mirror of
https://github.com/hanzo-fi/go-libs.git
synced 2026-10-30 20:53:44 +00:00
98a1daef0b
Port of 6b44d66 from release/v2.2 to v3.6, adapted to the v3 oidc package APIs. Allow configuring multiple OIDC issuers so that tokens from different identity providers (e.g. during a domain migration) are all accepted. - Add --auth-issuers flag (comma-separated) alongside existing --auth-issuer - Build one KeySet per issuer via OIDC discovery - Pre-parse tokens to route to the correct issuer's key set - Fail startup when auth is enabled but no issuers are configured Co-authored-by: Claude Opus 4.6 <[email protected]>
56 lines
1.8 KiB
Go
56 lines
1.8 KiB
Go
package jwt
|
|
|
|
import (
|
|
flag "github.com/spf13/pflag"
|
|
)
|
|
|
|
const (
|
|
AuthEnabledFlag = "auth-enabled"
|
|
AuthIssuerFlag = "auth-issuer"
|
|
AuthIssuersFlag = "auth-issuers"
|
|
AuthReadKeySetMaxRetriesFlag = "auth-read-key-set-max-retries"
|
|
AuthCheckScopesFlag = "auth-check-scopes"
|
|
AuthServiceFlag = "auth-service"
|
|
)
|
|
|
|
func AddFlags(flags *flag.FlagSet) {
|
|
flags.Bool(AuthEnabledFlag, false, "Enable auth")
|
|
flags.String(AuthIssuerFlag, "", "Issuer (single issuer, for backward compatibility)")
|
|
flags.StringSlice(AuthIssuersFlag, nil, "Trusted issuers (comma-separated, e.g. --auth-issuers=https://issuer1,https://issuer2)")
|
|
flags.Int(AuthReadKeySetMaxRetriesFlag, 10, "ReadKeySetMaxRetries")
|
|
flags.Bool(AuthCheckScopesFlag, false, "CheckScopes")
|
|
flags.String(AuthServiceFlag, "", "Service")
|
|
}
|
|
|
|
func ConfigFromFlags(flags *flag.FlagSet) Config {
|
|
authEnabled, _ := flags.GetBool(AuthEnabledFlag)
|
|
authIssuer, _ := flags.GetString(AuthIssuerFlag)
|
|
authIssuers, _ := flags.GetStringSlice(AuthIssuersFlag)
|
|
authReadKeySetMaxRetries, _ := flags.GetInt(AuthReadKeySetMaxRetriesFlag)
|
|
authCheckScopes, _ := flags.GetBool(AuthCheckScopesFlag)
|
|
authService, _ := flags.GetString(AuthServiceFlag)
|
|
|
|
// Merge --auth-issuer into --auth-issuers for backward compatibility
|
|
if authIssuer != "" {
|
|
found := false
|
|
for _, iss := range authIssuers {
|
|
if iss == authIssuer {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
authIssuers = append(authIssuers, authIssuer)
|
|
}
|
|
}
|
|
|
|
return Config{
|
|
Enabled: authEnabled,
|
|
Issuers: authIssuers,
|
|
ReadKeySetMaxRetries: authReadKeySetMaxRetries,
|
|
CheckScopes: authCheckScopes,
|
|
Service: authService,
|
|
AdditionalChecks: make([]AdditionalCheck, 0),
|
|
}
|
|
}
|