-
Notifications
You must be signed in to change notification settings - Fork 280
/
aud_claim.go
86 lines (75 loc) · 2.43 KB
/
aud_claim.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
package oidc
import (
"context"
"github.com/hashicorp/boundary/internal/auth/oidc/store"
"github.com/hashicorp/boundary/internal/errors"
"google.golang.org/protobuf/proto"
)
// defaultAudClaimTableName defines the default table name for an AudClaim
const defaultAudClaimTableName = "auth_oidc_aud_claim"
// AudClaim defines an audience claim for an OIDC auth method. It is assigned
// to an OIDC AuthMethod and updates/deletes to that AuthMethod are cascaded to
// its AudClaims. AudClaims are value objects of an AuthMethod, therefore
// there's no need for oplog metadata, since only the AuthMethod will have
// metadata because it's the root aggregate.
//
// see aud claim in the oidc spec:
// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
type AudClaim struct {
*store.AudClaim
tableName string
}
// NewAudClaim creates a new in memory audience claim assigned to an OIDC
// AuthMethod. It supports no options. If an AuthMethod as assigned AudClaims,
// then ID tokens issued from the provider must contain one of the assigned
// audiences to be valid.
//
// For more info on oidc aud claims, see the oidc spec:
// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
func NewAudClaim(ctx context.Context, authMethodId string, audClaim string) (*AudClaim, error) {
const op = "oidc.NewAudClaim"
c := &AudClaim{
AudClaim: &store.AudClaim{
OidcMethodId: authMethodId,
Aud: audClaim,
},
}
if err := c.validate(ctx, op); err != nil {
return nil, err // intentionally not wrapped
}
return c, nil
}
// validate the AudClaim. On success, it will return nil.
func (a *AudClaim) validate(ctx context.Context, caller errors.Op) error {
if a.OidcMethodId == "" {
return errors.New(ctx, errors.InvalidParameter, caller, "missing oidc auth method id")
}
if a.Aud == "" {
return errors.New(ctx, errors.InvalidParameter, caller, "missing aud claim")
}
return nil
}
// AllocAudClaim make an empty one in memory.
func AllocAudClaim() AudClaim {
return AudClaim{
AudClaim: &store.AudClaim{},
}
}
// Clone an AudClaim
func (c *AudClaim) Clone() *AudClaim {
cp := proto.Clone(c.AudClaim)
return &AudClaim{
AudClaim: cp.(*store.AudClaim),
}
}
// TableName returns the table name.
func (c *AudClaim) TableName() string {
if c.tableName != "" {
return c.tableName
}
return defaultAudClaimTableName
}
// SetTableName sets the table name.
func (c *AudClaim) SetTableName(n string) {
c.tableName = n
}