hydra: github.com/ory/hydra/consent Index | Files

package consent

import "github.com/ory/hydra/consent"

Index

Package Files

doc.go handler.go helper.go manager.go manager_memory.go manager_sql.go manager_test_helpers.go registry.go sql_helper.go strategy.go strategy_default.go subject_identifier_algorithm.go subject_identifier_algorithm_pairwise.go subject_identifier_algorithm_public.go types.go

Constants

const (
    LoginPath    = "/oauth2/auth/requests/login"
    ConsentPath  = "/oauth2/auth/requests/consent"
    LogoutPath   = "/oauth2/auth/requests/logout"
    SessionsPath = "/oauth2/auth/sessions"
)
const (
    CookieAuthenticationName    = "oauth2_authentication_session"
    CookieAuthenticationSIDName = "sid"
)

Variables

var ErrAbortOAuth2Request = errors.New("the OAuth 2.0 Authorization request must be aborted")
var ErrHintDoesNotMatchAuthentication = errors.New("subject from hint does not match subject from session")
var ErrNoAuthenticationSessionFound = errors.New("no previous login session was found")
var ErrNoPreviousConsentFound = errors.New("no previous OAuth 2.0 Consent could be found for this access request")

func CookieName Uses

func CookieName(secure bool, name string) string

func ManagerTests Uses

func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.FositeStorer) func(t *testing.T)

func MockAuthRequest Uses

func MockAuthRequest(key string, authAt bool) (c *LoginRequest, h *HandledLoginRequest)

func MockConsentRequest Uses

func MockConsentRequest(key string, remember bool, rememberFor int, hasError bool, skip bool, authAt bool) (c *ConsentRequest, h *HandledConsentRequest)

type Configuration Uses

type Configuration interface {
    configuration.Provider
}

type ConsentRequest Uses

type ConsentRequest struct {
    // Challenge is the identifier ("authorization challenge") of the consent authorization request. It is used to
    // identify the session.
    //
    // required: true
    Challenge string `json:"challenge" db:"challenge"`

    // RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
    RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`

    // RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
    RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`

    // Skip, if true, implies that the client has requested the same scopes from the same user previously.
    // If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the
    // consent request using the usual API call.
    Skip bool `json:"skip" db:"skip"`

    // Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
    // requested by the OAuth 2.0 client.
    Subject string `json:"subject" db:"subject"`

    // OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
    // values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
    OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`

    // Client is the OAuth 2.0 Client that initiated the request.
    Client   *client.Client `json:"client" db:"-"`
    ClientID string         `json:"-" db:"client_id"`

    // RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
    // initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
    // might come in handy if you want to deal with additional request parameters.
    RequestURL string `json:"request_url" db:"request_url"`

    // LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate
    // a login and consent request in the login & consent app.
    LoginChallenge sqlxx.NullString `json:"login_challenge" db:"login_challenge"`

    // LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
    // this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
    // this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
    // channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
    LoginSessionID sqlxx.NullString `json:"login_session_id" db:"login_session_id"`

    // ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
    // to express that, for example, a user authenticated using two factor authentication.
    ACR string `json:"acr" db:"acr"`

    // Context contains arbitrary information set by the login endpoint or is empty if not set.
    Context sqlxx.JSONRawMessage `json:"context,omitempty" db:"context"`

    // ForceSubjectIdentifier is the value from authentication (if set).
    ForceSubjectIdentifier string         `json:"-" db:"forced_subject_identifier"`
    SubjectIdentifier      string         `json:"-" db:"-"`
    Verifier               string         `json:"-" db:"verifier"`
    CSRF                   string         `json:"-" db:"csrf"`
    AuthenticatedAt        sqlxx.NullTime `json:"-" db:"authenticated_at"`
    RequestedAt            time.Time      `json:"-" db:"requested_at"`
    WasHandled             bool           `json:"-" db:"was_handled"`
}

Contains information on an ongoing consent request.

swagger:model consentRequest

func SaneMockConsentRequest Uses

func SaneMockConsentRequest(t *testing.T, m Manager, ar *LoginRequest, skip bool) (c *ConsentRequest)

SaneMockConsentRequest does the same thing as MockConsentRequest but uses less insanity and implicit dependencies.

