oidc

type LogoutConfig struct {

	// A http request path that the Authservice matches against to initiate logout.
	// Whenever a request is made to that path, the Authservice will remove the Authservice-specific
	// cookies and respond with a redirect to the configured `redirect_uri`. Removing the cookies
	// causes the user to be unauthenticated in future requests.
	// If the service application has its own logout controller, then it may be desirable to have its
	// logout controller redirect to this path. If the service application does not need its own logout
	// controller, then the application's logout button/link's href can GET or POST directly to this path.
	// Required.
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// A URI specifying the destination to which the Authservice will redirect any request made to the
	// logout `path`. For example, it may be desirable to redirect the logged out user to the homepage
	// of the service application, or to the
	// [logout endpoint of the OIDC Provider](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout).
	// As with all redirects, the user's browser will perform a GET to this URI.
	// Required.
	RedirectUri string `protobuf:"bytes,2,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutConfigMultiError []error

type LogoutConfigValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig struct {

	// The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig).
	// If this is set, the endpoints will be dynamically retrieved from the OIDC Provider's configuration endpoint.
	ConfigurationUri string `protobuf:"bytes,19,opt,name=configuration_uri,json=configurationUri,proto3" json:"configuration_uri,omitempty"`
	// The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
	// Required if `configuration_uri` is not set.
	AuthorizationUri string `protobuf:"bytes,1,opt,name=authorization_uri,json=authorizationUri,proto3" json:"authorization_uri,omitempty"`
	// The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
	// Required if `configuration_uri` is not set.
	TokenUri string `protobuf:"bytes,2,opt,name=token_uri,json=tokenUri,proto3" json:"token_uri,omitempty"`
	// This value will be used as the `redirect_uri` param of the authorization code grant
	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// This URL must be one of the Redirection URI values for the Client pre-registered at the OIDC provider.
	// Note: The Istio gateway's VirtualService must be prepared to ensure that this URL will get routed to
	// the service so that the Authservice can intercept the request and handle it
	// (see [example](https://github.com/istio-ecosystem/authservice/blob/master/bookinfo-example/config/bookinfo-gateway.yaml)).
	// Required.
	CallbackUri string `protobuf:"bytes,3,opt,name=callback_uri,json=callbackUri,proto3" json:"callback_uri,omitempty"`
	// Types that are assignable to JwksConfig:
	//
	//	*OIDCConfig_Jwks
	//	*OIDCConfig_JwksFetcher
	JwksConfig isOIDCConfig_JwksConfig `protobuf_oneof:"jwks_config"`
	// The OIDC client ID assigned to the filter to be used in the
	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// Required.
	ClientId string `protobuf:"bytes,5,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Types that are assignable to ClientSecretConfig:
	//
	//	*OIDCConfig_ClientSecret
	//	*OIDCConfig_ClientSecretRef
	ClientSecretConfig isOIDCConfig_ClientSecretConfig `protobuf_oneof:"client_secret_config"`
	// Additional scopes passed to the OIDC Provider in the
	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// The `openid` scope is always sent to the OIDC Provider, and does not need to be specified here.
	// Required, but an empty array is allowed.
	Scopes []string `protobuf:"bytes,7,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// A unique identifier of the Authservice's browser cookies. Can be any string.
	// Needed when multiple services in the same domain are each protected by
	// their own Authservice, in which case each service's Authservice should have
	// a unique value to avoid cookie name conflicts. Also needed when an Authservice
	// is configured with multiple `oidc` filters (across multiple `chains`), each
	// sharing a Redis server for their session storage, to avoid having those
	// `oidc` filters read/write the same sessions in Redis.
	// Optional.
	CookieNamePrefix string `protobuf:"bytes,8,opt,name=cookie_name_prefix,json=cookieNamePrefix,proto3" json:"cookie_name_prefix,omitempty"`
	// The configuration for adding ID Tokens as headers to requests forwarded to a service.
	// Required.
	IdToken *TokenConfig `protobuf:"bytes,9,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// The configuration for adding Access Tokens as headers to requests forwarded to a service.
	// Optional.
	AccessToken *TokenConfig `protobuf:"bytes,10,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// When specified, the Authservice will destroy the Authservice session when a request is
	// made to the configured path.
	// Optional.
	Logout *LogoutConfig `protobuf:"bytes,11,opt,name=logout,proto3" json:"logout,omitempty"`
	// The Authservice associates obtained OIDC tokens with a session ID in a session store.
	// It also stores some temporary information during the login process into the session store,
	// which will be removed when the user finishes the login.
	// This configuration option sets the number of seconds since a user's session with the Authservice has started
