downstreamsession

Documentation

Overview

Package downstreamsession provides some shared helpers for creating downstream OIDC sessions.

Index

• func AutoApproveScopes(authorizeRequester fosite.AuthorizeRequester)
• func NewPinnipedSession(ctx context.Context, ...) (*psession.PinnipedSession, error)
• type SessionConfig

Functions

func AutoApproveScopes

func AutoApproveScopes(authorizeRequester fosite.AuthorizeRequester)

AutoApproveScopes auto-grants the scopes which we support and for which we do not require end-user approval, if they were requested. This should only be called after it has been validated that the client is allowed to request the scopes that it requested (which is a check performed by fosite).

func NewPinnipedSession

func NewPinnipedSession(
	ctx context.Context,
	idp resolvedprovider.FederationDomainResolvedIdentityProvider,
	c *SessionConfig,
) (*psession.PinnipedSession, error)

NewPinnipedSession applies the configured FederationDomain identity transformations and creates a downstream Pinniped session.

Types

type SessionConfig

type SessionConfig struct {
	UpstreamIdentity    *resolvedprovider.Identity
	UpstreamLoginExtras *resolvedprovider.IdentityLoginExtras
	// The ID of the client who started the new downstream session.
	ClientID string
	// The scopes that were granted for the new downstream session.
	GrantedScopes []string
}

SessionConfig is everything that is needed to start a new downstream Pinniped session, including the upstream and downstream identities of the user. All fields are required.