type ConsentRequestSessionData Uses

type ConsentRequestSessionData struct {
    // AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the
    // refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.
    // If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties
    // can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
    AccessToken map[string]interface{} `json:"access_token"`

    // IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable
    // by anyone that has access to the ID Challenge. Use with care!
    IDToken map[string]interface{} `json:"id_token"`
}

Used to pass session data to a consent request.

swagger:model consentRequestSession

func NewConsentRequestSessionData Uses

func NewConsentRequestSessionData() *ConsentRequestSessionData

type DefaultStrategy Uses

type DefaultStrategy struct {
    // contains filtered or unexported fields
}

func NewStrategy Uses

func NewStrategy(
    r InternalRegistry,
    c Configuration,
) *DefaultStrategy

func (*DefaultStrategy) HandleOAuth2AuthorizationRequest Uses

func (s *DefaultStrategy) HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)

func (*DefaultStrategy) HandleOpenIDConnectLogout Uses

func (s *DefaultStrategy) HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)

type ForcedObfuscatedLoginSession Uses

type ForcedObfuscatedLoginSession struct {
    ClientID          string `db:"client_id"`
    Subject           string `db:"subject"`
    SubjectObfuscated string `db:"subject_obfuscated"`
}

type HandledConsentRequest Uses

type HandledConsentRequest struct {
    // GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
    GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`

    // GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
    GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`

    // Session allows you to set (optional) session data for access and ID tokens.
    Session *ConsentRequestSessionData `json:"session" db:"-"`

    // Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
    // client asks the same user for the same, or a subset of, scope.
    Remember bool `json:"remember" db:"remember"`

    // RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
    // authorization will be remembered indefinitely.
    RememberFor int `json:"remember_for" db:"remember_for"`

    // HandledAt contains the timestamp the consent request was handled.
    HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`

    ConsentRequest  *ConsentRequest     `json:"-" db:"-"`
    Error           *RequestDeniedError `json:"-" db:"error"`
    Challenge       string              `json:"-" db:"challenge"`
    RequestedAt     time.Time           `json:"-" db:"requested_at"`
    AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
    WasUsed         bool                `json:"-" db:"was_used"`

    SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
    SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
}

The request payload used to accept a consent request.

swagger:model acceptConsentRequest

func SaneMockHandleConsentRequest Uses

func SaneMockHandleConsentRequest(t *testing.T, m Manager, c *ConsentRequest, authAt time.Time, rememberFor int, remember bool, hasError bool) *HandledConsentRequest

func (*HandledConsentRequest) HasError Uses

func (r *HandledConsentRequest) HasError() bool

func (HandledConsentRequest) TableName Uses

func (r HandledConsentRequest) TableName() string

type HandledLoginRequest Uses

type HandledLoginRequest struct {
    // Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store
    // a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she
    // will not be asked to log in again.
    Remember bool `json:"remember" db:"remember"`

    // RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the
    // authorization will be remembered for the duration of the browser session (using a session cookie).
    RememberFor int `json:"remember_for" db:"remember_for"`

    // ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
    // to express that, for example, a user authenticated using two factor authentication.
    ACR string `json:"acr" db:"acr"`

    // Subject is the user ID of the end-user that authenticated.
    //
    // required: true
    Subject string `json:"subject" db:"subject"`

    // ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the
    // (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID
    // Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.
    //
    // Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the
    // sub claim in the OAuth 2.0 Introspection.
    //
    // Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself
    // you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in
    // ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's
    // configuration).
    //
    // Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies
    // that you have to compute this value on every authentication process (probably depending on the client ID or some
    // other unique value).
    //
    // If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.
    ForceSubjectIdentifier string `json:"force_subject_identifier" db:"forced_subject_identifier"`

    // Context is an optional object which can hold arbitrary data. The data will be made available when fetching the
    // consent request under the "context" field. This is useful in scenarios where login and consent endpoints share
    // data.
    Context sqlxx.JSONRawMessage `json:"context" db:"context"`

    LoginRequest    *LoginRequest       `json:"-" db:"-"`
    Error           *RequestDeniedError `json:"-" db:"error"`
    Challenge       string              `json:"-" db:"challenge"`
    RequestedAt     time.Time           `json:"-" db:"requested_at"`
    AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
    WasUsed         bool                `json:"-" db:"was_used"`
}

