oauth2

package module
v0.0.0-...-4365cb6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 17, 2015 License: BSD-3-Clause Imports: 12 Imported by: 0

README

OAuth2 for Go

This package is a fork of the original oauth2 package to support the Microsoft Sharepoint OAuth implementation.

See https://github.com/golang/oauth2 for the original package.

Installation

go get github.com/davrux/oauth2

Usage

import "github.com/davrux/oauth2"

var sharepointConf = &oauth2.Config{
    ClientID:     "client id",
    ClientSecret: "secret key",
    Scopes: []string{
	    "Web.Read",
	    "Web.Write",
	    "Web.Manage",
	    "List.Read",
	    "List.Write",
	    "List.Manage",
	    "AllSites.Read",
	    "AllSites.Write",
	    "AllSites.Manage",
    },
    RedirectURL: "https://localhost/authorize",
    Host:        "mysite.sharepoint.com",
}

// request Sharepoint realm
err := sharepointConf.QuerySharepointRealm()
if err != nil {
    ...
}

// set auth endpoints depending on site and realm
sharepointConf.Endpoint = oauth2.SharepointOnlineEndpoint(sharepointConf.Host, sharepointConf.Realm)

// Generate URL for OAuth. Let the user visit the site
signinURL := sharepointConf.AuthCodeURL("state", oauth2.ApprovalForce)

...

// In the handler for redirect URL
tok, err := sharepointConf.ExchangeWithRealm(oauth2.NoContext, code)
if err != nil {
    ...
}

client := sharepointConf.Client(oauth2.NoContext, tok)
resp, err := client.Get(...)

Register Sharepoint App

To register a Sharepoint App go to https://your_site_name.com/_layouts/15/appregnew.aspx.

Documentation

Overview

Package oauth2 provides support for making OAuth2 authorized and authenticated HTTP requests. It can additionally grant authorization with Bearer JWT.

Index

Examples

Constants

This section is empty.

Variables

View Source 
var HTTPClient internal.ContextKey

HTTPClient is the context key to use with golang.org/x/net/context's WithValue function to associate an *http.Client value with a context.

View Source 
var NoContext = context.TODO()

NoContext is the default context you should supply if not using your own context.Context (see https://golang.ir/x/net/context).

Functions

func NewClient 

func NewClient(ctx context.Context, src TokenSource) *http.Client

NewClient creates an *http.Client from a Context and TokenSource. The returned client is not valid beyond the lifetime of the context.

As a special case, if src is nil, a non-OAuth2 client is returned using the provided context. This exists to support related OAuth2 packages.

func RegisterBrokenAuthHeaderProvider 

func RegisterBrokenAuthHeaderProvider(tokenURL string)

RegisterBrokenAuthHeaderProvider registers an OAuth2 server identified by the tokenURL prefix as an OAuth2 implementation which doesn't support the HTTP Basic authentication scheme to authenticate with the authorization server. Once a server is registered, credentials (client_id and client_secret) will be passed as query parameters rather than being present in the Authorization header. See https://code.google.com/p/goauth2/issues/detail?id=31 for background.

Types

type AuthCodeOption 

type AuthCodeOption interface {
	// contains filtered or unexported methods
}

An AuthCodeOption is passed to Config.AuthCodeURL. 

var (
	// AccessTypeOnline and AccessTypeOffline are options passed
	// to the Options.AuthCodeURL method. They modify the
	// "access_type" field that gets sent in the URL returned by
	// AuthCodeURL.
	//
	// Online is the default if neither is specified. If your
	// application needs to refresh access tokens when the user
	// is not present at the browser, then use offline. This will
	// result in your application obtaining a refresh token the
	// first time your application exchanges an authorization
	// code for a user.
	AccessTypeOnline  AuthCodeOption = SetAuthURLParam("access_type", "online")
	AccessTypeOffline AuthCodeOption = SetAuthURLParam("access_type", "offline")

