oauth2cli
oauth2cli copied to clipboard
[WIP] Add Implicit Grant Flow support
Add implicit flow support in the library for oauth2 and openid connect.
The way it works is the following:
- Start a local TLS server.
- Open a browser and navigate it to the local server.
- Wait for the user authorization.
- Receive a token via an authorization response (HTTP redirect).
- Post the URL fragment via JavaScript to a local endpoint.
- Return the token.
Point 5. is needed, because the browsers don't send the URL fragment, when they do a GET after a HTTP Redirect.
The new public functions introduced are in implicit.go.
Unfortunately to keep backwards compatibility I could not refactor some of the server fields in the Config struct, so I had to copy them to a dedicated struct.
An example of using the library has been added as well.
This is marked as WIP due to several reasons:
- more tests are needed
-
token,id_tokenortoken id_tokenhave different requirements when doing the request and receiving the response (e.g. you have to use the scopeopenidwhen requestingid_token,redirect_uriis required for openid connect and more). Therefore would it make more sense to move those functions to separate packages and each having a dedicated struct?
More info https://tools.ietf.org/html/rfc6749#section-4.2 https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth