"`
	Code        int    `json:"status_code,omitempty"`
	Debug       string `json:"error_debug,omitempty"`
}

The request payload used to accept a login or consent request.

swagger:model rejectRequest

type RequestHandlerResponse 

type RequestHandlerResponse struct {
	// RedirectURL is the URL which you should redirect the user to once the authentication process is completed.
	RedirectTo string `json:"redirect_to"`
}

The response payload sent when accepting or rejecting a login or consent request.

swagger:model completedRequest

type SQLManager 

type SQLManager struct {
	// contains filtered or unexported fields
}

func NewSQLManager 

func NewSQLManager(db *sqlx.DB, c client.Manager) *SQLManager

func (*SQLManager) CreateAuthenticationRequest 

func (m *SQLManager) CreateAuthenticationRequest(c *AuthenticationRequest) error

func (*SQLManager) CreateAuthenticationSession 

func (m *SQLManager) CreateAuthenticationSession(a *AuthenticationSession) error

func (*SQLManager) CreateConsentRequest 

func (m *SQLManager) CreateConsentRequest(c *ConsentRequest) error

func (*SQLManager) CreateSchemas 

func (m *SQLManager) CreateSchemas() (int, error)

func (*SQLManager) DeleteAuthenticationSession 

func (m *SQLManager) DeleteAuthenticationSession(id string) error

func (*SQLManager) FindPreviouslyGrantedConsentRequests 

func (m *SQLManager) FindPreviouslyGrantedConsentRequests(client string, subject string) ([]HandledConsentRequest, error)

func (*SQLManager) GetAuthenticationRequest 

func (m *SQLManager) GetAuthenticationRequest(challenge string) (*AuthenticationRequest, error)

func (*SQLManager) GetAuthenticationSession 

func (m *SQLManager) GetAuthenticationSession(id string) (*AuthenticationSession, error)

func (*SQLManager) GetConsentRequest 

func (m *SQLManager) GetConsentRequest(challenge string) (*ConsentRequest, error)

func (*SQLManager) HandleAuthenticationRequest 

func (m *SQLManager) HandleAuthenticationRequest(challenge string, r *HandledAuthenticationRequest) (*AuthenticationRequest, error)

func (*SQLManager) HandleConsentRequest 

func (m *SQLManager) HandleConsentRequest(challenge string, r *HandledConsentRequest) (*ConsentRequest, error)

func (*SQLManager) VerifyAndInvalidateAuthenticationRequest 

func (m *SQLManager) VerifyAndInvalidateAuthenticationRequest(verifier string) (*HandledAuthenticationRequest, error)

func (*SQLManager) VerifyAndInvalidateConsentRequest 

func (m *SQLManager) VerifyAndInvalidateConsentRequest(verifier string) (*HandledConsentRequest, error)

type Strategy 

type Strategy interface {
	HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.