oidc

Dec 15, 2022

Changes in this version

+ type DynamicGlobalSecretConfig struct

+ func NewDynamicGlobalSecretConfig(fositeConfig *fosite.Config, keyFunc func() []byte) *DynamicGlobalSecretConfig

+ func (d *DynamicGlobalSecretConfig) GetAccessTokenLifespan(ctx context.Context) time.Duration

+ func (d *DynamicGlobalSecretConfig) GetAuthorizeCodeLifespan(ctx context.Context) time.Duration

+ func (d *DynamicGlobalSecretConfig) GetGlobalSecret(ctx context.Context) ([]byte, error)

+ func (d *DynamicGlobalSecretConfig) GetHMACHasher(ctx context.Context) func() hash.Hash

+ func (d *DynamicGlobalSecretConfig) GetRefreshTokenLifespan(ctx context.Context) time.Duration

+ func (d *DynamicGlobalSecretConfig) GetRotatedGlobalSecrets(ctx context.Context) ([][]byte, error)

+ func (d *DynamicGlobalSecretConfig) GetTokenEntropy(ctx context.Context) int

Sep 27, 2022

Changes in this version

type NullStorage

+ func NewNullStorage(secrets corev1client.SecretInterface, ...) *NullStorage

Jun 8, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

+ const PinnipedLoginPath

+ func FindUpstreamIDPByNameAndType(idpLister UpstreamIdentityProvidersLister, upstreamName string, ...) (provider.UpstreamOIDCIdentityProviderI, provider.UpstreamLDAPIdentityProviderI, ...)

+ func PerformAuthcodeRedirect(r *http.Request, w http.ResponseWriter, oauthHelper fosite.OAuth2Provider, ...)

+ func WriteAuthorizeError(w http.ResponseWriter, oauthHelper fosite.OAuth2Provider, ...)

type UpstreamStateParamData

+ UpstreamType string

+ func ReadStateParamAndValidateCSRFCookie(r *http.Request, cookieDecoder Decoder, stateDecoder Decoder) (string, *UpstreamStateParamData, error)

May 5, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Apr 19, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Mar 3, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Feb 9, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jan 21, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

type KubeStorage

+ func (k KubeStorage) RevokeRefreshTokenMaybeGracePeriod(ctx context.Context, requestID string, signature string) error

type NullStorage

+ func (NullStorage) RevokeRefreshTokenMaybeGracePeriod(_ context.Context, _ string, _ string) error

Feb 9, 2022 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Sep 16, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Aug 31, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

+ type UpstreamActiveDirectoryIdentityProviderLister interface

+ GetActiveDirectoryIdentityProviders func() []provider.UpstreamLDAPIdentityProviderI

Jul 30, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jun 14, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jun 3, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jun 1, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

+ const PinnipedIDPsPathV1Alpha1

+ type UpstreamIdentityProvidersLister interface

+ type UpstreamLDAPIdentityProvidersLister interface

+ GetLDAPIdentityProviders func() []provider.UpstreamLDAPIdentityProviderI

+ type UpstreamOIDCIdentityProvidersLister interface

+ GetOIDCIdentityProviders func() []provider.UpstreamOIDCIdentityProviderI

May 10, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Mar 31, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

type TokenExchangeHandler

+ func (t *TokenExchangeHandler) CanHandleTokenEndpointRequest(requester fosite.AccessRequester) bool

+ func (t *TokenExchangeHandler) CanSkipClientAuth(_ fosite.AccessRequester) bool

Feb 11, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Feb 4, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jul 8, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

May 25, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Apr 22, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jan 25, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Jan 15, 2021 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Dec 18, 2020 GO-2022-0981

  GO-2022-0981: Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev

Changes in this version

+ const CSRFCookieEncodingName

+ const CSRFCookieLifespan

+ const CSRFCookieName

+ const CallbackEndpointPath

+ const DownstreamGroupsClaim

+ const DownstreamUsernameClaim

+ const IDTokenIssuerClaim

+ const IDTokenSubjectClaim

+ const UpstreamStateParamEncodingName

+ const UpstreamStateParamFormatVersion

+ func FositeErrorForLog(err error) []interface

+ func FositeOauth2Helper(oauthStore interface{}, issuer string, ...) fosite.OAuth2Provider

+ func GrantScopeIfRequested(authorizeRequester fosite.AuthorizeRequester, scopeName string)

+ func PinnipedCLIOIDCClient() *fosite.DefaultOpenIDConnectClient

+ func ScopeWasRequested(authorizeRequester fosite.AuthorizeRequester, scopeName string) bool

+ func TokenExchangeFactory(config *compose.Config, storage interface{}, strategy interface{}) interface

+ type Codec interface

+ type Decoder interface

+ Decode func(name, value string, into interface{}) error

+ type Encoder interface

+ Encode func(name string, value interface{}) (string, error)

+ type IDPListGetter interface

+ GetIDPList func() []provider.UpstreamOIDCIdentityProviderI

+ type KubeStorage struct

+ func NewKubeStorage(secrets corev1client.SecretInterface, ...) *KubeStorage

+ func (KubeStorage) ClientAssertionJWTValid(_ context.Context, _ string) error

+ func (KubeStorage) GetClient(_ context.Context, id string) (fosite.Client, error)

+ func (KubeStorage) SetClientAssertionJWT(_ context.Context, _ string, _ time.Time) error

+ func (k KubeStorage) CreateAccessTokenSession(ctx context.Context, signatureOfAccessToken string, requester fosite.Requester) (err error)

+ func (k KubeStorage) CreateAuthorizeCodeSession(ctx context.Context, signatureOfAuthcode string, r fosite.Requester) (err error)

