DexIdP架构

// Connector is an object that contains the metadata about connectors used to login to Dex.
type Connector struct {
    // ID that will uniquely identify the connector object.
    ID string `json:"id"`
    // The Type of the connector. E.g. 'oidc' or 'ldap'
    Type string `json:"type"`
    // The Name of the connector that is used when displaying it to the end user.
    Name string `json:"name"`
    // ResourceVersion is the static versioning used to keep track of dynamic configuration
    // changes to the connector object made by the API calls.
    ResourceVersion string `json:"resourceVersion"`
    // Config holds all the configuration information specific to the connector type. Since there
    // no generic struct we can use for this purpose, it is stored as a byte stream.
    //
    // NOTE: This is a bug. The JSON tag should be `config`.
    // However, fixing this requires migrating Kubernetes objects for all previously created connectors,
    // or making Dex reading both tags and act accordingly.
    Config []byte `json:"email"`
}

func (c *conn) CreateConnector(connector storage.Connector) error {
    _, err := c.Exec(`
        insert into connector (
            id, type, name, resource_version, config
        )
        values (
            $1, $2, $3, $4, $5
        );
    `,
        connector.ID, connector.Type, connector.Name, connector.ResourceVersion, connector.Config,
    )
    if err != nil {
        if c.alreadyExistsCheck(err) {
            return storage.ErrAlreadyExists
        }
        return fmt.Errorf("insert connector: %v", err)
    }
    return nil
}

const (
    resourceAuthCode        = "authcodes"
    resourceAuthRequest     = "authrequests"
    resourceClient          = "oauth2clients"
    resourceRefreshToken    = "refreshtokens"
    resourceKeys            = "signingkeies" // Kubernetes attempts to pluralize.
    resourcePassword        = "passwords"
    resourceOfflineSessions = "offlinesessionses" // Again attempts to pluralize.
    resourceConnector       = "connectors"
    resourceDeviceRequest   = "devicerequests"
    resourceDeviceToken     = "devicetokens"
)

func (cli *client) CreateConnector(c storage.Connector) error {
    return cli.post(resourceConnector, cli.fromStorageConnector(c))
}

// Claims represents the ID Token claims supported by the server.
type Claims struct {
    UserID            string
    Username          string
    PreferredUsername string
    Email             string
    EmailVerified     bool

    Groups []string
}

// handleAuthorization handles the OAuth2 auth endpoint.
func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
    // Extract the arguments
    if err := r.ParseForm(); err != nil {
        s.logger.Errorf("Failed to parse arguments: %v", err)

        s.renderError(r, w, http.StatusBadRequest, err.Error())
        return
    }

    connectorID := r.Form.Get("connector_id")

    connectors, err := s.storage.ListConnectors()
    if err != nil {
        s.logger.Errorf("Failed to get list of connectors: %v", err)
        s.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve connector list.")
        return
    }

    // We don't need connector_id any more
    r.Form.Del("connector_id")

    // Construct a URL with all of the arguments in its query
    connURL := url.URL{
        RawQuery: r.Form.Encode(),
    }

    // Redirect if a client chooses a specific connector_id
    if connectorID != "" {
        for _, c := range connectors {
            if c.ID == connectorID {
                connURL.Path = s.absPath("/auth", url.PathEscape(c.ID))
                http.Redirect(w, r, connURL.String(), http.StatusFound)
                return
            }
        }
        s.renderError(r, w, http.StatusBadRequest, "Connector ID does not match a valid Connector")
        return
    }

    if len(connectors) == 1 && !s.alwaysShowLogin {
        connURL.Path = s.absPath("/auth", url.PathEscape(connectors[0].ID))
        http.Redirect(w, r, connURL.String(), http.StatusFound)
    }

    connectorInfos := make([]connectorInfo, len(connectors))
    for index, conn := range connectors {
        connURL.Path = s.absPath("/auth", url.PathEscape(conn.ID))
        connectorInfos[index] = connectorInfo{
            ID:   conn.ID,
            Name: conn.Name,
            Type: conn.Type,
            URL:  template.URL(connURL.String()),
        }
    }

    if err := s.templates.login(r, w, connectorInfos); err != nil {
        s.logger.Errorf("Server template error: %v", err)
    }
}

provider, err := oidc.NewProvider(ctx, issuerURL)
if err != nil {
    return fmt.Errorf("failed to query provider %q: %v", issuerURL, err)
}

func (a *app) oauth2Config(scopes []string) *oauth2.Config {
    return &oauth2.Config{
        ClientID:     a.clientID,
        ClientSecret: a.clientSecret,
        Endpoint:     a.provider.Endpoint(),
        Scopes:       scopes,
        RedirectURL:  a.redirectURI,
    }
}

// Configure the OAuth2 config with the client values.
oauth2Config := oauth2.Config{
    // client_id and client_secret of the client.
    ClientID:     "example-app",
    ClientSecret: "example-app-secret",

    // The redirectURL.
    RedirectURL: "http://127.0.0.1:5555/callback",

    // Discovery returns the OAuth2 endpoints.
    Endpoint: provider.Endpoint(),

    // "openid" is a required scope for OpenID Connect flows.
    //
    // Other scopes, such as "groups" can be requested.
    Scopes: []string{oidc.ScopeOpenID, "profile", "email", "groups"},
}

// Create an ID token parser.
idTokenVerifier := provider.Verifier(&oidc.Config{ClientID: "example-app"})

```
The HTTP server should then redirect unauthenticated users to dex to initialize the OAuth2 flow.
```
// handleRedirect is used to start an OAuth2 flow with the dex server.
func handleRedirect(w http.ResponseWriter, r *http.Request) {
    state := newState()
    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
}

func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
    state := r.URL.Query().Get("state")

    // Verify state.

    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
    if err != nil {
        // handle error
    }

    // Extract the ID Token from OAuth2 token.
    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
    if !ok {
        // handle missing token
    }

    // Parse and verify ID Token payload.
    idToken, err := idTokenVerifier.Verify(ctx, rawIDToken)
    if err != nil {
        // handle error
    }

    // Extract custom claims.
    var claims struct {
        Email    string   `json:"email"`
        Verified bool     `json:"email_verified"`
        Groups   []string `json:"groups"`
    }
    if err := idToken.Claims(&claims); err != nil {
        // handle error
    }
}