device

README

OAuth2 Device Authorization Flow go module

This go module is a helper to implement OAuth2 Device authentication in command line interfaces (or any other input constrained device).

This is the authorization flow the AWS cli uses for SSO.

Providers

The module has two providers, Auth0 and Okta, and a third which is yet to be implemented.

Auth0

This provider is fully functional. Setup instructions.

Okta

This provider is fully functional. Setup instructions.

Google

To be implemented. Setup instructions.

Documentation

Index

• Constants
• Variables
• type Auth0
  • func (a Auth0) Config(org, clientID string) *Config
• type AuthorizationResponse
• type Authorizer
  • func NewAuthorizer(config *Config) *Authorizer
  • func (a *Authorizer) Refresh(ctx context.Context) error
  • func (a *Authorizer) RequestCode(ctx context.Context) (Code, error)
  • func (a *Authorizer) Revoke(ctx context.Context) error
  • func (a *Authorizer) WaitForAuthorization(ctx context.Context, code Code) (AuthorizationResponse, error)
• type Code
• type Config
• type Error
• type Key
• type OfflineValidator
  • func (v *OfflineValidator) Initialize(ctx context.Context) error
  • func (v *OfflineValidator) Validate(_ context.Context, tokenString string) error
• type Okta
  • func (o Okta) Config(org, clientID string) *Config
• type OktaIntrospectionResponse
  • func (i OktaIntrospectionResponse) Valid(cfg *Config) error
• type OktaOnlineValidator
  • func NewOktaOnlineValidator(cfg *Config) *OktaOnlineValidator
  • func (o *OktaOnlineValidator) Initialize(_ context.Context) error
  • func (o *OktaOnlineValidator) Introspect(ctx context.Context, tokenString string) (OktaIntrospectionResponse, error)
  • func (o *OktaOnlineValidator) Validate(ctx context.Context, tokenString string) error
• type OnlineValidator
• type Provider
  • func NewProvider(name string) Provider
• type Validator
  • func NewOfflineValidator(cfg *Config) Validator

Constants

const GrantType = "urn:ietf:params:oauth:grant-type:device_code"

Variables

var (
	// ErrAccessDenied is returned when the user denies the app access to their account.
	ErrAccessDenied   = errors.New("access denied by user")
	ErrAuthPending    = errors.New("authorization pending")
	ErrNotImplemented = errors.New("not implemented")
)

var DefaultScopes = []string{"openid", "profile", "offline_access"}

Types

type Auth0

type Auth0 struct{}

func (Auth0) Config

func (a Auth0) Config(org, clientID string) *Config

type AuthorizationResponse

type AuthorizationResponse struct {
	AccessToken      string `json:"access_token"`
	IDToken          string `json:"id_token"`
	Scope            string `json:"scope"`
	TokenType        string `json:"token_type"`
	ExpiresIn        int    `json:"expires_in"`
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
}

type Authorizer

type Authorizer struct {
	*Config
	// contains filtered or unexported fields
}

func NewAuthorizer

func NewAuthorizer(config *Config) *Authorizer

func (*Authorizer) Refresh

func (a *Authorizer) Refresh(ctx context.Context) error

func (*Authorizer) RequestCode

func (a *Authorizer) RequestCode(ctx context.Context) (Code, error)

func (*Authorizer) Revoke

func (a *Authorizer) Revoke(ctx context.Context) error

func (*Authorizer) WaitForAuthorization

func (a *Authorizer) WaitForAuthorization(ctx context.Context, code Code) (AuthorizationResponse, error)

type Code

type Code struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete"`
	ExpiresIn               int64  `json:"expires_in"`
	Interval                int64  `json:"interval"`
}

type Config

type Config struct {
	OAuth2Config oauth2.Config
	Audience     string
	Issuer       string
	KeyURI       string
	// contains filtered or unexported fields
}

type Error

type Error struct {
	ErrorCode    string   `json:"ErrorCode"`
	ErrorSummary string   `json:"errorSummary"`
	ErrorCauses  []string `json:"errorCauses"`
}

type Key

type Key struct {
	Alg string   `json:"alg"`
	Kty string   `json:"kty"`
	Use string   `json:"use"`
	N   string   `json:"n"`
	E   string   `json:"e"`
	Kid string   `json:"kid"`
	X5T string   `json:"x5t"`
	X5C []string `json:"x5c"`
}

type OfflineValidator

type OfflineValidator struct {
	*Config
	Keys map[string]*rsa.PublicKey
}

func (*OfflineValidator) Initialize

func (v *OfflineValidator) Initialize(ctx context.Context) error

Initialize loads public keys from the provider

func (*OfflineValidator) Validate

func (v *OfflineValidator) Validate(_ context.Context, tokenString string) error

Validate validates a token against public keys which must be loaded prior.

type Okta

type Okta struct{}

func (Okta) Config

func (o Okta) Config(org, clientID string) *Config

type OktaIntrospectionResponse

type OktaIntrospectionResponse struct {
	Active    bool   `json:"active"`
	Scope     string `json:"scope"`
	Username  string `json:"username"`
	Exp       int64  `json:"exp"`
	Nbf       int64  `json:"nbf"`
	Iat       int64  `json:"iat"`
	Sub       string `json:"sub"`
	Aud       string `json:"aud"`
	Iss       string `json:"iss"`
	Jti       string `json:"jti"`
	TokenType string `json:"token_type"`
	ClientId  string `json:"client_id"`
	DeviceId  string `json:"device_id"`
	Uid       string `json:"uid"`
}

func (OktaIntrospectionResponse) Valid

func (i OktaIntrospectionResponse) Valid(cfg *Config) error

type OktaOnlineValidator

type OktaOnlineValidator struct {
	*Config
	// contains filtered or unexported fields
}

func NewOktaOnlineValidator

func NewOktaOnlineValidator(cfg *Config) *OktaOnlineValidator

func (*OktaOnlineValidator) Initialize

func (o *OktaOnlineValidator) Initialize(_ context.Context) error

func (*OktaOnlineValidator) Introspect

func (o *OktaOnlineValidator) Introspect(ctx context.Context, tokenString string) (OktaIntrospectionResponse, error)

Introspect calls the Okta OAuth2 API to validate the token, see https://developer.okta.com/docs/reference/api/oidc/#introspect

func (*OktaOnlineValidator) Validate

func (o *OktaOnlineValidator) Validate(ctx context.Context, tokenString string) error

type OnlineValidator

type OnlineValidator struct {
	*Config
}

type Provider

type Provider interface {
	Config(org, clientID string) *Config
}

func NewProvider

func NewProvider(name string) Provider

type Validator

type Validator interface {
	Validate(ctx context.Context, tokenString string) error
	Initialize(ctx context.Context) error
}

func NewOfflineValidator

func NewOfflineValidator(cfg *Config) Validator