server

Documentation

Overview

Package server implements authentication for inbound HTTP requests on GAE. It provides adapters for GAE Users and OAuth2 APIs to make them usable by server/auth package.

It also provides GAE-specific implementation of some other interface used by server/auth package, such as SessionStore.

By default, gaeauth must have its handlers installed into the "default" AppEngine module, and must be running on an instance with read/write datastore access.

Index

• Constants
• Variables
• func FetchFrontendClientID(ctx context.Context) (string, error)
• func GetAuthDB(ctx context.Context, prev authdb.DB) (authdb.DB, error)
• func InstallHandlers(r *router.Router, base router.MiddlewareChain)
• type InboundAppIDAuthMethod
  • func (m InboundAppIDAuthMethod) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)
• type OAuth2Method
  • func (m *OAuth2Method) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)
  • func (m *OAuth2Method) GetUserCredentials(ctx context.Context, r *http.Request) (*oauth2.Token, error)
• type SessionStore
  • func (s *SessionStore) CloseSession(ctx context.Context, sessionID string) error
  • func (s *SessionStore) GetSession(ctx context.Context, sessionID string) (*auth.Session, error)
  • func (s *SessionStore) OpenSession(ctx context.Context, userID string, u *auth.User, exp time.Time) (string, error)
• type UsersAPIAuthMethod
  • func (m UsersAPIAuthMethod) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)
  • func (m UsersAPIAuthMethod) LoginURL(ctx context.Context, dest string) (string, error)
  • func (m UsersAPIAuthMethod) LogoutURL(ctx context.Context, dest string) (string, error)

Constants

const EmailScope = "https://www.googleapis.com/auth/userinfo.email"

EmailScope is a scope used to identifies user's email. Present in most tokens by default. Can be used as a base scope for authentication.

Variables

var CookieAuth auth.Method

CookieAuth is default cookie-based auth method to use on GAE.

By default on the dev server it is based on dev server cookies (implemented by UsersAPIAuthMethod), in prod it is based on OpenID (implemented by *openid.CookieAuthMethod).

Works only if appropriate handlers have been installed into the router. See InstallHandlers.

It is allowed to assign to CookieAuth (e.g. to install a tweaked auth method) before InstallHandlers is called.

Functions

func FetchFrontendClientID

func FetchFrontendClientID(ctx context.Context) (string, error)

FetchFrontendClientID fetches the frontend client ID from the settings store.

func GetAuthDB

func GetAuthDB(ctx context.Context, prev authdb.DB) (authdb.DB, error)

GetAuthDB fetches AuthDB snapshot from the datastore and returns authdb.DB interface wrapping it.

It may reuse existing one (`prev`), if no changes were made. If `prev` is nil, always fetches a new copy from the datastore.

If auth_service URL is not configured, returns special kind of authdb.DB that implements some default authorization rules (allow everything on dev server, forbid everything and emit errors on real GAE).

func InstallHandlers

func InstallHandlers(r *router.Router, base router.MiddlewareChain)

InstallHandlers installs HTTP handlers for various default routes related to authentication system.

Must be installed in server HTTP router for authentication to work.

Types

type InboundAppIDAuthMethod

type InboundAppIDAuthMethod struct{}

InboundAppIDAuthMethod implements auth.Method by checking special HTTP header (X-Appengine-Inbound-Appid), that is set iff one GAE app talks to another.

func (InboundAppIDAuthMethod) Authenticate

func (m InboundAppIDAuthMethod) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)

Authenticate extracts peer's identity from the incoming request.

type OAuth2Method

type OAuth2Method struct {
	// Scopes is a list of OAuth scopes to check when authenticating the token.
	Scopes []string
}

OAuth2Method implements auth.Method on top of GAE OAuth2 API. It doesn't implement auth.UsersAPI.

func (*OAuth2Method) Authenticate

func (m *OAuth2Method) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)

Authenticate extracts peer's identity from the incoming request.

func (*OAuth2Method) GetUserCredentials

func (m *OAuth2Method) GetUserCredentials(ctx context.Context, r *http.Request) (*oauth2.Token, error)

GetUserCredentials implements auth.UserCredentialsGetter.

type SessionStore

type SessionStore struct {
	Prefix string // used as prefix for datastore keys
}

SessionStore stores auth sessions in the datastore (always in the default namespace). It implements auth.SessionStore.

func (*SessionStore) CloseSession

func (s *SessionStore) CloseSession(ctx context.Context, sessionID string) error

CloseSession closes a session given its ID. Does nothing if session is already closed or doesn't exist. Returns only transient errors.

func (*SessionStore) GetSession

func (s *SessionStore) GetSession(ctx context.Context, sessionID string) (*auth.Session, error)

GetSession returns existing non-expired session given its ID. Returns nil if session doesn't exist, closed or expired. Returns only transient errors.

func (*SessionStore) OpenSession

func (s *SessionStore) OpenSession(ctx context.Context, userID string, u *auth.User, exp time.Time) (string, error)

OpenSession create a new session for a user with given expiration time. It returns unique session ID.

type UsersAPIAuthMethod

type UsersAPIAuthMethod struct{}

UsersAPIAuthMethod implements auth.Method and auth.UsersAPI interfaces on top of GAE Users API (that uses HTTP cookies internally to track user sessions).

func (UsersAPIAuthMethod) Authenticate

func (m UsersAPIAuthMethod) Authenticate(ctx context.Context, r *http.Request) (*auth.User, error)

Authenticate extracts peer's identity from the incoming request.

func (UsersAPIAuthMethod) LoginURL

func (m UsersAPIAuthMethod) LoginURL(ctx context.Context, dest string) (string, error)

LoginURL returns a URL that, when visited, prompts the user to sign in, then redirects the user to the URL specified by dest.

func (UsersAPIAuthMethod) LogoutURL

func (m UsersAPIAuthMethod) LogoutURL(ctx context.Context, dest string) (string, error)

LogoutURL returns a URL that, when visited, signs the user out, then redirects the user to the URL specified by dest.