+ func (k KubeStorage) CreateOpenIDConnectSession(ctx context.Context, fullAuthcode string, requester fosite.Requester) error

+ func (k KubeStorage) CreatePKCERequestSession(ctx context.Context, signatureOfAuthcode string, requester fosite.Requester) error

+ func (k KubeStorage) CreateRefreshTokenSession(ctx context.Context, signatureOfRefreshToken string, request fosite.Requester) (err error)

+ func (k KubeStorage) DeleteAccessTokenSession(ctx context.Context, signatureOfAccessToken string) (err error)

+ func (k KubeStorage) DeleteOpenIDConnectSession(ctx context.Context, fullAuthcode string) error

+ func (k KubeStorage) DeletePKCERequestSession(ctx context.Context, signatureOfAuthcode string) error

+ func (k KubeStorage) DeleteRefreshTokenSession(ctx context.Context, signatureOfRefreshToken string) (err error)

+ func (k KubeStorage) GetAccessTokenSession(ctx context.Context, signatureOfAccessToken string, session fosite.Session) (request fosite.Requester, err error)

+ func (k KubeStorage) GetAuthorizeCodeSession(ctx context.Context, signatureOfAuthcode string, s fosite.Session) (request fosite.Requester, err error)

+ func (k KubeStorage) GetOpenIDConnectSession(ctx context.Context, fullAuthcode string, requester fosite.Requester) (fosite.Requester, error)

+ func (k KubeStorage) GetPKCERequestSession(ctx context.Context, signatureOfAuthcode string, session fosite.Session) (fosite.Requester, error)

+ func (k KubeStorage) GetRefreshTokenSession(ctx context.Context, signatureOfRefreshToken string, session fosite.Session) (request fosite.Requester, err error)

+ func (k KubeStorage) InvalidateAuthorizeCodeSession(ctx context.Context, signatureOfAuthcode string) (err error)

+ func (k KubeStorage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (k KubeStorage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ type NullStorage struct

+ func (NullStorage) ClientAssertionJWTValid(_ context.Context, _ string) error

+ func (NullStorage) CreateAccessTokenSession(_ context.Context, _ string, _ fosite.Requester) (err error)

+ func (NullStorage) CreateAuthorizeCodeSession(_ context.Context, _ string, _ fosite.Requester) (err error)

+ func (NullStorage) CreateOpenIDConnectSession(_ context.Context, _ string, _ fosite.Requester) error

+ func (NullStorage) CreatePKCERequestSession(_ context.Context, _ string, _ fosite.Requester) error

+ func (NullStorage) CreateRefreshTokenSession(_ context.Context, _ string, _ fosite.Requester) (err error)

+ func (NullStorage) DeleteAccessTokenSession(_ context.Context, _ string) (err error)

+ func (NullStorage) DeleteOpenIDConnectSession(_ context.Context, _ string) error

+ func (NullStorage) DeletePKCERequestSession(_ context.Context, _ string) error

+ func (NullStorage) DeleteRefreshTokenSession(_ context.Context, _ string) (err error)

+ func (NullStorage) GetAccessTokenSession(_ context.Context, _ string, _ fosite.Session) (request fosite.Requester, err error)

+ func (NullStorage) GetAuthorizeCodeSession(_ context.Context, _ string, _ fosite.Session) (request fosite.Requester, err error)

+ func (NullStorage) GetClient(_ context.Context, id string) (fosite.Client, error)

+ func (NullStorage) GetOpenIDConnectSession(_ context.Context, _ string, _ fosite.Requester) (fosite.Requester, error)

+ func (NullStorage) GetPKCERequestSession(_ context.Context, _ string, _ fosite.Session) (fosite.Requester, error)

+ func (NullStorage) GetRefreshTokenSession(_ context.Context, _ string, _ fosite.Session) (request fosite.Requester, err error)

+ func (NullStorage) InvalidateAuthorizeCodeSession(_ context.Context, _ string) (err error)

+ func (NullStorage) RevokeAccessToken(_ context.Context, _ string) error

+ func (NullStorage) RevokeRefreshToken(_ context.Context, _ string) error

+ func (NullStorage) SetClientAssertionJWT(_ context.Context, _ string, _ time.Time) error

+ type TimeoutsConfiguration struct

+ AccessTokenLifespan time.Duration

+ AccessTokenSessionStorageLifetime time.Duration

+ AuthorizationCodeSessionStorageLifetime time.Duration

+ AuthorizeCodeLifespan time.Duration

+ IDTokenLifespan time.Duration

+ OIDCSessionStorageLifetime time.Duration

+ PKCESessionStorageLifetime time.Duration

+ RefreshTokenLifespan time.Duration

+ RefreshTokenSessionStorageLifetime time.Duration

+ UpstreamStateParamLifespan time.Duration

+ func DefaultOIDCTimeoutsConfiguration() TimeoutsConfiguration

+ type TokenExchangeHandler struct

+ func (t *TokenExchangeHandler) HandleTokenEndpointRequest(ctx context.Context, requester fosite.AccessRequester) error

+ func (t *TokenExchangeHandler) PopulateTokenEndpointResponse(ctx context.Context, requester fosite.AccessRequester, ...) error

+ type UpstreamStateParamData struct

+ AuthParams string

+ CSRFToken csrftoken.CSRFToken

+ FormatVersion string

+ Nonce nonce.Nonce

+ PKCECode pkce.Code

+ UpstreamName string

Nov 3, 2020

Changes in this version

+ const AuthorizationEndpointPath

+ const JWKSEndpointPath

+ const TokenEndpointPath

+ const WellKnownEndpointPath