Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security Policy
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

oidc

package

Go to main page

Versions in this module

v0

v0.6.0

Mar 28, 2024

v0.5.0

Feb 6, 2024

v0.4.1

Dec 21, 2023

v0.4.0

Sep 22, 2023

v0.3.4

Jul 27, 2023

v0.3.3

Jul 21, 2023

v0.3.2

Jul 14, 2023

v0.3.1

Jun 6, 2023

v0.3.0

Apr 20, 2023

Changes in this version

type Config

+ ProviderConfig *ProviderConfig

type Option

+ func WithProviderConfig(cfg *ProviderConfig) Option

+ type ProviderConfig struct

+ AuthURL string

+ JWKSURL string

+ TokenURL string

+ UserInfoURL string

v0.2.0

Apr 8, 2022

v0.1.1

Jun 24, 2021

v0.1.0

May 21, 2021

Changes in this version

+ const DefaultIDLength

+ const RedactedAccessToken

+ const RedactedClientSecret

+ const RedactedIDToken

+ const RedactedRefreshToken

+ const RequestExpirySkew

+ const TokenExpirySkew

+ var ErrExpiredAuthTime = errors.New("expired auth_time")

+ var ErrExpiredRequest = errors.New("request is expired")

+ var ErrExpiredToken = errors.New("token is expired")

+ var ErrIDGeneratorFailed = errors.New("id generation failed")

+ var ErrIDTokenVerificationFailed = errors.New("id_token verification failed")

+ var ErrInvalidAtHash = errors.New("access_token hash does not match value in id_token")

+ var ErrInvalidAudience = errors.New("invalid audience")

+ var ErrInvalidAuthorizedParty = errors.New("invalid authorized party (azp)")

+ var ErrInvalidCACert = errors.New("invalid CA certificate")

+ var ErrInvalidCodeHash = errors.New("authorization code hash does not match value in id_token")

+ var ErrInvalidFlow = errors.New("invalid OIDC flow")

+ var ErrInvalidIssuedAt = errors.New("invalid issued at (iat)")

+ var ErrInvalidIssuer = errors.New("invalid issuer")

+ var ErrInvalidJWKs = errors.New("invalid jwks")

+ var ErrInvalidNonce = errors.New("invalid nonce")

+ var ErrInvalidNotBefore = errors.New("invalid not before")

+ var ErrInvalidParameter = errors.New("invalid parameter")

+ var ErrInvalidResponseState = errors.New("invalid response state")

+ var ErrInvalidSignature = errors.New("invalid signature")

+ var ErrInvalidSubject = errors.New("invalid subject")

+ var ErrLoginFailed = errors.New("login failed")

+ var ErrMalformedToken = errors.New("token malformed")

+ var ErrMissingAccessToken = errors.New("access_token is missing")

+ var ErrMissingClaim = errors.New("missing required claim")

+ var ErrMissingIDToken = errors.New("id_token is missing")

+ var ErrNilParameter = errors.New("nil parameter")

+ var ErrNotFound = errors.New("not found")

+ var ErrTokenNotSigned = errors.New("token is not signed")

+ var ErrUnauthorizedRedirectURI = errors.New("unauthorized redirect_uri")

+ var ErrUnsupportedAlg = errors.New("unsupported signing algorithm")

+ var ErrUnsupportedChallengeMethod = errors.New("unsupported PKCE challenge method")

+ var ErrUserInfoFailed = errors.New("user info failed")

+ func ApplyOpts(opts interface{}, opt ...Option)

+ func CreateCodeChallenge(v CodeVerifier) (string, error)

+ func EncodeCertificates(certs ...*x509.Certificate) (string, error)

+ func NewID(opt ...Option) (string, error)

+ func TestGenerateCA(t *testing.T, hosts []string) (*x509.Certificate, string)

+ func TestGenerateKeys(t *testing.T) (crypto.PublicKey, crypto.PrivateKey)

+ func TestSignJWT(t TestingT, key crypto.PrivateKey, alg string, claims interface{}, ...) string

+ func UnmarshalClaims(rawToken string, claims interface{}) error

+ type AccessToken string

+ func (t AccessToken) MarshalJSON() ([]byte, error)

+ func (t AccessToken) String() string

+ type Alg string

+ const ES256

+ const ES384

+ const ES512

+ const EdDSA

+ const PS256

+ const PS384

+ const PS512

+ const RS256

+ const RS384

+ const RS512

+ type ChallengeMethod string

+ const S256

+ type CleanupT interface

+ Cleanup func(func())

+ type ClientSecret string

+ func (t ClientSecret) MarshalJSON() ([]byte, error)

+ func (t ClientSecret) String() string

+ type CodeVerifier interface

+ Challenge func() string

+ Copy func() CodeVerifier

+ Method func() ChallengeMethod

+ Verifier func() string

+ type Config struct

+ AllowedRedirectURLs []string

+ Audiences []string

+ ClientID string

+ ClientSecret ClientSecret

+ Issuer string

+ NowFunc func() time.Time

+ ProviderCA string

+ Scopes []string

+ SupportedSigningAlgs []Alg

+ func NewConfig(issuer string, clientID string, clientSecret ClientSecret, supported []Alg, ...) (*Config, error)