HandledLoginRequest is the request payload used to accept a login request.

swagger:model acceptLoginRequest

func (*HandledLoginRequest) HasError Uses

func (r *HandledLoginRequest) HasError() bool

func (HandledLoginRequest) TableName Uses

func (r HandledLoginRequest) TableName() string

type Handler Uses

type Handler struct {
    // contains filtered or unexported fields
}

func NewHandler Uses

func NewHandler(
    r InternalRegistry,
    c Configuration,
) *Handler

func (*Handler) AcceptConsentRequest Uses

func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/consent/accept admin acceptConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  404: genericError
  500: genericError

func (*Handler) AcceptLoginRequest Uses

func (h *Handler) AcceptLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/login/accept admin acceptLoginRequest

Accept a Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting a cookie.

The response contains a redirect URL which the login provider should redirect the user-agent to.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  404: genericError
  401: genericError
  500: genericError

func (*Handler) AcceptLogoutRequest Uses

func (h *Handler) AcceptLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/logout/accept admin acceptLogoutRequest

Accept a Logout Request

When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request. No body is required.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  404: genericError
  500: genericError

func (*Handler) DeleteConsentSession Uses

func (h *Handler) DeleteConsentSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route DELETE /oauth2/auth/sessions/consent admin revokeConsentSessions

This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all associated OAuth 2.0 Access Tokens.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  204: emptyResponse
  400: genericError
  404: genericError
  500: genericError

func (*Handler) DeleteLoginSession Uses

func (h *Handler) DeleteLoginSession(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route DELETE /oauth2/auth/sessions/login admin revokeAuthenticationSession

Invalidates All Login Sessions of a Certain User Invalidates a Subject's Authentication Session

This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect Front- or Back-channel logout.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  204: emptyResponse
  400: genericError
  404: genericError
  500: genericError

func (*Handler) GetConsentRequest Uses

func (h *Handler) GetConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/requests/consent admin getConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: consentRequest
  404: genericError
  409: genericError
  500: genericError

func (*Handler) GetConsentSessions Uses

func (h *Handler) GetConsentSessions(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/sessions/consent admin listSubjectConsentSessions

This endpoint lists all subject's granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK.

The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'. Multiple links can be included in this header, and will be separated by a comma.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: handledConsentRequestList
  400: genericError
  500: genericError

func (*Handler) GetLoginRequest Uses

func (h *Handler) GetLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/requests/login admin getLoginRequest

Get a Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: loginRequest
  400: genericError
  404: genericError
  409: genericError
  500: genericError

func (*Handler) GetLogoutRequest Uses

func (h *Handler) GetLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route GET /oauth2/auth/requests/logout admin getLogoutRequest

Get a Logout Request

Use this endpoint to fetch a logout request.

Produces:
- application/json

Schemes: http, https

Responses:
  200: logoutRequest
  404: genericError
  500: genericError

func (*Handler) RejectConsentRequest Uses

func (h *Handler) RejectConsentRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/consent/reject admin rejectConsentRequest

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.

This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  404: genericError
  500: genericError

func (*Handler) RejectLoginRequest Uses

func (h *Handler) RejectLoginRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/login/reject admin rejectLoginRequest

Reject a Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication was be denied.

The response contains a redirect URL which the login provider should redirect the user-agent to.

Consumes:
- application/json

Produces:
- application/json

Schemes: http, https

Responses:
  200: completedRequest
  401: genericError
  404: genericError
  500: genericError

func (*Handler) RejectLogoutRequest Uses

func (h *Handler) RejectLogoutRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params)

swagger:route PUT /oauth2/auth/requests/logout/reject admin rejectLogoutRequest

Reject a Logout Request

When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request. No body is required.

The response is empty as the logout provider has to chose what action to perform next.