	// until that session should expire.
	// When configured to `0`, which is the default value, the session will never timeout based on the time
	// that it was started, but can still timeout due to being idle.
	// When both `absolute_session_timeout` and `idle_session_timeout` are zero, then sessions will never
	// expire. These settings do not affect how quickly the OIDC tokens contained inside the user's session expire.
	// Optional.
	AbsoluteSessionTimeout uint32 `` /* 131-byte string literal not displayed */
	// The Authservice associates obtained OIDC tokens with a session ID in a session store.
	// It also stores some temporary information during the login process into the session store,
	// which will be removed when the user finishes the login.
	// This configuration option sets the number of seconds since the most recent incoming request from that user
	// until the user's session with the Authservice should expire.
	// When configured to `0`, which is the default value, session expiration will not consider idle time,
	// but can still consider timeout based on maximum absolute time since added.
	// When both `absolute_session_timeout` and `idle_session_timeout` are zero, then sessions will never
	// expire. These settings do not affect how quickly the OIDC tokens contained inside the user's session expire.
	// Optional.
	IdleSessionTimeout uint32 `protobuf:"varint,13,opt,name=idle_session_timeout,json=idleSessionTimeout,proto3" json:"idle_session_timeout,omitempty"`
	// When specified, the Authservice will trust the specified Certificate Authority when performing HTTPS calls to
	// the OIDC Identity Provider.
	//
	// Types that are assignable to TrustedCaConfig:
	//
	//	*OIDCConfig_TrustedCertificateAuthority
	//	*OIDCConfig_TrustedCertificateAuthorityFile
	TrustedCaConfig isOIDCConfig_TrustedCaConfig `protobuf_oneof:"trusted_ca_config"`
	// The duration between refreshes of the trusted certificate authority if `trusted_certificate_authority_file` is set.
	// Unset or 0 (the default) disables the refresh, useful is no rotation is expected.
	// Is a String that ends in `s` to indicate seconds and is preceded by the number of seconds, e.g. `120s` (represents 2 minutes).
	// Optional.
	TrustedCertificateAuthorityRefreshInterval *durationpb.Duration `` /* 194-byte string literal not displayed */
	// The Authservice makes two kinds of direct network connections directly to the OIDC Provider.
	// Both are POST requests to the configured `token_uri` of the OIDC Provider.
	// The first is to exchange the authorization code for tokens, and the other is to use the
	// refresh token to obtain new tokens. Configure the `proxy_uri` when
	// both of these requests should be made through a web proxy. The format of `proxy_uri` is
	// `http://proxyserver.example.com:8080`, where `:<port_number>` is optional.
	// Userinfo (usernames and passwords) in the `proxy_uri` setting are not yet supported.
	// The `proxy_uri` should always start with `http://`.
	// The Authservice will upgrade the connection to the OIDC provider to HTTPS using
	// an HTTP CONNECT request to the proxy server. The proxy server will see the hostname and port number
	// of the OIDC provider in plain text in the CONNECT request, but all other communication will occur
	// over an encrypted HTTPS connection negotiated directly between the Authservice and
	// the OIDC provider. See also the related `trusted_certificate_authority` configuration option.
	// Optional.
	ProxyUri string `protobuf:"bytes,15,opt,name=proxy_uri,json=proxyUri,proto3" json:"proxy_uri,omitempty"`
	// When specified, the Authservice will use the configured Redis server to store session data.
	// Optional.
	RedisSessionStoreConfig *RedisConfig `` /* 135-byte string literal not displayed */
	// If set to true, the verification of the destination certificate will be skipped when
	// making a request to the Token Endpoint. This option is useful when you want to use a
	// self-signed certificate for testing purposes, but basically should not be set to true
	// in any other cases.
	// Optional.
	SkipVerifyPeerCert *structpb.Value `protobuf:"bytes,18,opt,name=skip_verify_peer_cert,json=skipVerifyPeerCert,proto3" json:"skip_verify_peer_cert,omitempty"` // keep this field out from the trusted_ca_config one of for backward compatibility.
	// contains filtered or unexported fields
}

type OIDCConfigMultiError []error

type OIDCConfigValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig_ClientSecret struct {
	// The OIDC client secret assigned to the filter to be used in the
	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	// This field keeps the client secret in plain text. Recommend to use `client_secret_ref` instead
	// when running in a Kubernetes cluster.
	ClientSecret string `protobuf:"bytes,6,opt,name=client_secret,json=clientSecret,proto3,oneof"`
}

type OIDCConfig_ClientSecretRef struct {
	// The Kubernetes secret that contains the OIDC client secret assigned to the filter to be used in the
	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
	//
	// This is an Opaque secret. The client secret should be stored in the key "client-secret".
	// This filed is only valid when running in a Kubernetes cluster.
	ClientSecretRef *OIDCConfig_SecretReference `protobuf:"bytes,21,opt,name=client_secret_ref,json=clientSecretRef,proto3,oneof"`
}

