Documentation
¶
Overview ¶
Package fakeidp is a minimal OpenID Connect provider for tests: discovery, a JWKS, an authorization endpoint that signs the current identity in at once, a token endpoint that answers with an RS256-signed id_token for that identity, and an end-session endpoint (RP-initiated logout) that records who asked.
Standard library only, on purpose: internal/testutil pulls in the whole API (and with it every auth driver), so a driver's own tests could not import a provider living there without an import cycle.
⚠ The ONE fake IdP. PR #40 (Berk Başarır) brought it for RP-initiated logout; the identity-providers page's tests (handlers/auth_providers_live_ test.go) had a second one of their own with a real client check and a browser-shaped authorize step. Both live here now: WithClient makes the token endpoint judge the client the way a real IdP does, WithIssuerPath gives the issuer a realm path.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type IdP ¶
type IdP struct {
// contains filtered or unexported fields
}
IdP is one running provider.
func (*IdP) EndSessionEndpoint ¶
EndSessionEndpoint is where RP-initiated logout goes, or "" when the provider was started WithoutEndSession.
func (*IdP) IDToken ¶
IDToken signs an id_token with arbitrary claims — for tests that need one the token endpoint would never issue (another issuer, say).
func (*IdP) LastIDToken ¶
LastIDToken is the raw id_token the token endpoint handed out last.
func (*IdP) SetExtraClaims ¶ added in v0.49.0
SetExtraClaims adds claims (a groups claim, say) to every id_token from now on; nil removes them. A claim set to nil is LEFT OUT of the id_token (`"email_verified": nil` is a provider that does not send the claim at all), where a non-nil value replaces the default one.
type Option ¶
type Option func(*IdP)
Option configures New.
func WithClient ¶
WithClient makes the token endpoint behave like a real IdP's for one confidential client: wrong credentials are `401 invalid_client`, a request that is not an authorization-code exchange of a code /auth issued is `400 unauthorized_client` (what filex's provider probe reads as "the client authenticated").
func WithIssuerPath ¶
WithIssuerPath puts the issuer under a path, e.g. "/realms/test".
func WithoutEndSession ¶
func WithoutEndSession() Option
WithoutEndSession leaves end_session_endpoint out of discovery — an IdP that offers no RP-initiated logout (GitHub-style OAuth bridges, some hosted providers).
Source Files