Produces:
- application/json

Schemes: http, https

Responses:
  204: emptyResponse
  404: genericError
  500: genericError

func (*Handler) SetRoutes Uses

func (h *Handler) SetRoutes(admin *x.RouterAdmin)

type InternalRegistry Uses

type InternalRegistry interface {
    x.RegistryWriter
    x.RegistryCookieStore
    x.RegistryLogger
    Registry
    client.Registry

    OAuth2Storage() x.FositeStorer
    OpenIDJWTStrategy() jwk.JWTStrategy
    OpenIDConnectRequestValidator() *openid.OpenIDConnectRequestValidator
    ScopeStrategy() fosite.ScopeStrategy
}

type LoginRequest Uses

type LoginRequest struct {
    // Challenge is the identifier ("login challenge") of the login request. It is used to
    // identify the session.
    //
    // required: true
    Challenge string `json:"challenge" db:"challenge"`

    // RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.
    //
    // required: true
    RequestedScope sqlxx.StringSlicePipeDelimiter `json:"requested_scope" db:"requested_scope"`

    // RequestedScope contains the access token audience as requested by the OAuth 2.0 Client.
    //
    // required: true
    RequestedAudience sqlxx.StringSlicePipeDelimiter `json:"requested_access_token_audience" db:"requested_at_audience"`

    // Skip, if true, implies that the client has requested the same scopes from the same user previously.
    // If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.
    //
    // This feature allows you to update / set session information.
    //
    // required: true
    Skip bool `json:"skip" db:"skip"`

    // Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
    // requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type
    // when accepting the login request, or the request will fail.
    //
    // required: true
    Subject string `json:"subject" db:"subject"`

    // OpenIDConnectContext provides context for the (potential) OpenID Connect context. Implementation of these
    // values in your app are optional but can be useful if you want to be fully compliant with the OpenID Connect spec.
    OpenIDConnectContext *OpenIDConnectContext `json:"oidc_context" db:"oidc_context"`

    // Client is the OAuth 2.0 Client that initiated the request.
    //
    // required: true
    Client *client.Client `json:"client"`

    ClientID string `json:"-" db:"client_id"`

    // RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
    // initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
    // might come in handy if you want to deal with additional request parameters.
    //
    // required: true
    RequestURL string `json:"request_url" db:"request_url"`

    // SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
    // this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
    // this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
    // channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
    SessionID sqlxx.NullString `json:"session_id" db:"login_session_id"`

    ForceSubjectIdentifier string `json:"-" db:"-"` // this is here but has no meaning apart from sql_helper working properly.
    Verifier               string `json:"-" db:"verifier"`
    CSRF                   string `json:"-" db:"csrf"`

    AuthenticatedAt sqlxx.NullTime `json:"-" db:"authenticated_at"`
    RequestedAt     time.Time      `json:"-" db:"requested_at"`
    WasHandled      bool           `json:"-" db:"was_handled"`
    Context         string         `json:"-" db:"context"`
}

Contains information on an ongoing login request.

swagger:model loginRequest

func SaneMockAuthRequest Uses

func SaneMockAuthRequest(t *testing.T, m Manager, ls *LoginSession, cl *client.Client) (c *LoginRequest)

SaneMockAuthRequest does the same thing as MockAuthRequest but uses less insanity and implicit dependencies.

type LoginSession Uses

type LoginSession struct {
    ID              string    `db:"id"`
    AuthenticatedAt time.Time `db:"authenticated_at"`
    Subject         string    `db:"subject"`
    Remember        bool      `db:"remember"`
}

swagger:ignore

func (LoginSession) TableName Uses

func (s LoginSession) TableName() string

type LogoutRequest Uses

type LogoutRequest struct {
    // Challenge is the identifier ("logout challenge") of the logout authentication request. It is used to
    // identify the session.
    Challenge string `json:"-" db:"challenge"`

    // Subject is the user for whom the logout was request.
    Subject string `json:"subject" db:"subject"`

    // SessionID is the login session ID that was requested to log out.
    SessionID string `json:"sid,omitempty" db:"sid"`

    // RequestURL is the original Logout URL requested.
    RequestURL string `json:"request_url" db:"request_url"`

    // RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client.
    RPInitiated bool `json:"rp_initiated" db:"rp_initiated"`

    Verifier              string         `json:"-" db:"verifier"`
    PostLogoutRedirectURI string         `json:"-" db:"redir_url"`
    WasUsed               bool           `json:"-" db:"was_used"`
    Accepted              bool           `json:"-" db:"accepted"`
    Rejected              bool           `db:"rejected" json:"-"`
    ClientID              sql.NullString `json:"-" db:"client_id"`
    Client                *client.Client `json:"-" db:"-"`
}

Contains information about an ongoing logout request.

