This repository has been archived on 2023-08-14. You can view files and clone it, but cannot push or open issues or pull requests.
dex/vendor/github.com/coreos/go-oidc
2016-11-22 13:29:17 -08:00
..
example vendor: revendor 2016-11-22 13:29:17 -08:00
http vendor: revendor 2016-11-22 13:29:17 -08:00
jose vendor: revendor 2016-11-22 13:29:17 -08:00
key vendor: revendor 2016-11-22 13:29:17 -08:00
oauth2 vendor: revendor 2016-11-22 13:29:17 -08:00
oidc vendor: revendor 2016-11-22 13:29:17 -08:00
.gitignore vendor: revendor 2016-11-22 13:29:17 -08:00
.travis.yml vendor: revendor 2016-11-22 13:29:17 -08:00
CONTRIBUTING.md vendor: revendor 2016-11-22 13:29:17 -08:00
DCO vendor: revendor 2016-11-22 13:29:17 -08:00
gen.go vendor: revendor 2016-11-22 13:29:17 -08:00
jose_test.go vendor: revendor 2016-11-22 13:29:17 -08:00
jose.go vendor: revendor 2016-11-22 13:29:17 -08:00
jwks_test.go vendor: revendor 2016-11-22 13:29:17 -08:00
jwks.go vendor: revendor 2016-11-22 13:29:17 -08:00
LICENSE vendor: revendor 2016-11-22 13:29:17 -08:00
MAINTAINERS vendor: revendor 2016-11-22 13:29:17 -08:00
NOTICE vendor: revendor 2016-11-22 13:29:17 -08:00
oidc_test.go vendor: revendor 2016-11-22 13:29:17 -08:00
oidc.go vendor: revendor 2016-11-22 13:29:17 -08:00
README.md vendor: revendor 2016-11-22 13:29:17 -08:00
test vendor: revendor 2016-11-22 13:29:17 -08:00
verify_test.go vendor: revendor 2016-11-22 13:29:17 -08:00
verify.go vendor: revendor 2016-11-22 13:29:17 -08:00

go-oidc

GoDoc Build Status

OpenID Connect support for Go

This package enables OpenID Connect support for the golang.org/x/oauth2 package.

provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
if err != nil {
    // handle error
}

// Configure an OpenID Connect aware OAuth2 client.
oauth2Config := oauth2.Config{
    ClientID:     clientID,
    ClientSecret: clientSecret,
    RedirectURL:  redirectURL,

    // Discovery returns the OAuth2 endpoints.
    Endpoint: provider.Endpoint(),

    // "openid" is a required scope for OpenID Connect flows.
    Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
}

OAuth2 redirects are unchanged.

func handleRedirect(w http.ResponseWriter, r *http.Request) {
    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
}

The on responses, the provider can be used to verify ID Tokens.

var verifier = provider.Verifier()

func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
    // Verify state and errors.

    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
    if err != nil {
        // handle error
    }

    // Extract the ID Token from OAuth2 token.
    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
    if !ok {
        // handle missing token
    }

    // Parse and verify ID Token payload.
    idToken, err := verifier.Verify(ctx, rawIDToken)
    if err != nil {
        // handle error
    }

    // Extract custom claims
    var claims struct {
        Email    string `json:"email"`
        Verified bool   `json:"email_verified"`
    }
    if err := idToken.Claims(&claims); err != nil {
        // handle error
    }
}