func (c *AuthConfig) getOAuthProvider(identityProvider configapi.IdentityProvider) (external.Provider, error) {
switch provider := identityProvider.Provider.(type) {
case (*configapi.GitHubIdentityProvider):
return github.NewProvider(identityProvider.Name, provider.ClientID, provider.ClientSecret, provider.Organizations), nil
case (*configapi.GitLabIdentityProvider):
transport, err := cmdutil.TransportFor(provider.CA, "", "")
if err != nil {
return nil, err
}
return gitlab.NewProvider(identityProvider.Name, transport, provider.URL, provider.ClientID, provider.ClientSecret)
case (*configapi.GoogleIdentityProvider):
return google.NewProvider(identityProvider.Name, provider.ClientID, provider.ClientSecret, provider.HostedDomain)
case (*configapi.OpenIDIdentityProvider):
transport, err := cmdutil.TransportFor(provider.CA, "", "")
if err != nil {
return nil, err
}
// OpenID Connect requests MUST contain the openid scope value
// http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
scopes := sets.NewString("openid")
scopes.Insert(provider.ExtraScopes...)
config := openid.Config{
ClientID: provider.ClientID,
ClientSecret: provider.ClientSecret,
Scopes: scopes.List(),
ExtraAuthorizeParameters: provider.ExtraAuthorizeParameters,
AuthorizeURL: provider.URLs.Authorize,
TokenURL: provider.URLs.Token,
UserInfoURL: provider.URLs.UserInfo,
IDClaims: provider.Claims.ID,
PreferredUsernameClaims: provider.Claims.PreferredUsername,
EmailClaims: provider.Claims.Email,
NameClaims: provider.Claims.Name,
}
return openid.NewProvider(identityProvider.Name, transport, config)
default:
return nil, fmt.Errorf("No OAuth provider found that matches %v. The OAuth server cannot start!", identityProvider)
}
}
func NewProvider(providerName, clientID, clientSecret, hostedDomain string) (external.Provider, error) {
config := openid.Config{
ClientID: clientID,
ClientSecret: clientSecret,
AuthorizeURL: googleAuthorizeURL,
TokenURL: googleTokenURL,
UserInfoURL: googleUserInfoURL,
Scopes: googleOAuthScopes,
IDClaims: []string{"sub"},
PreferredUsernameClaims: []string{"preferred_username", "email"},
EmailClaims: []string{"email"},
NameClaims: []string{"name", "email"},
}
if len(hostedDomain) > 0 {
// Request a specific hosted domain during authorization
config.ExtraAuthorizeParameters = map[string]string{
googleHostedDomain: hostedDomain,
}
// Validate the returned id_token is from that hosted domain
config.IDTokenValidator = func(idToken map[string]interface{}) error {
hdClaim, ok := idToken[googleHostedDomain].(string)
if !ok {
return errors.New("id_token did not contain a hd claim")
}
if hdClaim != hostedDomain {
return fmt.Errorf("id_token hd claim (%s) did not match hostedDomain (%s)", hdClaim, hostedDomain)
}
return nil
}
}
return openid.NewProvider(providerName, nil, config)
}