swagger:model logoutRequest

func MockLogoutRequest Uses

func MockLogoutRequest(key string, withClient bool) (c *LogoutRequest)

type LogoutResult Uses

type LogoutResult struct {
    RedirectTo             string
    FrontChannelLogoutURLs []string
}

Returned when the log out request was used.

swagger:ignore

type Manager Uses

type Manager interface {
    CreateConsentRequest(ctx context.Context, req *ConsentRequest) error
    GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)
    HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)
    RevokeSubjectConsentSession(ctx context.Context, user string) error
    RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error

    VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*HandledConsentRequest, error)
    FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]HandledConsentRequest, error)
    FindSubjectsGrantedConsentRequests(ctx context.Context, user string, limit, offset int) ([]HandledConsentRequest, error)
    CountSubjectsGrantedConsentRequests(ctx context.Context, user string) (int, error)

    // Cookie management
    GetRememberedLoginSession(ctx context.Context, id string) (*LoginSession, error)
    CreateLoginSession(ctx context.Context, session *LoginSession) error
    DeleteLoginSession(ctx context.Context, id string) error
    RevokeSubjectLoginSession(ctx context.Context, user string) error
    ConfirmLoginSession(ctx context.Context, id string, subject string, remember bool) error

    CreateLoginRequest(ctx context.Context, req *LoginRequest) error
    GetLoginRequest(ctx context.Context, challenge string) (*LoginRequest, error)
    HandleLoginRequest(ctx context.Context, challenge string, r *HandledLoginRequest) (*LoginRequest, error)
    VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*HandledLoginRequest, error)

    CreateForcedObfuscatedLoginSession(ctx context.Context, session *ForcedObfuscatedLoginSession) error
    GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)

    ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
    ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

    CreateLogoutRequest(ctx context.Context, request *LogoutRequest) error
    GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
    AcceptLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)
    RejectLogoutRequest(ctx context.Context, challenge string) error
    VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*LogoutRequest, error)
}

type MemoryManager Uses

type MemoryManager struct {
    // contains filtered or unexported fields
}

func NewMemoryManager Uses

func NewMemoryManager(r InternalRegistry) *MemoryManager

func (*MemoryManager) AcceptLogoutRequest Uses

func (m *MemoryManager) AcceptLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)

func (*MemoryManager) ConfirmLoginSession Uses

func (m *MemoryManager) ConfirmLoginSession(ctx context.Context, id string, subject string, remember bool) error

func (*MemoryManager) CountSubjectsGrantedConsentRequests Uses

func (m *MemoryManager) CountSubjectsGrantedConsentRequests(ctx context.Context, subject string) (int, error)

func (*MemoryManager) CreateConsentRequest Uses

func (m *MemoryManager) CreateConsentRequest(ctx context.Context, c *ConsentRequest) error

func (*MemoryManager) CreateForcedObfuscatedLoginSession Uses

func (m *MemoryManager) CreateForcedObfuscatedLoginSession(ctx context.Context, s *ForcedObfuscatedLoginSession) error

func (*MemoryManager) CreateLoginRequest Uses

func (m *MemoryManager) CreateLoginRequest(ctx context.Context, a *LoginRequest) error

func (*MemoryManager) CreateLoginSession Uses

func (m *MemoryManager) CreateLoginSession(ctx context.Context, a *LoginSession) error

func (*MemoryManager) CreateLogoutRequest Uses

func (m *MemoryManager) CreateLogoutRequest(ctx context.Context, r *LogoutRequest) error

func (*MemoryManager) DeleteLoginSession Uses

func (m *MemoryManager) DeleteLoginSession(ctx context.Context, id string) error

func (*MemoryManager) FindGrantedAndRememberedConsentRequests Uses

func (m *MemoryManager) FindGrantedAndRememberedConsentRequests(ctx context.Context, client, subject string) ([]HandledConsentRequest, error)

func (*MemoryManager) FindSubjectsGrantedConsentRequests Uses

func (m *MemoryManager) FindSubjectsGrantedConsentRequests(ctx context.Context, subject string, limit, offset int) ([]HandledConsentRequest, error)

func (*MemoryManager) GetConsentRequest Uses

func (m *MemoryManager) GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)

func (*MemoryManager) GetForcedObfuscatedLoginSession Uses

func (m *MemoryManager) GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)