	// ApprovalForce forces the users to view the consent dialog
	// and confirm the permissions request at the URL returned
	// from AuthCodeURL, even if they've already done so.
	ApprovalForce AuthCodeOption = SetAuthURLParam("approval_prompt", "force")
)

func SetAuthURLParam 

func SetAuthURLParam(key, value string) AuthCodeOption

SetAuthURLParam builds an AuthCodeOption which passes key/value parameters to a provider's authorization endpoint.

type Config 

type Config struct {
	// ClientID is the application's ID.
	ClientID string

	// ClientSecret is the application's secret.
	ClientSecret string

	// Endpoint contains the resource server's token endpoint
	// URLs. These are constants specific to each server and are
	// often available via site-specific packages, such as
	// google.Endpoint or github.Endpoint.
	Endpoint Endpoint

	// RedirectURL is the URL to redirect users going through
	// the OAuth flow, after the resource owner's URLs.
	RedirectURL string

	// Scope specifies optional requested permissions.
	Scopes []string

	// Realm is the realm of the Sharepoint site.
	//
	// To retrieve it do a GET request:
	// https://mysite.sharepoint.com/_vti_bin/client.svc/ with header
	// "Authorization: Bearer"
	// The returned "WWW-Authenticate" header contains:
	// Bearer realm="realm UUID"
	Realm string

	// Host is Sharepoint site
	Host string

	// AppCtxSender is the sender of the token.
	// ACS	      00000001-0000-0000-c000-000000000000
	// Exchange   00000002-0000-0ff1-ce00-000000000000
	// SharePoint 00000003-0000-0ff1-ce00-000000000000
	// Lync	      00000004-0000-0ff1-ce00-000000000000
	// Workflow   00000005-0000-0000-c000-000000000000
	AppCtxSender string
}

Config describes a typical 3-legged OAuth2 flow, with both the client application information and the server's endpoint URLs.

Example 
package main

import (
	"fmt"
	"log"

	"github.com/davrux/oauth2"
)

func main() {
	conf := &oauth2.Config{
		ClientID:     "YOUR_CLIENT_ID",
		ClientSecret: "YOUR_CLIENT_SECRET",
		Scopes:       []string{"SCOPE1", "SCOPE2"},
		Endpoint: oauth2.Endpoint{
			AuthURL:  "https://provider.com/o/oauth2/auth",
			TokenURL: "https://provider.com/o/oauth2/token",
		},
	}

	// Redirect user to consent page to ask for permission
	// for the scopes specified above.
	url := conf.AuthCodeURL("state", oauth2.AccessTypeOffline)
	fmt.Printf("Visit the URL for the auth dialog: %v", url)

	// Use the authorization code that is pushed to the redirect URL.
	// NewTransportWithCode will do the handshake to retrieve
	// an access token and initiate a Transport that is
	// authorized and authenticated by the retrieved token.
	var code string
	if _, err := fmt.Scan(&code); err != nil {
		log.Fatal(err)
	}
	tok, err := conf.Exchange(oauth2.NoContext, code)
	if err != nil {
		log.Fatal(err)
	}

	client := conf.Client(oauth2.NoContext, tok)
	client.Get("...")
}

Output:

func (*Config) AuthCodeURL 

func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string

AuthCodeURL returns a URL to OAuth 2.0 provider's consent page that asks for permissions for the required scopes explicitly.

State is a token to protect the user from CSRF attacks. You must always provide a non-zero string and validate that it matches the the state query parameter on your redirect callback. See http://tools.ietf.org/html/rfc6749#section-10.12 for more info.

Opts may include AccessTypeOnline or AccessTypeOffline, as well as ApprovalForce.

func (*Config) Client 

func (c *Config) Client(ctx context.Context, t *Token) *http.Client

Client returns an HTTP client using the provided token. The token will auto-refresh as necessary. The underlying HTTP transport will be obtained using the provided context. The returned client and its Transport should not be modified.

func (*Config) ClientAtRealm 

func (c *Config) ClientAtRealm() string

ClientAtRealm returns the ClientID@Realm needed in Sharepoint OAuth requests.

func (*Config) Exchange 

func (c *Config) Exchange(ctx context.Context, code string) (*Token, error)

Exchange converts an authorization code into a token.

