-
Notifications
You must be signed in to change notification settings - Fork 279
/
google.go
67 lines (56 loc) · 2.07 KB
/
google.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
// Package google implements OpenID Connect for Google and GSuite.
//
// https://www.pomerium.com/docs/identity-providers/google
// https://developers.google.com/identity/protocols/oauth2/openid-connect
package google
import (
"context"
"fmt"
oidc "github.com/coreos/go-oidc/v3/oidc"
"github.com/pomerium/pomerium/internal/identity/oauth"
pom_oidc "github.com/pomerium/pomerium/internal/identity/oidc"
)
const (
// Name identifies the Google identity provider
Name = "google"
defaultProviderURL = "https://accounts.google.com"
)
var defaultScopes = []string{oidc.ScopeOpenID, "profile", "email"}
// unlike other identity providers, google does not support the `offline_access` scope and instead
// requires we set this on a custom uri param. Also, ` prompt` must be set to `consent`to ensure
// that our application always receives a refresh token (ask google). And finally, we default to
// having the user select which Google account they'd like to use.
// For more details, please see google's documentation:
//
// https://developers.google.com/identity/protocols/oauth2/web-server#offline
// https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters
var defaultAuthCodeOptions = map[string]string{"prompt": "select_account consent", "access_type": "offline"}
// Provider is a Google implementation of the Authenticator interface.
type Provider struct {
*pom_oidc.Provider
}
// New instantiates an OpenID Connect (OIDC) session with Google.
func New(ctx context.Context, o *oauth.Options) (*Provider, error) {
var p Provider
var err error
if o.ProviderURL == "" {
o.ProviderURL = defaultProviderURL
}
if len(o.Scopes) == 0 {
o.Scopes = defaultScopes
}
genericOidc, err := pom_oidc.New(ctx, o)
if err != nil {
return nil, fmt.Errorf("%s: failed creating oidc provider: %w", Name, err)
}
p.Provider = genericOidc
p.AuthCodeOptions = defaultAuthCodeOptions
if len(o.AuthCodeOptions) != 0 {
p.AuthCodeOptions = o.AuthCodeOptions
}
return &p, nil
}
// Name returns the provider name.
func (p *Provider) Name() string {
return Name
}