func (*MemoryManager) GetLoginRequest Uses

func (m *MemoryManager) GetLoginRequest(ctx context.Context, challenge string) (*LoginRequest, error)

func (*MemoryManager) GetLogoutRequest Uses

func (m *MemoryManager) GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)

func (*MemoryManager) GetRememberedLoginSession Uses

func (m *MemoryManager) GetRememberedLoginSession(ctx context.Context, id string) (*LoginSession, error)

func (*MemoryManager) HandleConsentRequest Uses

func (m *MemoryManager) HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)

func (*MemoryManager) HandleLoginRequest Uses

func (m *MemoryManager) HandleLoginRequest(ctx context.Context, challenge string, r *HandledLoginRequest) (*LoginRequest, error)

func (*MemoryManager) ListUserAuthenticatedClientsWithBackChannelLogout Uses

func (m *MemoryManager) ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

func (*MemoryManager) ListUserAuthenticatedClientsWithFrontChannelLogout Uses

func (m *MemoryManager) ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

func (*MemoryManager) RejectLogoutRequest Uses

func (m *MemoryManager) RejectLogoutRequest(ctx context.Context, challenge string) error

func (*MemoryManager) RevokeSubjectClientConsentSession Uses

func (m *MemoryManager) RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error

func (*MemoryManager) RevokeSubjectConsentSession Uses

func (m *MemoryManager) RevokeSubjectConsentSession(ctx context.Context, user string) error

func (*MemoryManager) RevokeSubjectLoginSession Uses

func (m *MemoryManager) RevokeSubjectLoginSession(ctx context.Context, user string) error

func (*MemoryManager) VerifyAndInvalidateConsentRequest Uses

func (m *MemoryManager) VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*HandledConsentRequest, error)

func (*MemoryManager) VerifyAndInvalidateLoginRequest Uses

func (m *MemoryManager) VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*HandledLoginRequest, error)

func (*MemoryManager) VerifyAndInvalidateLogoutRequest Uses

func (m *MemoryManager) VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*LogoutRequest, error)

type OpenIDConnectContext Uses

type OpenIDConnectContext struct {
    // ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.
    // It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.
    //
    // OpenID Connect defines it as follows:
    // > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values
    // that the Authorization Server is being requested to use for processing this Authentication Request, with the
    // values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication
    // performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a
    // Voluntary Claim by this parameter.
    ACRValues []string `json:"acr_values,omitempty"`

    // UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a
    // space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value
    // "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),
    // followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested
    // locales are not supported by the OpenID Provider.
    UILocales []string `json:"ui_locales,omitempty"`

    // Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
    // The defined values are:
    // - page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
    // - popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
    // - touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
    // - wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
    //
    // The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.
    Display string `json:"display,omitempty"`

    // IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the
    // End-User's current or past authenticated session with the Client.
    IDTokenHintClaims map[string]interface{} `json:"id_token_hint_claims,omitempty"`

    // LoginHint hints about the login identifier the End-User might use to log in (if necessary).
    // This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)
    // and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a
    // phone number in the format specified for the phone_number Claim. The use of this parameter is optional.
    LoginHint string `json:"login_hint,omitempty"`
}

Contains optional information about the OpenID Connect request.

swagger:model openIDConnectContext

func (*OpenIDConnectContext) Scan Uses

func (n *OpenIDConnectContext) Scan(value interface{}) error

func (*OpenIDConnectContext) Value Uses

func (n *OpenIDConnectContext) Value() (driver.Value, error)

type PreviousConsentSession Uses

type PreviousConsentSession struct {
    // GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
    GrantedScope sqlxx.StringSlicePipeDelimiter `json:"grant_scope" db:"granted_scope"`

    // GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
    GrantedAudience sqlxx.StringSlicePipeDelimiter `json:"grant_access_token_audience" db:"granted_at_audience"`

    // Session allows you to set (optional) session data for access and ID tokens.
    Session *ConsentRequestSessionData `json:"session" db:"-"`

    // Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
    // client asks the same user for the same, or a subset of, scope.
    Remember bool `json:"remember" db:"remember"`

    // RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
    // authorization will be remembered indefinitely.
    RememberFor int `json:"remember_for" db:"remember_for"`

    // HandledAt contains the timestamp the consent request was handled.
    HandledAt sqlxx.NullTime `json:"handled_at" db:"handled_at"`

