1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
// Copyright 2024 OpenPubkey
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0
package providers
import (
"context"
"net/http"
"time"
"github.com/openpubkey/openpubkey/discover"
)
const googleIssuer = "https://accounts.google.com"
// GoogleOptions is an options struct that configures how providers.GoogleOp
// operates. See providers.GetDefaultGoogleOpOptions for the recommended default
// values to use when interacting with Google as the OpenIdProvider.
type GoogleOptions struct {
// ClientID is the client ID of the OIDC application. It should be the
// expected "aud" claim in received ID tokens from the OP.
ClientID string
// ClientSecret is the client secret of the OIDC application. Some OPs do
// not require that this value is set.
ClientSecret string
// Issuer is the OP's issuer URI for performing OIDC authorization and
// discovery.
Issuer string
// Scopes is the list of scopes to send to the OP in the initial
// authorization request.
Scopes []string
// PromptType is the type of prompt to use when requesting authorization from the user. Typically
// this is set to "consent".
PromptType string
// AccessType is the type of access to request from the OP. Typically this is set to "offline".
AccessType string
// RedirectURIs is the list of authorized redirect URIs that can be
// redirected to by the OP after the user completes the authorization code
// flow exchange. Ensure that your OIDC application is configured to accept
// these URIs otherwise an error may occur.
RedirectURIs []string
// GQSign denotes if the received ID token should be upgraded to a GQ token
// using GQ signatures.
GQSign bool
// OpenBrowser denotes if the client's default browser should be opened
// automatically when performing the OIDC authorization flow. This value
// should typically be set to true, unless performing some headless
// automation (e.g. integration tests) where you don't want the browser to
// open.
OpenBrowser bool
// HttpClient is the http.Client to use when making queries to the OP (OIDC
// code exchange, refresh, verification of ID token, fetch of JWKS endpoint,
// etc.). If nil, then http.DefaultClient is used.
HttpClient *http.Client
// IssuedAtOffset configures the offset to add when validating the "iss" and
// "exp" claims of received ID tokens from the OP.
IssuedAtOffset time.Duration
}
func GetDefaultGoogleOpOptions() *GoogleOptions {
return &GoogleOptions{
Issuer: googleIssuer,
ClientID: "206584157355-7cbe4s640tvm7naoludob4ut1emii7sf.apps.googleusercontent.com",
// The clientSecret was intentionally checked in. It holds no power. Do not report as a security issue
// Google requires a ClientSecret even if this a public OIDC App
ClientSecret: "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", // The client secret is a public value
Scopes: []string{"openid profile email"},
PromptType: "consent",
AccessType: "offline",
RedirectURIs: []string{
"http://localhost:3000/login-callback",
"http://localhost:10001/login-callback",
"http://localhost:11110/login-callback",
},
GQSign: false,
OpenBrowser: true,
HttpClient: nil,
IssuedAtOffset: 1 * time.Minute,
}
}
// NewGoogleOp creates a Google OP (OpenID Provider) using the
// default configurations options. It uses the OIDC Relying Party (Client)
// setup by the OpenPubkey project.
func NewGoogleOp() BrowserOpenIdProvider {
options := GetDefaultGoogleOpOptions()
return NewGoogleOpWithOptions(options)
}
// NewGoogleOpWithOptions creates a Google OP with configuration specified
// using an options struct. This is useful if you want to use your own OIDC
// Client or override the configuration.
func NewGoogleOpWithOptions(opts *GoogleOptions) BrowserOpenIdProvider {
return &GoogleOp{
StandardOp{
clientID: opts.ClientID,
ClientSecret: opts.ClientSecret,
Scopes: opts.Scopes,
PromptType: opts.PromptType,
AccessType: opts.AccessType,
RedirectURIs: opts.RedirectURIs,
GQSign: opts.GQSign,
OpenBrowser: opts.OpenBrowser,
HttpClient: opts.HttpClient,
IssuedAtOffset: opts.IssuedAtOffset,
issuer: opts.Issuer,
requestTokensOverrideFunc: nil,
publicKeyFinder: discover.PublicKeyFinder{
JwksFunc: func(ctx context.Context, issuer string) ([]byte, error) {
return discover.GetJwksByIssuer(ctx, issuer, opts.HttpClient)
},
},
},
}
}
type GoogleOp = StandardOpRefreshable
var _ OpenIdProvider = (*GoogleOp)(nil)
var _ BrowserOpenIdProvider = (*GoogleOp)(nil)
var _ RefreshableOpenIdProvider = (*GoogleOp)(nil)
|
