mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-28 18:06:34 +02:00
b9fd926618
* identity: add support for verifying access and identity tokens * allow overriding with policy option * authenticate: add verify endpoints * wip * implement session creation * add verify test * implement idp token login * fix tests * add pr permission * make session ids route-specific * rename method * add test * add access token test * test for newUserFromIDPClaims * more tests * make the session id per-idp * use type for * add test * remove nil checks
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
package authenticate
|
|
|
|
import (
|
|
"context"
|
|
|
|
oteltrace "go.opentelemetry.io/otel/trace"
|
|
|
|
"github.com/pomerium/pomerium/config"
|
|
"github.com/pomerium/pomerium/internal/urlutil"
|
|
"github.com/pomerium/pomerium/pkg/identity"
|
|
"github.com/pomerium/pomerium/pkg/identity/oauth"
|
|
)
|
|
|
|
func defaultGetIdentityProvider(ctx context.Context, tracerProvider oteltrace.TracerProvider, options *config.Options, idpID string) (identity.Authenticator, error) {
|
|
authenticateURL, err := options.GetAuthenticateURL()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
redirectURL, err := urlutil.DeepCopy(authenticateURL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
redirectURL.Path = options.AuthenticateCallbackPath
|
|
|
|
idp, err := options.GetIdentityProviderForID(idpID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
o := oauth.Options{
|
|
RedirectURL: redirectURL,
|
|
ProviderName: idp.GetType(),
|
|
ProviderURL: idp.GetUrl(),
|
|
ClientID: idp.GetClientId(),
|
|
ClientSecret: idp.GetClientSecret(),
|
|
Scopes: idp.GetScopes(),
|
|
AuthCodeOptions: idp.GetRequestParams(),
|
|
}
|
|
if v := idp.GetAccessTokenAllowedAudiences(); v != nil {
|
|
o.AccessTokenAllowedAudiences = &v.Values
|
|
}
|
|
return identity.NewAuthenticator(ctx, tracerProvider, o)
|
|
}
|