initial commit

pkg/oidc/grants/client_credentials.go

@@ -0,0 +1,33 @@
+package grants
+
+import "strings"
+
+type clientCredentialsGrantBasic struct {
+	grantType string `schema:"grant_type"`
+	scope     string `schema:"scope"`
+}
+
+type clientCredentialsGrant struct {
+	*clientCredentialsGrantBasic
+	clientID     string `schema:"client_id"`
+	clientSecret string `schema:"client_secret"`
+}
+
+//ClientCredentialsGrantBasic creates an oauth2 `Client Credentials` Grant
+//sneding client_id and client_secret as basic auth header
+func ClientCredentialsGrantBasic(scopes ...string) *clientCredentialsGrantBasic {
+	return &clientCredentialsGrantBasic{
+		grantType: "client_credentials",
+		scope:     strings.Join(scopes, " "),
+	}
+}
+
+//ClientCredentialsGrantValues creates an oauth2 `Client Credentials` Grant
+//sneding client_id and client_secret as form values
+func ClientCredentialsGrantValues(clientID, clientSecret string, scopes ...string) *clientCredentialsGrant {
+	return &clientCredentialsGrant{
+		clientCredentialsGrantBasic: ClientCredentialsGrantBasic(scopes...),
+		clientID:                    clientID,
+		clientSecret:                clientSecret,
+	}
+}

pkg/oidc/grants/tokenexchange/tokenexchange.go

@@ -0,0 +1,75 @@
+package tokenexchange
+
+const (
+	AccessTokenType     = "urn:ietf:params:oauth:token-type:access_token"
+	RefreshTokenType    = "urn:ietf:params:oauth:token-type:refresh_token"
+	IDTokenType         = "urn:ietf:params:oauth:token-type:id_token"
+	JWTTokenType        = "urn:ietf:params:oauth:token-type:jwt"
+	DelegationTokenType = AccessTokenType
+
+	TokenExchangeGrantType = "urn:ietf:params:oauth:grant-type:token-exchange"
+)
+
+type TokenExchangeRequest struct {
+	grantType          string   `schema:"grant_type"`
+	subjectToken       string   `schema:"subject_token"`
+	subjectTokenType   string   `schema:"subject_token_type"`
+	actorToken         string   `schema:"actor_token"`
+	actorTokenType     string   `schema:"actor_token_type"`
+	resource           []string `schema:"resource"`
+	audience           []string `schema:"audience"`
+	scope              []string `schema:"scope"`
+	requestedTokenType string   `schema:"requested_token_type"`
+}
+
+func NewTokenExchangeRequest(subjectToken, subjectTokenType string, opts ...TokenExchangeOption) *TokenExchangeRequest {
+	t := &TokenExchangeRequest{
+		grantType:          TokenExchangeGrantType,
+		subjectToken:       subjectToken,
+		subjectTokenType:   subjectTokenType,
+		requestedTokenType: AccessTokenType,
+	}
+	for _, opt := range opts {
+		opt(t)
+	}
+	return t
+}
+
+type TokenExchangeOption func(*TokenExchangeRequest)
+
+func WithActorToken(token, tokenType string) func(*TokenExchangeRequest) {
+	return func(req *TokenExchangeRequest) {
+		req.actorToken = token
+		req.actorTokenType = tokenType
+	}
+}
+
+func WithAudience(audience []string) func(*TokenExchangeRequest) {
+	return func(req *TokenExchangeRequest) {
+		req.audience = audience
+	}
+}
+
+func WithGrantType(grantType string) TokenExchangeOption {
+	return func(req *TokenExchangeRequest) {
+		req.grantType = grantType
+	}
+}
+
+func WithRequestedTokenType(tokenType string) func(*TokenExchangeRequest) {
+	return func(req *TokenExchangeRequest) {
+		req.requestedTokenType = tokenType
+	}
+}
+
+func WithResource(resource []string) func(*TokenExchangeRequest) {
+	return func(req *TokenExchangeRequest) {
+		req.resource = resource
+	}
+}
+
+func WithScope(scope []string) func(*TokenExchangeRequest) {
+	return func(req *TokenExchangeRequest) {
+		req.scope = scope
+	}
+}