simplify oidc middleware

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

oidc/claims.go

@@ -171,58 +171,3 @@ type StandardClaims struct {
 	Address    map[string]interface{} `json:"address,omitempty"`
 	KCIdentity map[string]string      `json:"kc.identity,omitempty"`
 }
-
-// The IntrospectionResponse is a JSON object [RFC7159] in
-// "application/json" format with the following top-level members.
-// see https://tools.ietf.org/html/rfc7662#section-2.2
-type IntrospectionResponse struct {
-	// REQUIRED.  Boolean indicator of whether or not the presented token
-	// is currently active.  The specifics of a token's "active" state
-	// will vary depending on the implementation of the authorization
-	// server and the information it keeps about its tokens, but a "true"
-	// value return for the "active" property will generally indicate
-	// that a given token has been issued by this authorization server,
-	// has not been revoked by the resource owner, and is within its
-	// given time window of validity (e.g., after its issuance time and
-	// before its expiration time).  See Section 4 for information on
-	// implementation of such checks.
-	Active bool `json:"active"`
-	// OPTIONAL.  A JSON string containing a space-separated list of
-	// scopes associated with this token, in the format described in
-	// Section 3.3 of OAuth 2.0 [RFC6749].
-	Scope string `json:"scope,omitempty"`
-	// OPTIONAL.  Client identifier for the OAuth 2.0 client that
-	// requested this token.
-	ClientID string `json:"client_id,omitempty"`
-	// OPTIONAL.  Human-readable identifier for the resource owner who
-	// authorized this token.
-	Username string `json:"username,omitempty"`
-	// OPTIONAL.  Type of the token as defined in Section 5.1 of OAuth
-	// 2.0 [RFC6749].
-	TokenType string `json:"token_type,omitempty"`
-	// OPTIONAL.  Integer timestamp, measured in the number of seconds
-	// since January 1 1970 UTC, indicating when this token will expire,
-	// as defined in JWT [RFC7519].
-	Exp int64 `json:"exp,omitempty"`
-	// OPTIONAL.  Integer timestamp, measured in the number of seconds
-	// since January 1 1970 UTC, indicating when this token was
-	// originally issued, as defined in JWT [RFC7519].
-	Iat int64 `json:"iat,omitempty"`
-	// OPTIONAL.  Integer timestamp, measured in the number of seconds
-	// since January 1 1970 UTC, indicating when this token is not to be
-	// used before, as defined in JWT [RFC7519].
-	Nbf int64 `json:"nbf,omitempty"`
-	// OPTIONAL.  Subject of the token, as defined in JWT [RFC7519].
-	// Usually a machine-readable identifier of the resource owner who
-	// authorized this token.
-	Sub string `json:"sub,omitempty"`
-	// OPTIONAL.  Service-specific string identifier or list of string
-	// identifiers representing the intended audience for this token, as
-	// defined in JWT [RFC7519].
-	Aud string `json:"aud,omitempty"`
-	// OPTIONAL.  String representing the issuer of this token, as
-	// defined in JWT [RFC7519].
-	Iss string `json:"iss,omitempty"`
-	// OPTIONAL.  String identifier for the token, as defined in JWT [RFC7519].
-	Jti string `json:"jti,omitempty"`
-}

oidc/option.go

@@ -15,18 +15,10 @@ type Options struct {
 	Endpoint string
 	// Realm to use in the WWW-Authenticate header, defaults to Endpoint
 	Realm string
-	// Audience to use when checking jwt based tokens
-	Audience string
 	// SigningAlgs to use when verifying jwt signatures, defaults to "RS256" & "PS256"
 	SigningAlgs []string
-	// ClientId to use as username for basic auth against the introspection endpoint
-	ClientID string
-	// ClientSecret to use as password for basic auth against the introspection endpoint
-	ClientSecret string
 	// Insecure can be used to disable http certificate checks
 	Insecure bool
-	// SkipCheck can be used to further reduce security. Fix that!
-	SkipChecks bool
 }
 
 // Logger provides a function to set the logger option.
@@ -50,13 +42,6 @@ func Realm(r string) Option {
 	}
 }
 
-// Audience provides a function to set the audience option.
-func Audience(a string) Option {
-	return func(o *Options) {
-		o.Audience = a
-	}
-}
-
 // SigningAlgs provides a function to set the signing algorithms option.
 func SigningAlgs(sa []string) Option {
 	return func(o *Options) {
@@ -64,30 +49,9 @@ func SigningAlgs(sa []string) Option {
 	}
 }
 
-// ClientID provides a function to set the client id option.
-func ClientID(ci string) Option {
-	return func(o *Options) {
-		o.ClientID = ci
-	}
-}
-
-// ClientSecret provides a function to set the client secret option.
-func ClientSecret(cs string) Option {
-	return func(o *Options) {
-		o.ClientSecret = cs
-	}
-}
-
 // Insecure provides a function to set the insecure option.
 func Insecure(i bool) Option {
 	return func(o *Options) {
 		o.Insecure = i
 	}
 }
-
-// SkipChecks provides a function to set the ready option.
-func SkipChecks(sc bool) Option {
-	return func(o *Options) {
-		o.SkipChecks = sc
-	}
-}