mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-01 03:16:31 +02:00
c886b924e7
* authenticate: set cookie secure as default. * authenticate: remove single flight provider. * authenticate/providers: Rename “ProviderData” to “IdentityProvider” * authenticate/providers: Fixed an issue where scopes were not being overwritten * proxy/authenticate : http client code removed. * proxy: standardized session variable names between services. * docs: change basic docker-config to be an “all-in-one” example with no nginx load. * docs: nginx balanced docker compose example with intra-ingress settings. * license: attribution for adaptation of goji’s middleware pattern.
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
package providers // import "github.com/pomerium/pomerium/internal/providers"
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
oidc "github.com/pomerium/go-oidc"
|
|
"golang.org/x/oauth2"
|
|
)
|
|
|
|
// OIDCProvider provides a standard, OpenID Connect implementation
|
|
// of an authorization identity provider.
|
|
// see : https://openid.net/specs/openid-connect-core-1_0.html
|
|
type OIDCProvider struct {
|
|
*IdentityProvider
|
|
}
|
|
|
|
// NewOIDCProvider creates a new instance of an OpenID Connect provider.
|
|
func NewOIDCProvider(p *IdentityProvider) (*OIDCProvider, error) {
|
|
ctx := context.Background()
|
|
if p.ProviderURL == "" {
|
|
return nil, errors.New("missing required provider url")
|
|
}
|
|
var err error
|
|
p.provider, err = oidc.NewProvider(ctx, p.ProviderURL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if len(p.Scopes) == 0 {
|
|
p.Scopes = []string{oidc.ScopeOpenID, "profile", "email", "offline_access"}
|
|
}
|
|
p.verifier = p.provider.Verifier(&oidc.Config{ClientID: p.ClientID})
|
|
p.oauth = &oauth2.Config{
|
|
ClientID: p.ClientID,
|
|
ClientSecret: p.ClientSecret,
|
|
Endpoint: p.provider.Endpoint(),
|
|
RedirectURL: p.RedirectURL.String(),
|
|
Scopes: p.Scopes,
|
|
}
|
|
return &OIDCProvider{IdentityProvider: p}, nil
|
|
}
|