go-oidc

go-oidc

OpenID Connect is a specification on top of OAuth 2.0 that adds a provider-agnostic API for user attributes. End users perform the regular OAuth 2.0 flow and the response includes a JWT signed by the identity provider with standard claims for a stable identifier, email, display name, and other attributes.

{
  "sub": "12345abcd",
  "email": "[email protected]",
  "email_verified": true,
  "name": "Jane Doe"
}

This package can be used to identify users (and even workload identities) across a large number of identity providers:

• Consumer
  • Google
  • Apple (Sign in with Apple)
  • Microsoft
  • Facebook Login
  • LinkedIn
• Enterprise
  • Microsoft Entra ID
  • Okta
  • Auth0
  • Amazon Cognito
  • OneLogin
• Workload
  • GitHub Actions
  • GitLab CI/CD (ID tokens)
  • Google Cloud Workload Identity Federation
  • AWS (IAM OIDC identity providers)
  • Kubernetes (service account / OIDC tokens)
  • HashiCorp HCP Terraform

go-oidc is a mature OpenID Connect client, and is imported by over 1000 open source projects.

OpenID Connect support for Go

This package enables OpenID Connect support for the golang.org/x/oauth2 package. The client can be initialized through OpenID Connect discovery with the issuer URL and a few additional scopes on the oauth2.Config.

…

OAuth2 redirects are unchanged.

func handleRedirect(w http.ResponseWriter, r *http.Request) {
    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
}

Then, on the response, the ID Token verifier can be used to verify ID Tokens.

…