    ConsentRequest  *ConsentRequest     `json:"consent_request" db:"-"`
    Error           *RequestDeniedError `json:"-" db:"error"`
    Challenge       string              `json:"-" db:"challenge"`
    RequestedAt     time.Time           `json:"-" db:"requested_at"`
    AuthenticatedAt sqlxx.NullTime      `json:"-" db:"authenticated_at"`
    WasUsed         bool                `json:"-" db:"was_used"`

    SessionIDToken     sqlxx.MapStringInterface `db:"session_id_token" json:"-"`
    SessionAccessToken sqlxx.MapStringInterface `db:"session_access_token" json:"-"`
}

The response used to return used consent requests same as HandledLoginRequest, just with consent_request exposed as json

type Registry Uses

type Registry interface {
    ConsentManager() Manager
    ConsentStrategy() Strategy
    SubjectIdentifierAlgorithm() map[string]SubjectIdentifierAlgorithm
}

type RequestDeniedError Uses

type RequestDeniedError struct {
    // The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`).
    //
    // Defaults to `request_denied`.
    Name string `json:"error"`

    // Description of the error in a human readable format.
    Description string `json:"error_description"`

    // Hint to help resolve the error.
    Hint string `json:"error_hint"`

    // Represents the HTTP status code of the error (e.g. 401 or 403)
    //
    // Defaults to 400
    Code int `json:"status_code"`

    // Debug contains information to help resolve the problem as a developer. Usually not exposed
    // to the public but only in the server logs.
    Debug string `json:"error_debug"`
    // contains filtered or unexported fields
}

The request payload used to accept a login or consent request.

swagger:model rejectRequest

func (*RequestDeniedError) IsError Uses

func (e *RequestDeniedError) IsError() bool

func (*RequestDeniedError) Scan Uses

func (e *RequestDeniedError) Scan(value interface{}) error

func (*RequestDeniedError) SetDefaults Uses

func (e *RequestDeniedError) SetDefaults(name string)

func (*RequestDeniedError) Value Uses

func (e *RequestDeniedError) Value() (driver.Value, error)

type RequestHandlerResponse Uses

type RequestHandlerResponse struct {
    // RedirectURL is the URL which you should redirect the user to once the authentication process is completed.
    //
    // required: true
    RedirectTo string `json:"redirect_to"`
}

The response payload sent when accepting or rejecting a login or consent request.

swagger:model completedRequest

type SQLManager Uses

type SQLManager struct {
    DB *sqlx.DB
    // contains filtered or unexported fields
}

func NewSQLManager Uses

func NewSQLManager(db *sqlx.DB, r InternalRegistry) *SQLManager

func (*SQLManager) AcceptLogoutRequest Uses

func (m *SQLManager) AcceptLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)

func (*SQLManager) ConfirmLoginSession Uses

func (m *SQLManager) ConfirmLoginSession(ctx context.Context, id string, subject string, remember bool) error

func (*SQLManager) CountSubjectsGrantedConsentRequests Uses

func (m *SQLManager) CountSubjectsGrantedConsentRequests(ctx context.Context, subject string) (int, error)

func (*SQLManager) CreateConsentRequest Uses

func (m *SQLManager) CreateConsentRequest(ctx context.Context, c *ConsentRequest) error

func (*SQLManager) CreateForcedObfuscatedLoginSession Uses

func (m *SQLManager) CreateForcedObfuscatedLoginSession(ctx context.Context, s *ForcedObfuscatedLoginSession) error

func (*SQLManager) CreateLoginRequest Uses

func (m *SQLManager) CreateLoginRequest(ctx context.Context, c *LoginRequest) error

func (*SQLManager) CreateLoginSession Uses

func (m *SQLManager) CreateLoginSession(ctx context.Context, a *LoginSession) error

func (*SQLManager) CreateLogoutRequest Uses

func (m *SQLManager) CreateLogoutRequest(ctx context.Context, r *LogoutRequest) error

func (*SQLManager) DeleteLoginSession Uses

func (m *SQLManager) DeleteLoginSession(ctx context.Context, id string) error

func (*SQLManager) FindGrantedAndRememberedConsentRequests Uses

func (m *SQLManager) FindGrantedAndRememberedConsentRequests(ctx context.Context, client, subject string) ([]HandledConsentRequest, error)

