admin

OIDC authentication middleware that validates bearer tokens against configured issuer URLs and grants access based on group membership.

Quickstart

package main

import (
    "log/slog"
    "net/http"
    "os"

    "github.com/corticph/gocomo/admin"
)

func main() {
    logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))

    mw, err := admin.NewMiddleware(logger)
    if err != nil {
        logger.Error("Failed to create admin middleware", "error", err)
        os.Exit(1)
    }

    handler := mw(http.HandlerFunc(adminHandler))
    if err := http.ListenAndServe(":8080", handler); err != nil {
        logger.Error("Server failed", "error", err)
        os.Exit(1)
    }
}

func adminHandler(w http.ResponseWriter, r *http.Request) {
    w.WriteHeader(http.StatusOK)
}

Configuration

The middleware is configured entirely via environment variables:

Variable	Description
`ADMIN_OIDC_ISSUER_URLS`	Comma-delimited list of allowed OIDC issuer URLs.
`ADMIN_GROUPS`	Comma-delimited list of groups in the `groups` claim that are granted admin permissions.
`ADMIN_OIDC_CLIENT_ID`	Optional OIDC client ID. If set, tokens must be issued to this audience; if empty, the audience check is skipped.

Behavior

Initialization — NewMiddleware performs OIDC discovery for each configured issuer and pre-fetches the JWKS endpoint. If discovery or JWKS fetch fails, the function returns an error so the service fails fast at startup.
Request — The middleware extracts the Bearer token from the Authorization header, verifies it against each configured issuer's verifier, and checks the groups claim for membership in at least one required group.
Rejection — If the token is missing, invalid, or the user is not in a required group, the middleware writes admin.ErrUnauthorized to the response with HTTP 401 (token issues) or 403 (valid token, wrong groups).