+ func (c *Config) Hash() (uint64, error)

+ func (c *Config) Now() time.Time

+ func (c *Config) Validate() error

+ type DiscoveryInfo struct

+ AcrValuesSupported []string

+ AuthURL string

+ ClaimsParameterSupported bool

+ ClaimsSupported []string

+ DisplayValuesSupported []string

+ GrantTypesSupported []string

+ IdTokenSigningAlgsSupported []string

+ Issuer string

+ JWKSURL string

+ ScopesSupported []string

+ TokenURL string

+ UILocalesSupported []string

+ UserInfoURL string

+ type Display string

+ const Page

+ const Popup

+ const Touch

+ const WAP

+ type HelperT interface

+ Helper func()

+ type IDToken string

+ func (t IDToken) Claims(claims interface{}) error

+ func (t IDToken) MarshalJSON() ([]byte, error)

+ func (t IDToken) String() string

+ func (t IDToken) VerifyAccessToken(accessToken AccessToken) (bool, error)

+ func (t IDToken) VerifyAuthorizationCode(code string) (bool, error)

+ type InfofT interface

+ Infof func(format string, args ...interface{})

+ type Option func(interface{})

+ func WithACRValues(values ...string) Option

+ func WithAudiences(auds ...string) Option

+ func WithClaims(json []byte) Option

+ func WithDisplay(d Display) Option

+ func WithImplicitFlow(args ...interface{}) Option

+ func WithMaxAge(seconds uint) Option

+ func WithNoTLS() Option

+ func WithNonce(n string) Option

+ func WithNow(now func() time.Time) Option

+ func WithPKCE(v CodeVerifier) Option

+ func WithPrefix(prefix string) Option

+ func WithPrompts(prompts ...Prompt) Option

+ func WithProviderCA(cert string) Option

+ func WithScopes(scopes ...string) Option

+ func WithState(s string) Option

+ func WithTestDefaults(defaults *TestProviderDefaults) Option

+ func WithTestHost(host string) Option

+ func WithTestPort(port int) Option

+ func WithUILocales(locales ...language.Tag) Option

+ type Prompt string

+ const Consent

+ const Login

+ const None

+ const SelectAccount

+ type Provider struct

+ func NewProvider(c *Config) (*Provider, error)

+ func (p *Provider) AuthURL(ctx context.Context, oidcRequest Request) (url string, e error)

+ func (p *Provider) ConfigHash() (uint64, error)

+ func (p *Provider) DiscoveryInfo(ctx context.Context) (*DiscoveryInfo, error)

+ func (p *Provider) Done()

+ func (p *Provider) Exchange(ctx context.Context, oidcRequest Request, authorizationState string, ...) (*Tk, error)

+ func (p *Provider) HTTPClient() (*http.Client, error)

+ func (p *Provider) HTTPClientContext(ctx context.Context) (context.Context, error)

+ func (p *Provider) UserInfo(ctx context.Context, tokenSource oauth2.TokenSource, validSubject string, ...) error

+ func (p *Provider) VerifyIDToken(ctx context.Context, t IDToken, oidcRequest Request, opt ...Option) (map[string]interface{}, error)

+ type RefreshToken string

+ func (t RefreshToken) MarshalJSON() ([]byte, error)

+ func (t RefreshToken) String() string

+ type Req struct

+ func NewRequest(expireIn time.Duration, redirectURL string, opt ...Option) (*Req, error)

+ func (r *Req) ACRValues() []string

+ func (r *Req) Audiences() []string

+ func (r *Req) Claims() []byte

+ func (r *Req) Display() Display

+ func (r *Req) ImplicitFlow() (bool, bool)

+ func (r *Req) IsExpired() bool

+ func (r *Req) MaxAge() (uint, time.Time)

+ func (r *Req) Nonce() string

+ func (r *Req) PKCEVerifier() CodeVerifier

+ func (r *Req) Prompts() []Prompt

+ func (r *Req) RedirectURL() string

+ func (r *Req) Scopes() []string

+ func (r *Req) State() string

+ func (r *Req) UILocales() []language.Tag

+ type Request interface

+ ACRValues func() []string

+ Audiences func() []string

+ Claims func() []byte

+ Display func() Display

+ ImplicitFlow func() (useImplicitFlow bool, includeAccessToken bool)

+ IsExpired func() bool

+ MaxAge func() (seconds uint, authAfter time.Time)

+ Nonce func() string

+ PKCEVerifier func() CodeVerifier

+ Prompts func() []Prompt

+ RedirectURL func() string

+ Scopes func() []string

+ State func() string

+ UILocales func() []language.Tag

+ type S256Verifier struct

+ func NewCodeVerifier() (*S256Verifier, error)

+ func (v *S256Verifier) Challenge() string

+ func (v *S256Verifier) Copy() CodeVerifier

+ func (v *S256Verifier) Method() ChallengeMethod

+ func (v *S256Verifier) Verifier() string

+ type StaticTokenSource interface

+ StaticTokenSource func() oauth2.TokenSource

+ type TestProvider struct

+ func StartTestProvider(t TestingT, opt ...Option) *TestProvider

+ func (p *TestProvider) Addr() string

+ func (p *TestProvider) CACert() string

+ func (p *TestProvider) ClientCreds() (clientID, clientSecret string)