func (*SQLManager) FindSubjectsGrantedConsentRequests Uses

func (m *SQLManager) FindSubjectsGrantedConsentRequests(ctx context.Context, subject string, limit, offset int) ([]HandledConsentRequest, error)

func (*SQLManager) GetConsentRequest Uses

func (m *SQLManager) GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)

func (*SQLManager) GetForcedObfuscatedLoginSession Uses

func (m *SQLManager) GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)

func (*SQLManager) GetLoginRequest Uses

func (m *SQLManager) GetLoginRequest(ctx context.Context, challenge string) (*LoginRequest, error)

func (*SQLManager) GetLogoutRequest Uses

func (m *SQLManager) GetLogoutRequest(ctx context.Context, challenge string) (*LogoutRequest, error)

func (*SQLManager) GetRememberedLoginSession Uses

func (m *SQLManager) GetRememberedLoginSession(ctx context.Context, id string) (*LoginSession, error)

func (*SQLManager) HandleConsentRequest Uses

func (m *SQLManager) HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)

func (*SQLManager) HandleLoginRequest Uses

func (m *SQLManager) HandleLoginRequest(ctx context.Context, challenge string, r *HandledLoginRequest) (*LoginRequest, error)

func (*SQLManager) ListUserAuthenticatedClientsWithBackChannelLogout Uses

func (m *SQLManager) ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

func (*SQLManager) ListUserAuthenticatedClientsWithFrontChannelLogout Uses

func (m *SQLManager) ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

func (*SQLManager) RejectLogoutRequest Uses

func (m *SQLManager) RejectLogoutRequest(ctx context.Context, challenge string) error

func (*SQLManager) RevokeSubjectClientConsentSession Uses

func (m *SQLManager) RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error

func (*SQLManager) RevokeSubjectConsentSession Uses

func (m *SQLManager) RevokeSubjectConsentSession(ctx context.Context, user string) error

func (*SQLManager) RevokeSubjectLoginSession Uses

func (m *SQLManager) RevokeSubjectLoginSession(ctx context.Context, user string) error

func (*SQLManager) VerifyAndInvalidateConsentRequest Uses

func (m *SQLManager) VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*HandledConsentRequest, error)

func (*SQLManager) VerifyAndInvalidateLoginRequest Uses

func (m *SQLManager) VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*HandledLoginRequest, error)

func (*SQLManager) VerifyAndInvalidateLogoutRequest Uses

func (m *SQLManager) VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*LogoutRequest, error)

type Strategy Uses

type Strategy interface {
    HandleOAuth2AuthorizationRequest(w http.ResponseWriter, r *http.Request, req fosite.AuthorizeRequester) (*HandledConsentRequest, error)
    HandleOpenIDConnectLogout(w http.ResponseWriter, r *http.Request) (*LogoutResult, error)
}

type SubjectIdentifierAlgorithm Uses

type SubjectIdentifierAlgorithm interface {
    // Obfuscate derives a pairwise subject identifier from the given string.
    Obfuscate(subject string, client *client.Client) (string, error)
}

type SubjectIdentifierAlgorithmPairwise Uses

type SubjectIdentifierAlgorithmPairwise struct {
    Salt []byte
}

func NewSubjectIdentifierAlgorithmPairwise Uses

func NewSubjectIdentifierAlgorithmPairwise(salt []byte) *SubjectIdentifierAlgorithmPairwise

func (*SubjectIdentifierAlgorithmPairwise) Obfuscate Uses

func (g *SubjectIdentifierAlgorithmPairwise) Obfuscate(subject string, client *client.Client) (string, error)

type SubjectIdentifierAlgorithmPublic Uses

type SubjectIdentifierAlgorithmPublic struct{}

func NewSubjectIdentifierAlgorithmPublic Uses

func NewSubjectIdentifierAlgorithmPublic() *SubjectIdentifierAlgorithmPublic

func (*SubjectIdentifierAlgorithmPublic) Obfuscate Uses

func (g *SubjectIdentifierAlgorithmPublic) Obfuscate(subject string, client *client.Client) (string, error)

Package consent imports 38 packages (graph) and is imported by 47 packages. Updated 2020-09-20. Refresh now. Tools for package owners.