It is used after a resource provider redirects the user back to the Redirect URI (the URL obtained from AuthCodeURL).

The HTTP client to use is derived from the context. If a client is not provided via the context, http.DefaultClient is used.

The code will be in the *http.Request.FormValue("code"). Before calling Exchange, be sure to validate FormValue("state").

func (*Config) ExchangeWithRealm 

func (c *Config) ExchangeWithRealm(ctx context.Context, code string) (*Token, error)

ExchangeWithRealm converts an authorization code into a token. This Version is like Exchange, but adds all needed params for Sharepoint.

It is used after a resource provider redirects the user back to the Redirect URI (the URL obtained from AuthCodeURL).

The HTTP client to use is derived from the context. If a client is not provided via the context, http.DefaultClient is used.

The code will be in the *http.Request.FormValue("code"). Before calling Exchange, be sure to validate FormValue("state").

func (*Config) HostAuthUrl 

func (c *Config) HostAuthUrl() string

HostAuthUrl returns the default auth URL. For example: https://site/_layouts/15/OAuthAuthorize.aspx

func (*Config) PasswordCredentialsToken 

func (c *Config) PasswordCredentialsToken(ctx context.Context, username, password string) (*Token, error)

PasswordCredentialsToken converts a resource owner username and password pair into a token.

Per the RFC, this grant type should only be used "when there is a high degree of trust between the resource owner and the client (e.g., the client is part of the device operating system or a highly privileged application), and when other authorization grant types are not available." See https://tools.ietf.org/html/rfc6749#section-4.3 for more info.

The HTTP client to use is derived from the context. If nil, http.DefaultClient is used.

func (*Config) QuerySharepointRealm 

func (c *Config) QuerySharepointRealm() error

QuerySharepointRealm queries a Sharepoint server for realm and AppCtxSender.

func (*Config) TokenSource 

func (c *Config) TokenSource(ctx context.Context, t *Token) TokenSource

TokenSource returns a TokenSource that returns t until t expires, automatically refreshing it as necessary using the provided context.

Most users will use Config.Client instead.

type Endpoint 

type Endpoint struct {
	AuthURL  string
	TokenURL string
}

Endpoint contains the OAuth 2.0 provider's authorization and token endpoint URLs.

func SharepointOnlineEndpoint 

func SharepointOnlineEndpoint(site, realm string) Endpoint

SharepointOnlineEndpoint returns the Endpoints for a Sharepoint online site.

type Token 

type Token struct {
	// AccessToken is the token that authorizes and authenticates
	// the requests.
	AccessToken string `json:"access_token"`

	// TokenType is the type of token.
	// The Type method returns either this or "Bearer", the default.
	TokenType string `json:"token_type,omitempty"`

	// RefreshToken is a token that's used by the application
	// (as opposed to the user) to refresh the access token
	// if it expires.
	RefreshToken string `json:"refresh_token,omitempty"`

	// Expiry is the optional expiration time of the access token.
	//
	// If zero, TokenSource implementations will reuse the same
	// token forever and RefreshToken or equivalent
	// mechanisms for that TokenSource will not be used.
	Expiry time.Time `json:"expiry,omitempty"`
	// contains filtered or unexported fields
}

Token represents the crendentials used to authorize the requests to access protected resources on the OAuth 2.0 provider's backend.

Most users of this package should not access fields of Token directly. They're exported mostly for use by related packages implementing derivative OAuth2 flows.

func (*Token) Extra 

func (t *Token) Extra(key string) interface{}

Extra returns an extra field. Extra fields are key-value pairs returned by the server as a part of the token retrieval response.

func (*Token) SetAuthHeader 

func (t *Token) SetAuthHeader(r *http.Request)

SetAuthHeader sets the Authorization header to r using the access token in t.

