oauth

Documentation

Overview

Package oauth contains rpc AuthHandler for oauth/oidc JWT tokens.

Index

• Constants
• func WithWebOAuthTokenAuthHandler(opts WebOAuthOptions) rpc.ServerOption
• type WebOAuthClaims
  • func (c *WebOAuthClaims) Entity() (string, error)
  • func (c *WebOAuthClaims) Subject() string
  • func (c *WebOAuthClaims) Valid() error
• type WebOAuthOptions

Constants

const (
	// CredentialsTypeOAuthWeb for jwt access tokens signed by oidc/oauth backend.
	CredentialsTypeOAuthWeb = rpc.CredentialsType("oauth-web-auth")
)

Functions

func WithWebOAuthTokenAuthHandler

func WithWebOAuthTokenAuthHandler(opts WebOAuthOptions) rpc.ServerOption

WithWebOAuthTokenAuthHandler returns a rpc server option configured for the AuthHandler. The WebAuth handler will validate jwt access tokens signed by OIDC provider. The jwts are validated for the aud standard claim.

This allows auth handler allows for a dynamic set of signing keys provided through OIDC configuration endpoint.

Entity verification is deleged to the EntityVerifier method in the options.

Types

type WebOAuthClaims

type WebOAuthClaims struct {
	rpc.JWTClaims
	// contains filtered or unexported fields
}

WebOAuthClaims is the claims struct used during WebOauth flows. Validates the audience matches one of the allowed audiences set.

func (*WebOAuthClaims) Entity

func (c *WebOAuthClaims) Entity() (string, error)

Entity returns the Viam Entity. This is the user's email and not always the subject of the JWTs. If rpc_auth_md.email is not set a error is returned.

func (*WebOAuthClaims) Subject

func (c *WebOAuthClaims) Subject() string

Subject returns the Viam Entity. This is the user's email and not always the subject of the JWTs. If not available falls back to the jwt's subject.

func (*WebOAuthClaims) Valid

func (c *WebOAuthClaims) Valid() error

Valid returns true if the audience matches one of the allowed audiences set and all other standard claims are valid.

type WebOAuthOptions

type WebOAuthOptions struct {
	// Audience claim that must be within the "aud" JWT claims presented.
	AllowedAudiences []string

	// Key provider used to provide public keys to validate the jwt basid on its "kid" header.
	KeyProvider jwks.KeyProvider

	// Underlying Entity verifier after
	EntityVerifier func(ctx context.Context, entity string) (interface{}, error)
	Logger         golog.Logger
}

WebOAuthOptions options for the WebOauth handler.