Decode creates a new UserIDTransformer using as input a JSON formatted string for rules initialization. The accepted JSON format is: { [ {"matches": "

GetUserInfo uses the token source to query the provider's user info endpoint. We reimplement UserInfo [1] instead of using the go-oidc's library UserI

RevokeOIDCSession revokes the given session, which is assumed to be an OIDC session, for which it also performs the necessary cleanup. TODO: In the fu

Transform modifies the UserID based on user provided rules. This method will search the rules in order, find the first that matches the userID and rep

login performs an OIDC login and return the session cookie

TokenSource is a wrapper around oauth2.Config.TokenSource that additionally returns a boolean indicator for a token refresh.

We copy the parseJWT() from: https://github.com/coreos/go-oidc/blob/v3/oidc/verify.go to perform one of the necessary local tests for the JWT authenti

ParseUserInfo unmarshals the response of the UserInfo endpoint and enforces boolean value for the EmailVerified claim.

SessionFromID returns a session which has its key in a header. XXX: Because the session library we use doesn't support getting a session by key, we ne

SessionFromRequest looks for a session id in a header and a cookie, in that order. If it doesn't find a valid session in the header, it will then chec

authenticate is the core function of AuthService. It implements the following steps: 1. attempt to authenticate the user who is performing the examine

getRequestInfo creates a AuthorizationRequestInfo object for the current context.

getUserInfo creates a AuthorizationUserInfo object for the current context.

newBoltDBSessionStore returns a session store backed by BoltDB. The database is stored in the given path and keys are stored in the given bucket. If t

Perform local checks for the issuer and the audiences

Retrieve the USERID_CLAIM and the GROUPS_CLAIM from the JWT access token

Retrieve the USERID_CLAIM and the GROUPS_CLAIM from the /userinfo response

revokeSession revokes the given session.

revokeToken takes care of revoking an access/refresh token to the IdP. The revocation procedure is described in RFC7009: https://tools.ietf.org/html/r

siteHandler returns an http.HandlerFunc that serves a given template

validAccessTokenAuthn() examines if the admins have configured a valid value for the ACCESS_TOKEN_AUTHN envvar.

whitelistMiddleware is a middleware that - Allows all requests that match the whitelist - If the server is ready, forwards requests to be evaluated fu

This function examines if there is at least one common element between two []string objects. The JWT authenticator uses this function to verify that a

CreateState creates the state parameter from the incoming request, stores it in the session store and sets a cookie with the session key. It returns t

InitiateSessionStores initiates both the required stores for the: * users sessions * OIDC states Based on the configured session store (boltdb, or red

RevocationEndpoint parses the OIDC Provider claims from the discovery document and tries to find the revocation_endpoint.

RevokeTokens is a helper that takes an oauth2.Token and revokes the access and refresh tokens. If no tokens are found, it succeeds.

SaveToken triggers oidc.TokenSource to refresh access and refresh token if they have expired and saves them to the session

VerifyState gets the state from the cookie 'initState' saved. It also gets the state from an http param and: 1. Confirms the two values match (CSRF ch

apply does the actual transformation to userID.

authCodeFlowAuthenticationRequest initiates an OIDC Authorization Code flow

authorize tries out all of the available authorizers. If at least one of them does not allow the user to make the request then AuthService denies the

doRequest does the request to the external authorization server.

enabledAuthenticator indicates if the examined authenticator is enabled.

getCachedUser returns: * the UserInfo * the cacheKey if there is an entry in the cache for the examined user. Otherwise, it returns an empty string fo

isApplicable checks if the rule is relevant for the userID.

readiness is the handler that checks if the authservice is ready for serving requests. Currently, it checks if the provider is nil, meaning that the s

tryAuthenticators will iterate over the available enabled authenticators. If one of them manages to authenticate the user who is making the requester

validLogLevel() examines if the admins have configured a valid value for the LOG_LEVEL envvar.

validSessionStoreType() examines if the admins have configured a valid value for the SESSION_STORE_TYPE envvar.

Claims unmarshals the raw JSON object claims into the provided object.