forked from mystiq/dex
69 lines
1.7 KiB
Go
69 lines
1.7 KiB
Go
package session
|
|
|
|
import (
|
|
"net/url"
|
|
"time"
|
|
|
|
"github.com/coreos/go-oidc/jose"
|
|
"github.com/coreos/go-oidc/oidc"
|
|
|
|
"github.com/coreos/dex/scope"
|
|
)
|
|
|
|
const (
|
|
sessionKeyValidityWindow = 10 * time.Minute //RFC6749
|
|
|
|
// The default token expiration time.
|
|
// This is exported, so it can be used to set the expiration
|
|
// time in refresh token flow.
|
|
DefaultSessionValidityWindow = 12 * time.Hour
|
|
)
|
|
|
|
type SessionState string
|
|
|
|
const (
|
|
SessionStateNew = SessionState("NEW")
|
|
SessionStateRemoteAttached = SessionState("REMOTE_ATTACHED")
|
|
SessionStateIdentified = SessionState("IDENTIFIED")
|
|
SessionStateDead = SessionState("EXCHANGED")
|
|
)
|
|
|
|
type SessionKey struct {
|
|
Key string
|
|
SessionID string
|
|
}
|
|
|
|
type Session struct {
|
|
ConnectorID string
|
|
ID string
|
|
State SessionState
|
|
CreatedAt time.Time
|
|
ExpiresAt time.Time
|
|
ClientID string
|
|
ClientState string
|
|
RedirectURL url.URL
|
|
Identity oidc.Identity
|
|
UserID string
|
|
|
|
// Regsiter indicates that this session is a registration flow.
|
|
Register bool
|
|
|
|
// Nonce is optionally provided in the initial authorization request, and
|
|
// propogated in such cases to the generated claims.
|
|
Nonce string
|
|
|
|
// Scope is the 'scope' field in the authentication request. Example scopes
|
|
// are 'openid', 'email', 'offline', etc.
|
|
Scope scope.Scopes
|
|
}
|
|
|
|
// Claims returns a new set of Claims for the current session.
|
|
// The "sub" of the returned Claims is that of the dex User, not whatever
|
|
// remote Identity was used to authenticate.
|
|
func (s *Session) Claims(issuerURL string) jose.Claims {
|
|
claims := oidc.NewClaims(issuerURL, s.UserID, s.ClientID, s.CreatedAt, s.ExpiresAt)
|
|
if s.Nonce != "" {
|
|
claims["nonce"] = s.Nonce
|
|
}
|
|
return claims
|
|
}
|