+ func (p *TestProvider) ExpectedSubject() string

+ func (p *TestProvider) HTTPClient() *http.Client

+ func (p *TestProvider) PKCEVerifier() CodeVerifier

+ func (p *TestProvider) ServeHTTP(w http.ResponseWriter, req *http.Request)

+ func (p *TestProvider) SetAllowedRedirectURIs(uris []string)

+ func (p *TestProvider) SetClientCreds(clientID, clientSecret string)

+ func (p *TestProvider) SetCustomAudience(customAudiences ...string)

+ func (p *TestProvider) SetCustomClaims(customClaims map[string]interface{})

+ func (p *TestProvider) SetDisableImplicit(disable bool)

+ func (p *TestProvider) SetDisableJWKs(disable bool)

+ func (p *TestProvider) SetDisableToken(disable bool)

+ func (p *TestProvider) SetDisableUserInfo(disable bool)

+ func (p *TestProvider) SetExpectedAuthCode(code string)

+ func (p *TestProvider) SetExpectedAuthNonce(nonce string)

+ func (p *TestProvider) SetExpectedExpiry(exp time.Duration)

+ func (p *TestProvider) SetExpectedState(s string)

+ func (p *TestProvider) SetExpectedSubject(sub string)

+ func (p *TestProvider) SetInvalidJWKS(invalid bool)

+ func (p *TestProvider) SetNowFunc(n func() time.Time)

+ func (p *TestProvider) SetOmitAccessTokens(omitAccessTokens bool)

+ func (p *TestProvider) SetOmitAuthTimeClaim(omitAuthTime bool)

+ func (p *TestProvider) SetOmitIDTokens(omitIDTokens bool)

+ func (p *TestProvider) SetPKCEVerifier(verifier CodeVerifier)

+ func (p *TestProvider) SetSigningKeys(privKey crypto.PrivateKey, pubKey crypto.PublicKey, alg Alg, KeyID string)

+ func (p *TestProvider) SetSubjectInfo(subjectInfo map[string]*TestSubject)

+ func (p *TestProvider) SetSupportedScopes(scope ...string)

+ func (p *TestProvider) SetUserInfoReply(resp map[string]interface{})

+ func (p *TestProvider) SigningKeys() (crypto.PrivateKey, crypto.PublicKey, Alg, string)

+ func (p *TestProvider) Stop()

+ func (p *TestProvider) SubjectInfo() map[string]*TestSubject

+ func (p *TestProvider) SupportedScopes() []string

+ func (p *TestProvider) UserInfoReply() map[string]interface{}

+ type TestProviderDefaults struct

+ AllowedRedirectURIs []string

+ ClientID *string

+ ClientSecret *string

+ CustomAudiences []string

+ CustomClaims map[string]interface{}

+ DisableImplicitFlow bool

+ DisableJWKs bool

+ DisableTokenEndpoint bool

+ DisableUserInfo bool

+ ExpectedCode *string

+ ExpectedNonce *string

+ ExpectedState *string

+ ExpectedSubject *string

+ Expiry *time.Duration

+ InvalidJWKS bool

+ NowFunc func() time.Time

+ OmitAccessTokens bool

+ OmitAuthTime bool

+ OmitIDTokens bool

+ PKCEVerifier CodeVerifier

+ SigningKey *TestSigningKey

+ SubjectInfo map[string]*TestSubject

+ SupportedScopes []string

+ UserInfoReply map[string]interface{}

+ type TestSigningKey struct

+ Alg Alg

+ PrivKey crypto.PrivateKey

+ PubKey crypto.PublicKey

+ type TestSubject struct

+ CustomClaims map[string]interface{}

+ Password string

+ UserInfo map[string]interface{}

+ type TestingLogger struct

+ Logger hclog.Logger

+ func NewTestingLogger(logger hclog.Logger) (*TestingLogger, error)

+ func (l *TestingLogger) Errorf(format string, args ...interface{})

+ func (l *TestingLogger) FailNow()

+ func (l *TestingLogger) Infof(format string, args ...interface{})

+ type TestingT interface

+ Errorf func(format string, args ...interface{})

+ FailNow func()

+ type Tk struct

+ func NewToken(i IDToken, t *oauth2.Token, opt ...Option) (*Tk, error)

+ func (t *Tk) AccessToken() AccessToken

+ func (t *Tk) Expiry() time.Time

+ func (t *Tk) IDToken() IDToken

+ func (t *Tk) IsExpired() bool

+ func (t *Tk) RefreshToken() RefreshToken

+ func (t *Tk) StaticTokenSource() oauth2.TokenSource

+ func (t *Tk) Valid() bool

+ type Token interface

+ AccessToken func() AccessToken

+ Expiry func() time.Time

+ IDToken func() IDToken

+ IsExpired func() bool

+ RefreshToken func() RefreshToken

+ Valid func() bool