OpenID Connect SDK (client and server) for Go
What Is It
This project is an easy-to-use client (RP) and server (OP) implementation for the OIDC (OpenID Connect) standard written for Go.
The RP is certified for the basic and config profile.
Whenever possible we tried to reuse / extend existing packages like OAuth2 for Go.
Basic Overview
The most important packages of the library:
Semver
This package uses semver for releases. Major releases ship breaking changes. Starting with the v2 to v3 increment we provide an upgrade guide to ease migration to a newer version.
How To Use It
Check the /example folder where example code for different scenarios is located.
# start oidc op server
# oidc discovery http://localhost:9998/.well-known/openid-configuration
go run github.com/zitadel/oidc/v3/example/server
# start oidc web client (in a new terminal)
CLIENT_ID=web CLIENT_SECRET=secret ISSUER=http://localhost:9998/ SCOPES="openid profile" PORT=9999 go run github.com/zitadel/oidc/v3/example/client/app
- open http://localhost:9999/login in your browser
- you will be redirected to op server and the login UI
- login with user
test-user@localhostand passwordverysecure - the OP will redirect you to the client app, which displays the user info
for the dynamic issuer, just start it with:
go run github.com/zitadel/oidc/v3/example/server/dynamic
the oidc web client above will still work, but if you add oidc.local (pointing to 127.0.0.1) in your hosts file you can also start it with:
CLIENT_ID=web CLIENT_SECRET=secret ISSUER=http://oidc.local:9998/ SCOPES="openid profile" PORT=9999 go run github.com/zitadel/oidc/v3/example/client/app
Note: Usernames are suffixed with the hostname (
test-user@localhostortest-user@oidc.local)
Features
| Relying party | OpenID Provider | Specification | |
|---|---|---|---|
| Code Flow | yes | yes | OpenID Connect Core 1.0, Section 3.1 |
| Implicit Flow | no^1 | yes | OpenID Connect Core 1.0, Section 3.2 |
| Hybrid Flow | no | not yet | OpenID Connect Core 1.0, Section 3.3 |
| Client Credentials | yes | yes | OpenID Connect Core 1.0, Section 9 |
| Refresh Token | yes | yes | OpenID Connect Core 1.0, Section 12 |
| Discovery | yes | yes | OpenID Connect Discovery 1.0 |
| JWT Profile | yes | yes | RFC 7523 |
| PKCE | yes | yes | RFC 7636 |
| Token Exchange | yes | yes | RFC 8693 |
| Device Authorization | yes | yes | RFC 8628 |
| mTLS | not yet | not yet | RFC 8705 |
Contributors
Made with contrib.rocks.
Resources
For your convenience you can find the relevant guides linked below.
Supported Go Versions
For security reasons, we only support and recommend the use of one of the latest two Go versions (:white_check_mark:).
Versions that also build are marked with :warning:.
| Version | Supported |
|---|---|
| <1.21 | :x: |
| 1.21 | :white_check_mark: |
| 1.22 | :white_check_mark: |
Why another library
As of 2020 there are not a lot of OIDC library's in Go which can handle server and client implementations. ZITADEL is strongly committed to the general field of IAM (Identity and Access Management) and as such, we need solid frameworks to implement services.
Goals
Other Go OpenID Connect libraries
https://github.com/coreos/go-oidc
The go-oidc does only support RP and is not feasible to use as OP that's why we could not rely on go-oidc
We did not choose fosite because it implements OAuth 2.0 on its own and does not rely on the golang provided package. Nonetheless this is a great project.
License
The full functionality of this library is and stays open source and free to use for everyone. Visit
our website and get in touch.
See the exact licensing terms here
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "
AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific
language governing permissions and limitations under the License.