type OIDCConfig_Jwks struct {
	// The JSON JWKS response from the OIDC provider’s `jwks_uri` URI which can be found in
	// the OIDC provider's
	// [configuration response](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
	// Note that this JSON value must be escaped when embedded in a json configmap
	// (see [example](https://github.com/istio-ecosystem/authservice/blob/master/bookinfo-example/config/authservice-configmap-template.yaml)).
	// Used during token verification.
	Jwks string `protobuf:"bytes,4,opt,name=jwks,proto3,oneof"`
}

type OIDCConfig_JwksFetcher struct {
	// Configuration to allow JWKs to be retrieved and updated asynchronously at regular intervals.
	JwksFetcher *OIDCConfig_JwksFetcherConfig `protobuf:"bytes,17,opt,name=jwks_fetcher,json=jwksFetcher,proto3,oneof"`
}

type OIDCConfig_JwksFetcherConfig struct {

	// Request URI that has the JWKs.
	// Required if `configuration_uri` is not set.
	JwksUri string `protobuf:"bytes,1,opt,name=jwks_uri,json=jwksUri,proto3" json:"jwks_uri,omitempty"`
	// Request interval to check whether new JWKs are available. If not specified,
	// default to 1200 seconds, 20min.
	// Optional.
	PeriodicFetchIntervalSec uint32 `` /* 138-byte string literal not displayed */
	// If set to true, the verification of the destination certificate will be skipped when
	// making a request to the JWKs URI. This option is useful when you want to use a
	// self-signed certificate for testing purposes, but basically should not be set to
	// true in any other cases.
	// Optional.
	// Deprecated: Use the one from the OIDCConfig instead.
	//
	// Deprecated: Marked as deprecated in v1/oidc/config.proto.
	SkipVerifyPeerCert *structpb.Value `protobuf:"bytes,3,opt,name=skip_verify_peer_cert,json=skipVerifyPeerCert,proto3" json:"skip_verify_peer_cert,omitempty"`
	// contains filtered or unexported fields
}

type OIDCConfig_JwksFetcherConfigMultiError []error

type OIDCConfig_JwksFetcherConfigValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig_SecretReference struct {

	// The namespace of the referenced Secret, if not set, default to "default" namespace.
	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// The name of the referenced Secret.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type OIDCConfig_SecretReferenceMultiError []error

type OIDCConfig_SecretReferenceValidationError struct {
	// contains filtered or unexported fields
}

type OIDCConfig_TrustedCertificateAuthority struct {
	// String PEM-encoded certificate authority to trust when performing HTTPS calls to the OIDC Identity Provider.
	// Optional.
	TrustedCertificateAuthority string `protobuf:"bytes,14,opt,name=trusted_certificate_authority,json=trustedCertificateAuthority,proto3,oneof"`
}

type OIDCConfig_TrustedCertificateAuthorityFile struct {
	// The file path to the PEM-encoded certificate authority to trust when performing HTTPS calls to the OIDC Identity Provider.
	// Optional.
	TrustedCertificateAuthorityFile string `protobuf:"bytes,20,opt,name=trusted_certificate_authority_file,json=trustedCertificateAuthorityFile,proto3,oneof"`
}

type RedisConfig struct {

	// The Redis server uri, e.g. "tcp://127.0.0.1:6379"
	ServerUri string `protobuf:"bytes,1,opt,name=server_uri,json=serverUri,proto3" json:"server_uri,omitempty"`
	// contains filtered or unexported fields
}

type RedisConfigMultiError []error

type RedisConfigValidationError struct {
	// contains filtered or unexported fields
}

type TokenConfig struct {

	// The name of the header that Authservice adds to the request when forwarding to services.
	// The value of this header will contain the `preamble` and the token.
	// This value is case-insensitive, as http header names are case-insensitive.
	// Note that this value must be `Authorization` for the
	// [Istio Authentication Policy](https://istio.io/docs/tasks/security/authn-policy/)
	// to inspect the token.
	// Required.
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// The authentication scheme of the token.
	// For example, when the preamble is `Bearer` and `header` is `Authorization`, the following
	// header will be added to the request to the service: `Authorization: Bearer ID_TOKEN_VALUE`.
	// Note that this value must be `Bearer`, case-sensitive, when header is `Authorization`.
	// Optional.
	Preamble string `protobuf:"bytes,2,opt,name=preamble,proto3" json:"preamble,omitempty"`
	// contains filtered or unexported fields
}

type TokenConfigMultiError []error

type TokenConfigValidationError struct {
	// contains filtered or unexported fields
}