oauth2

type AccessResponse ¶

type AccessResponse struct {
	AccessToken  string
	TokenType    string
	ExpiresIn    int64
	RefreshToken string
	Info         map[string]interface{}
}

AccessResponse holds a valid and authorized access response.

func (r *AccessResponse) ToMap() map[string]interface{}

func (r *AccessResponse) ToValues() url.Values

type AuthorizeGrantType ¶

type AuthorizeGrantType interface {
	GrantType
	ResponseName() string
	Respond(w http.ResponseWriter, req *http.Request, reqParams url.Values, client Client, redirectURI, state string)
}

AuthorizeGrantType is a grant type on the /authorize endpoint.

type Client ¶

type Client interface {
	Identifier() string
	IsAllowedRedirectURI(uri string) bool
	IsAllowedGrantType(identifier string) bool
	IsConfidential() bool
	Authenticate(secret string) bool
}

Client is a oauth2 client:

An application making protected resource requests on behalf of the resource owner and with its authorization. The term "client" does not imply any particular implementation characteristics (e.g., whether the application executes on a server, a desktop, or other devices).

https://tools.ietf.org/html/rfc6749#section-1.1

type ClientGrantTypeService ¶

type ClientGrantTypeService interface {
	ClientGrantTypeResponse(ctx context.Context, client Client) (*AccessResponse, error)
}

ClientGrantTypeService returns an access response, if the access token request is valid and authorized.

The authorization server MUST authenticate the client.

A refresh token SHOULD NOT be included.

https://tools.ietf.org/html/rfc6749#section-4.4.2

type GrantType ¶

type GrantType interface {
	Identifier() string
}

GrantType is a oauth2 grant type.

func NewClientGrantType(logger Log, service ClientGrantTypeService) GrantType

func NewImplicitGrantType(logger Log, service ImplicitGrantTypeService) GrantType

func NewPasswordGrantType(logger Log, service PasswordGrantTypeService) GrantType

func NewRefreshGrantType(logger Log, service RefreshGrantTypeService) GrantType

type Handler ¶

type Handler struct {
	// contains filtered or unexported fields
}

Handler provides the oauth2 protocol endpoints:

The authorization process utilizes two authorization server endpoints (HTTP resources):

o Authorization endpoint - used by the client to obtain authorization from the resource owner via user-agent redirection.

o Token endpoint - used by the client to exchange an authorization grant for an access token, typically with client authentication.

https://tools.ietf.org/html/rfc6749#section-3

func NewHandler(storer Storer, logger Log, gts ...GrantType) *Handler

func (h *Handler) Authorize(w http.ResponseWriter, req *http.Request)

func (h *Handler) Token(w http.ResponseWriter, req *http.Request)

type ImplicitGrantTypeService ¶

type ImplicitGrantTypeService interface {
	ImplicitGrantTypeResponse(w http.ResponseWriter, req *http.Request, client Client, params url.Values) (*AccessResponse, error)
}

ImplicitGrantTypeService returns an access response, if the resource owner grants the access request.

The authorization server MUST NOT issue a refresh token.

https://tools.ietf.org/html/rfc6749#section-4.2.2

type Log ¶

type Log interface {
	Println(v ...interface{})
}

Log logs server errors.

type PasswordGrantTypeService ¶

type PasswordGrantTypeService interface {
	PasswordGrantTypeResponse(ctx context.Context, client Client, username, password string, issueRefreshToken bool) (*AccessResponse, error)
}

PasswordGrantTypeService returns an access response, if the access token request is valid and authorized.

The authorization server MUST validate the resource owner password credentials using its existing password validation algorithm.

Since this access token request utilizes the resource owner's password, the authorization server MUST protect the endpoint against brute force attacks (e.g., using rate-limitation or generating alerts).

https://tools.ietf.org/html/rfc6749#section-4.3.2

type RefreshGrantTypeService ¶

type RefreshGrantTypeService interface {
	RefreshGrantTypeResponse(ctx context.Context, client Client, refreshToken string) (*AccessResponse, error)
}

RefreshGrantTypeService returns an access response, if the access token request is valid and authorized.

Because refresh tokens are typically long-lasting credentials used to request additional access tokens, the refresh token is bound to the client to which it was issued.

The authorization server MUST validate the refresh token.

The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request.

https://tools.ietf.org/html/rfc6749#section-6

type Storer ¶

type Storer interface {
	FindClient(ctx context.Context, id string) (Client, error)
}

Storer finds clients by their identifier.

type TokenGrantType ¶

type TokenGrantType interface {
	GrantType
	GrantName() string
	Grant(req *http.Request, client Client) (*AccessResponse, error)
}

TokenGrantType is a grant type on the /token endpoint.