This repo is a drop-in replacement of golang.org/x/oauth2
It extends the original library with additional authentication methods:
- private_key_jwt
- tls_client_auth
- self_signed_tls_client_auth
Additionally, it also adds utility methods for easy use of PKCE.
When using go modules you can run:
go mod edit -replace golang.org/x/oauth2 github.com/cloudentity/oauth2
When using any of the originally supported authentication methods, there's no need to change anything. This library can be used as a drop-in replacement.
For new authentication methods see the examples below:
import (
"context"
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/advancedauth"
"golang.org/x/oauth2/clientcredentials"
) cfg := clientcredentials.Config{
ClientID: "your client id",
AuthStyle: oauth2.AuthStylePrivateKeyJWT,
PrivateKeyAuth: advancedauth.PrivateKeyAuth{
Key: "your PEM encoded private key",
Algorithm: advancedauth.RS256,
Exp: 30 * time.Second,
},
}
token, err := cfg.Token(context.Background())import (
"context"
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/advancedauth"
) cfg := oauth2.Config{
ClientID: "your client id",
Endpoint: oauth2.Endpoint{
AuthStyle: oauth2.AuthStylePrivateKeyJWT,
},
PrivateKeyAuth: advancedauth.PrivateKeyAuth{
Key: "your PEM encoded private key",
Algorithm: advancedauth.RS256,
Exp: 30 * time.Second,
},
Scopes: []string{"scope1", "scope2"},
},
token, err := cfg.Exchange(context.Background(), "your authorization code")Both tls_client_auth and self_signed_tls_client_auth are handled with TLSAuth
import (
"context"
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/advancedauth"
"golang.org/x/oauth2/clientcredentials"
) cfg := clientcredentials.Config{
ClientID: "your client id",
AuthStyle: oauth2.AuthStyleTLS,
TLSAuth: advancedauth.TLSAuth{
Key: "your certificate PEM encoded private key",
Certificate: "your PEM encoded TLS certificate",
},
}
token, err := cfg.Token(context.Background())import (
"context"
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/advancedauth"
) cfg := oauth2.Config{
ClientID: "your client id",
Endpoint: oauth2.Endpoint{
AuthStyle: oauth2.AuthStyleTLS,
},
TLSAuth: advancedauth.TLSAuth{
Key: "your certificate PEM encoded private key",
Certificate: "your PEM encoded TLS certificate",
},
Scopes: []string{"scope1", "scope2"},
},
token, err := cfg.Exchange(context.Background(), "your authorization code")import (
"context"
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/advancedauth/pkce"
)Create PKCE with
p, err := pkce.New()or, if you want to specify the code challenge method and verifier length
p, err := pkce.NewWithMethodVerifierLength(pkce.512, 84)PKCE exposes few utility methods to ease creating AuthCodeURL
You can use utility methods returning needed AuthCodeOption's
url = conf.AuthCodeURL("state", p.AuthCodeURLOpts()...)
or, individual methods
url := conf.AuthCodeURL("state", p.ChallengeOpt(), p.MethodOpt())
PKCE also exposes similar methods for Exchange
tok, err := conf.Exchange(context.Background(), "exchange-code", p.ExchangeOpts()...)or, with individual methods
tok, err := conf.Exchange(context.Background(), "exchange-code", p.VerifierOpt(), p.MethodOpt())This fork tries to limit changes to the original codebase to the minimum.
All the new major changes are implemented in the advancedauth package.