okta

type CreationOptions struct {
	ClientID     string
	ClientSecret string
	RedirectURI  string
	Issuer       string
	// Scopes define the user information to request when authorizing the user.
	// See https://developer.okta.com/docs/reference/api/oidc/#access-token-scopes-and-claims
	Scopes []string

	UserGroup string
	// If set, user can be reauthorized without needing to authenticate.
	AllowReauthorization bool
	// If set, authentication and reauthorization will validate the group for
	// the user matches UserGroup. Otherwise, it simply checks that the user
	// attempting to reauthorize has the same name as that returned by the ID
	// token. This validation is only possible when the issuer returns group
	// information from its endpoints, which requires the application to have
	// permission to request them as part of the scopes.
	ValidateGroups bool

	CookiePath   string
	CookieDomain string
	CookieTTL    time.Duration

	LoginCookieName string
	LoginCookieTTL  time.Duration

	UserCache     usercache.Cache
	ExternalCache *usercache.ExternalOptions

	GetHTTPClient func() *http.Client
	PutHTTPClient func(*http.Client)

	// ReconciliateID is only used for the purposes of reconciliating existing
	// user IDs with their Okta IDs.
	ReconciliateID func(id string) (newID string)
}