Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ExternalIDP ¶
type ExternalIDP interface {
// Routes is a function called when initializing
// the external-idp, which allows the implementation
// to specify their own set of required routes.
//
// The Start endpoint is already mapped by the root
// router setup. Start is:
// GET /external-idp/[type]/{id}/
//
// There are pros and cons too this approach:
// - It requires a server restart whenever a new external IDP is added.
// - It keeps the setup fairly simple.
//
// There could be an argument for polymorphism here? If a new external-idp
// is added dynamically through per-say a database, we could instruct the CHI
// router to map new routes? The second approach is too always map
// all the external-idp types in the router, and make each of them
// take a dynamic ID as input.
//
// The current approach was taken since we make our lives easier by
// just iterating all the different types of IDP's defiend in
// the config. This approach is probably subject for overhaul.
Routes(r chi.Router)
Name() string
Type() config.ExternalIDPType
// Start initializes the authentication. The AuthRequest is already
// discovered by its caller before handof..
Start(w http.ResponseWriter, r *http.Request, ar *schema.AuthRequest)
}
type LDAP ¶
type LDAP struct {
// contains filtered or unexported fields
}
func (*LDAP) Manager ¶
Manager names the group that manages group, from the group's manager attribute (owner, or managedBy in AD), qualified by this provider. The attribute must name exactly one group under the groups base people's groups come from; anything else (none, several, a person, a group elsewhere) is no manager.
func (*LDAP) Start ¶
func (l *LDAP) Start(w http.ResponseWriter, r *http.Request, ar *schema.AuthRequest)
Start Steps. The start function simply renders the form for the user. when the user has input the details, they will be posted to /external-idp/{idp-type}/{idp-id}/login. We validate the credentials. Here two things can happen. We validate them as false, I.E bad password, or user not found. This form is naturally rendered with HTMX, so we can add nice errors. But, should the credentials be correct we are supposed to finish the oauth2 flow, by returning the codepath back to the issuer. This is done by calling issuer.LoginComplete.
func (*LDAP) Type ¶
func (l *LDAP) Type() config.ExternalIDPType
type OIDC ¶
type OIDC struct {
// contains filtered or unexported fields
}
func (*OIDC) Manager ¶
Manager names the group that manages group: the Zitadel role's group field, qualified by this provider. Without a zitadel block there are no managers.
func (*OIDC) Start ¶
func (o *OIDC) Start(w http.ResponseWriter, r *http.Request, ar *schema.AuthRequest)
Start redirects the browser to the upstream OIDC provider. routes.go always reaches this via a real top-level GET (never htmx), so a plain http.Redirect is correct here — no HX-Redirect dance needed, unlike LoginComplete.
func (*OIDC) Type ¶
func (o *OIDC) Type() config.ExternalIDPType
Source Files