oidc

type LogoutConfig struct {

	// A http request path that the Authservice matches against to initiate
	// logout. Whenever a request is made to that path, the Authservice will
	// remove the Authservice-specific cookies and respond with a redirect to the
	// configured `redirect_uri`. Removing the cookies causes the user to be
	// unauthenticated in future requests. If the service application has its own
	// logout controller, then it may be desirable to have its logout controller
	// redirect to this path. If the service application does not need its own
	// logout controller, then the application's logout button/link's href can GET
	// or POST directly to this path. Required.
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// A URI specifying the destination to which the Authservice will redirect any
	// request made to the logout `path`. For example, it may be desirable to
	// redirect the logged out user to the homepage of the service application, or
	// to the [logout endpoint of the OIDC
	// Provider](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout).
	// As with all redirects, the user's browser will perform a GET to this URI.
	// Required.
	RedirectUri string `protobuf:"bytes,2,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutConfigMultiError []error

type LogoutConfigValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig struct {

	// The OIDC Provider's [authorization
	// endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
	// Required.
	AuthorizationUri string `protobuf:"bytes,1,opt,name=authorization_uri,json=authorizationUri,proto3" json:"authorization_uri,omitempty"`
	// The OIDC Provider's [token
	// endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
	// Required.
	TokenUri string `protobuf:"bytes,2,opt,name=token_uri,json=tokenUri,proto3" json:"token_uri,omitempty"`
	// This value will be used as the `redirect_uri` param of the authorization
	// code grant [Authentication
	// Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// This URL must be one of the Redirection URI values for the Client
	// pre-registered at the OIDC provider. Note: The Istio gateway's
	// VirtualService must be prepared to ensure that this URL will get routed to
	// the service so that the Authservice can intercept the request and handle it
	// (see
	// [example](https://github.com/istio-ecosystem/authservice/blob/master/bookinfo-example/config/bookinfo-gateway.yaml)).
	// Required.
	CallbackUri string `protobuf:"bytes,3,opt,name=callback_uri,json=callbackUri,proto3" json:"callback_uri,omitempty"`
	// Types that are assignable to JwksConfig:
	//	*OIDCConfig_Jwks
	//	*OIDCConfig_JwksFetcher
	JwksConfig isOIDCConfig_JwksConfig `protobuf_oneof:"jwks_config"`
	// The OIDC client ID assigned to the filter to be used in the
	// [Authentication
	// Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// Required.
	ClientId string `protobuf:"bytes,5,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// The OIDC client secret assigned to the filter to be used in the
	// [Authentication
	// Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// Required.
	ClientSecret string `protobuf:"bytes,6,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// Additional scopes passed to the OIDC Provider in the
	// [Authentication
	// Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// The `openid` scope is always sent to the OIDC Provider, and does not need
	// to be specified here. Required, but an empty array is allowed.
	Scopes []string `protobuf:"bytes,7,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// A unique identifier of the Authservice's browser cookies. Can be any
	// string. Needed when multiple services in the same domain are each protected
	// by their own Authservice, in which case each service's Authservice should
	// have a unique value to avoid cookie name conflicts. Also needed when an
	// Authservice is configured with multiple `oidc` filters (across multiple
	// `chains`), each sharing a Redis server for their session storage, to avoid
	// having those `oidc` filters read/write the same sessions in Redis.
	// Optional.
	CookieNamePrefix string `protobuf:"bytes,8,opt,name=cookie_name_prefix,json=cookieNamePrefix,proto3" json:"cookie_name_prefix,omitempty"`
	// The configuration for adding ID Tokens as headers to requests forwarded to
	// a service. Required.
	IdToken *TokenConfig `protobuf:"bytes,9,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// The configuration for adding Access Tokens as headers to requests forwarded
	// to a service. Optional.
	AccessToken *TokenConfig `protobuf:"bytes,10,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// When specified, the Authservice will destroy the Authservice session when a
	// request is made to the configured path. Optional.
	Logout *LogoutConfig `protobuf:"bytes,11,opt,name=logout,proto3" json:"logout,omitempty"`
	// The Authservice associates obtained OIDC tokens with a session ID in a
	// session store. It also stores some temporary information during the login
	// process into the session store, which will be removed when the user
	// finishes the login. This configuration option sets the number of seconds
	// since a user's session with the Authservice has started until that session
	// should expire. When configured to `0`, which is the default value, the
	// session will never timeout based on the time that it was started, but can
	// still timeout due to being idle. When both `absolute_session_timeout` and
	// `idle_session_timeout` are zero, then sessions will never expire. These
	// settings do not affect how quickly the OIDC tokens contained inside the
	// user's session expire. Optional.
	AbsoluteSessionTimeout uint32 `` /* 131-byte string literal not displayed */
	// The Authservice associates obtained OIDC tokens with a session ID in a
	// session store. It also stores some temporary information during the login
	// process into the session store, which will be removed when the user
	// finishes the login. This configuration option sets the number of seconds
	// since the most recent incoming request from that user until the user's
	// session with the Authservice should expire. When configured to `0`, which
	// is the default value, session expiration will not consider idle time, but
	// can still consider timeout based on maximum absolute time since added. When
	// both `absolute_session_timeout` and `idle_session_timeout` are zero, then
	// sessions will never expire. These settings do not affect how quickly the
	// OIDC tokens contained inside the user's session expire. Optional.
	IdleSessionTimeout uint32 `protobuf:"varint,13,opt,name=idle_session_timeout,json=idleSessionTimeout,proto3" json:"idle_session_timeout,omitempty"`
	// When specified, the Authservice will trust the specified Certificate
	// Authority when performing HTTPS calls to the Token Endpoint of the OIDC
	// Identity Provider. Optional.
	TrustedCertificateAuthority string `` /* 145-byte string literal not displayed */
	// The Authservice makes two kinds of direct network connections directly to
	// the OIDC Provider. Both are POST requests to the configured `token_uri` of
	// the OIDC Provider. The first is to exchange the authorization code for
	// tokens, and the other is to use the refresh token to obtain new tokens.
	// Configure the `proxy_uri` when both of these requests should be made
	// through a web proxy. The format of `proxy_uri` is
	// `http://proxyserver.example.com:8080`, where `:<port_number>` is optional.
	// Userinfo (usernames and passwords) in the `proxy_uri` setting are not yet
	// supported. The `proxy_uri` should always start with `http://`. The
	// Authservice will upgrade the connection to the OIDC provider to HTTPS using
	// an HTTP CONNECT request to the proxy server. The proxy server will see the
	// hostname and port number of the OIDC provider in plain text in the CONNECT
	// request, but all other communication will occur over an encrypted HTTPS
	// connection negotiated directly between the Authservice and the OIDC
	// provider. See also the related `trusted_certificate_authority`
	// configuration option. Optional.
	ProxyUri string `protobuf:"bytes,15,opt,name=proxy_uri,json=proxyUri,proto3" json:"proxy_uri,omitempty"`
	// When specified, the Authservice will use the configured Redis server to
	// store session data. Optional.
	RedisSessionStoreConfig *RedisConfig `` /* 135-byte string literal not displayed */
	// If set to true, the verification of the destination certificate will be
	// skipped when making a request to the Token Endpoint. This option is useful
	// when you want to use a self-signed certificate for testing purposes, but
	// basically should not be set to true in any other cases. Optional.
	SkipVerifyPeerCert bool `protobuf:"varint,18,opt,name=skip_verify_peer_cert,json=skipVerifyPeerCert,proto3" json:"skip_verify_peer_cert,omitempty"`
	// contains filtered or unexported fields
}

type OIDCConfigMultiError []error

type OIDCConfigValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig_Jwks struct {
	// The JSON JWKS response from the OIDC provider’s `jwks_uri` URI which can
	// be found in the OIDC provider's [configuration
	// response](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
	// Note that this JSON value must be escaped when embedded in a json
	// configmap (see
	// [example](https://github.com/istio-ecosystem/authservice/blob/master/bookinfo-example/config/authservice-configmap-template.yaml)).
	// Used during token verification.
	Jwks string `protobuf:"bytes,4,opt,name=jwks,proto3,oneof"`
}

type OIDCConfig_JwksFetcher struct {
	// Configuration to allow JWKs to be retrieved and updated asynchronously at
	// regular intervals.
	JwksFetcher *OIDCConfig_JwksFetcherConfig `protobuf:"bytes,17,opt,name=jwks_fetcher,json=jwksFetcher,proto3,oneof"`
}

type OIDCConfig_JwksFetcherConfig struct {

	// Request URI that has the JWKs.
	// Required.
	JwksUri string `protobuf:"bytes,1,opt,name=jwks_uri,json=jwksUri,proto3" json:"jwks_uri,omitempty"`
	// Request interval to check whether new JWKs are available. If not
	// specified, default to 1200 seconds, 20min. Optional.
	PeriodicFetchIntervalSec uint32 `` /* 138-byte string literal not displayed */
	// If set to true, the verification of the destination certificate will be
	// skipped when making a request to the JWKs URI. This option is useful when
	// you want to use a self-signed certificate for testing purposes, but
	// basically should not be set to true in any other cases. Optional.
	SkipVerifyPeerCert bool `protobuf:"varint,3,opt,name=skip_verify_peer_cert,json=skipVerifyPeerCert,proto3" json:"skip_verify_peer_cert,omitempty"`
	// contains filtered or unexported fields
}

type OIDCConfig_JwksFetcherConfigMultiError []error

type OIDCConfig_JwksFetcherConfigValidationError struct {
	// contains filtered or unexported fields
}

type RedisConfig struct {

	// The Redis server uri, e.g. "tcp://127.0.0.1:6379"
	ServerUri string `protobuf:"bytes,1,opt,name=server_uri,json=serverUri,proto3" json:"server_uri,omitempty"`
	// contains filtered or unexported fields
}

type RedisConfigMultiError []error

type RedisConfigValidationError struct {
	// contains filtered or unexported fields
}

type TokenConfig struct {

	// The name of the header that Authservice adds to the request when forwarding
	// to services. The value of this header will contain the `preamble` and the
	// token. This value is case-insensitive, as http header names are
	// case-insensitive. Note that this value must be `Authorization` for the
	// [Istio Authentication
	// Policy](https://istio.io/docs/tasks/security/authn-policy/) to inspect the
	// token. Required.
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// The authentication scheme of the token.
	// For example, when the preamble is `Bearer` and `header` is `Authorization`,
	// the following header will be added to the request to the service:
	// `Authorization: Bearer ID_TOKEN_VALUE`. Note that this value must be
	// `Bearer`, case-sensitive, when header is `Authorization`. Optional.
	Preamble string `protobuf:"bytes,2,opt,name=preamble,proto3" json:"preamble,omitempty"`
	// contains filtered or unexported fields
}

type TokenConfigMultiError []error

type TokenConfigValidationError struct {
	// contains filtered or unexported fields
}