OpenID Connect for IBM w3id

This is support code for authenticating using IBM's internal OpenID Connect authentication servers.

The OpenID Connect parameters for w3ID are taken from environment variables:

	W3ID_CLIENTID
W3ID_CLIENTSECRET
W3ID_CALLBACKURL

Example usage:

w3id := ibmoidc.NewIntranetAuthenticator()

http.Handle("/login", w3id.BeginLogin())
	http.Handle("/openid/code", w3id.CompleteLogin(myauthhandler))

where W3ID_CALLBACKURL is https://www.example.com/openid/code on your web app.

The http.Handler myauthhandler can then do:

claimset, ok := ibmoidc.ClaimSetFromRequest(r) // r is the http.Request

The claimset will contain the the authenticated information from w3ID. At that point it's up to you to work out some way to persist it via a session, cookies, or whatever.

The useful claimset keys are generally given_name, family_name, email, name, sub and blueGroups.

# Functions

ClaimSetFromRequest

ClaimSetFromRequest obtains the authenticated claimset from the request's context, where it was stored earlier by RequestWithClaimSet.

Decode

Decode unpacks an id_token payload, as returned from the token endpoint, from its raw base64-encoded value.

MakeCSRFcookie

MakeCSRFcookie turns a string generated by MakeCSRFtoken into a CSRF cookie.

MakeCSRFtoken

MakeCSRFtoken makes a random 32-character string for use as a CSRF token.

NewIntranetAuthenticator

NewIntranetAuthenticator creates an Authenticator object for processing intranet w3ID authentication server responses.

NewIntranetStagingAuthenticator

NewIntranetStagingAuthenticator creates an Authenticator object for processing intranet w3ID authentication server responses from the staging server.

ReadCSRFcookie

ReadCSRFcookie gets the token from the CSRF cookie, if found.

RequestWithClaimSet

RequestWithClaimSet adds a claimset to the http request, using a private context key.

UnmarshalJSON

UnmarshalJSON turns a JSON payload from a JWS token into a set of claims, and handles remapping IBM-specific private claims to standard ones: lastName → family_name firstName → given_name cn → name dn → sub emailAddress → email The original emailAddress claim is left intact, as are the dn and realmName claims.