(rawIDToken string, provider *auth.OIDCProvider)
| 264 | } |
| 265 | |
| 266 | func (h *handler) createSessionForTrustedIdToken(rawIDToken string, provider *auth.OIDCProvider) (username string, sessionID string, err error) { |
| 267 | user, updates, tokenExpiryTime, err := h.db.Authenticator(h.ctx()).AuthenticateTrustedJWT(rawIDToken, provider, h.getOIDCCallbackURL) |
| 268 | if err != nil { |
| 269 | return "", "", err |
| 270 | } |
| 271 | if user == nil { |
| 272 | return "", "", ErrInvalidLogin |
| 273 | } |
| 274 | |
| 275 | _, _, err = h.db.UpdatePrincipal(h.ctx(), &updates, true, true) |
| 276 | if err != nil { |
| 277 | return "", "", fmt.Errorf("failed to update user: %w", err) |
| 278 | } |
| 279 | |
| 280 | if !provider.DisableSession { |
| 281 | sessionTTL := tokenExpiryTime.Sub(time.Now()) |
| 282 | oneTime := false |
| 283 | sessionID, err := h.makeSessionWithTTL(user, sessionTTL, oneTime) |
| 284 | return user.Name(), sessionID, err |
| 285 | } |
| 286 | return user.Name(), "", nil |
| 287 | } |
| 288 | |
| 289 | func (h *handler) getOIDCProvider(providerName string) (*auth.OIDCProvider, error) { |
| 290 | provider, err := h.db.GetOIDCProvider(providerName) |
no test coverage detected