clientregistry

Documentation

Overview

Package clientregistry defines Pinniped's OAuth2/OIDC clients.

Index

• type Client
  • func PinnipedCLI() *Client
  • func (c *Client) GetResponseModes() []fosite.ResponseModeType
• type ClientManager
  • func NewClientManager(oidcClientsClient supervisorclient.OIDCClientInterface, ...) *ClientManager
  • func (*ClientManager) ClientAssertionJWTValid(ctx context.Context, jti string) error
  • func (m *ClientManager) GetClient(ctx context.Context, id string) (fosite.Client, error)
  • func (*ClientManager) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

Types

type Client

type Client struct {
	fosite.DefaultOpenIDConnectClient
}

Client represents a Pinniped OAuth/OIDC client. It can be the static pinniped-cli client or a dynamic client defined by an OIDCClient CR.

func PinnipedCLI

func PinnipedCLI() *Client

PinnipedCLI returns the static Client corresponding to the Pinniped CLI.

func (*Client) GetResponseModes

func (c *Client) GetResponseModes() []fosite.ResponseModeType

type ClientManager

type ClientManager struct {
	// contains filtered or unexported fields
}

ClientManager is a fosite.ClientManager with a statically-defined client and with dynamically-defined clients.

func NewClientManager

func NewClientManager(
	oidcClientsClient supervisorclient.OIDCClientInterface,
	storage *oidcclientsecretstorage.OIDCClientSecretStorage,
	minBcryptCost int,
) *ClientManager

func (*ClientManager) ClientAssertionJWTValid

func (*ClientManager) ClientAssertionJWTValid(ctx context.Context, jti string) error

ClientAssertionJWTValid returns an error if the JTI is known or the DB check failed and nil if the JTI is not known.

This functionality is not supported by the ClientManager.

func (*ClientManager) GetClient

func (m *ClientManager) GetClient(ctx context.Context, id string) (fosite.Client, error)

GetClient returns the client specified by the given ID.

It returns a fosite.ErrNotFound if an unknown client is specified. Other errors returned are plain errors, because fosite will wrap them into a new ErrInvalidClient error and use the plain error's text as that error's debug message (see client_authentication.go in fosite).

func (*ClientManager) SetClientAssertionJWT

func (*ClientManager) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

SetClientAssertionJWT marks a JTI as known for the given expiry time. Before inserting the new JTI, it will clean up any existing JTIs that have expired as those tokens can not be replayed due to the expiry.

This functionality is not supported by the ClientManager.