This method is unnecessary when using Transport or an HTTP Client returned by this package.

func (*Token) Type 

func (t *Token) Type() string

Type returns t.TokenType if non-empty, else "Bearer".

func (*Token) Valid 

func (t *Token) Valid() bool

Valid reports whether t is non-nil, has an AccessToken, and is not expired.

func (*Token) WithExtra 

func (t *Token) WithExtra(extra interface{}) *Token

WithExtra returns a new Token that's a clone of t, but using the provided raw extra map. This is only intended for use by packages implementing derivative OAuth2 flows.

type TokenSource 

type TokenSource interface {
	// Token returns a token or an error.
	// Token must be safe for concurrent use by multiple goroutines.
	// The returned Token must not be modified.
	Token() (*Token, error)
}

A TokenSource is anything that can return a token.

func ReuseTokenSource 

func ReuseTokenSource(t *Token, src TokenSource) TokenSource

ReuseTokenSource returns a TokenSource which repeatedly returns the same token as long as it's valid, starting with t. When its cached token is invalid, a new token is obtained from src.

ReuseTokenSource is typically used to reuse tokens from a cache (such as a file on disk) between runs of a program, rather than obtaining new tokens unnecessarily.

The initial token t may be nil, in which case the TokenSource is wrapped in a caching version if it isn't one already. This also means it's always safe to wrap ReuseTokenSource around any other TokenSource without adverse effects.

func StaticTokenSource 

func StaticTokenSource(t *Token) TokenSource

StaticTokenSource returns a TokenSource that always returns the same token. Because the provided token t is never refreshed, StaticTokenSource is only useful for tokens that never expire.

type Transport 

type Transport struct {
	// Source supplies the token to add to outgoing requests'
	// Authorization headers.
	Source TokenSource

	// Base is the base RoundTripper used to make HTTP requests.
	// If nil, http.DefaultTransport is used.
	Base http.RoundTripper
	// contains filtered or unexported fields
}

Transport is an http.RoundTripper that makes OAuth 2.0 HTTP requests, wrapping a base RoundTripper and adding an Authorization header with a token from the supplied Sources.

Transport is a low-level mechanism. Most code will use the higher-level Config.Client method instead.

func (*Transport) CancelRequest 

func (t *Transport) CancelRequest(req *http.Request)

CancelRequest cancels an in-flight request by closing its connection.

func (*Transport) RoundTrip 

func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error)

RoundTrip authorizes and authenticates the request with an access token. If no token exists or token is expired, tries to refresh/fetch a new token.

Source Files

View all Source files

Directories

Path Synopsis
Package bitbucket provides constants for using OAuth2 to access Bitbucket.
 Package bitbucket provides constants for using OAuth2 to access Bitbucket.
Package clientcredentials implements the OAuth2.0 "client credentials" token flow, also known as the "two-legged OAuth 2.0".
 Package clientcredentials implements the OAuth2.0 "client credentials" token flow, also known as the "two-legged OAuth 2.0".
Package facebook provides constants for using OAuth2 to access Facebook.
 Package facebook provides constants for using OAuth2 to access Facebook.
Package github provides constants for using OAuth2 to access Github.
 Package github provides constants for using OAuth2 to access Github.
Package google provides support for making OAuth2 authorized and authenticated HTTP requests to Google APIs.
 Package google provides support for making OAuth2 authorized and authenticated HTTP requests to Google APIs.
Package internal contains support packages for oauth2 package.
 Package internal contains support packages for oauth2 package.
Package jws provides encoding and decoding utilities for signed JWS messages.
 Package jws provides encoding and decoding utilities for signed JWS messages.
Package jwt implements the OAuth 2.0 JSON Web Token flow, commonly known as "two-legged OAuth 2.0".
 Package jwt implements the OAuth 2.0 JSON Web Token flow, commonly known as "two-legged OAuth 2.0".
Package linkedin provides constants for using OAuth2 to access LinkedIn.
 Package linkedin provides constants for using OAuth2 to access LinkedIn.
Package odnoklassniki provides constants for using OAuth2 to access Odnoklassniki.
 Package odnoklassniki provides constants for using OAuth2 to access Odnoklassniki.
Package paypal provides constants for using OAuth2 to access PayPal.
 Package paypal provides constants for using OAuth2 to access PayPal.
Package vk provides constants for using OAuth2 to access VK.com.
 Package vk provides constants for using OAuth2 to access VK.com.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.