Skip to content

Commit

Permalink
google: Add support for OAuth2 token exchange over mTLS
Browse files Browse the repository at this point in the history
With Context Aware Access enabled, users must use the endpoint "https://oauth2.mtls.googleapis.com/token" for token exchange. This PR adds support for runtime configuration of the OAuth2 token endpoint (as determined by the caller). If using the mTLS oauth2 endpoint, the caller will also need to specify an mTLS-enabled HTTPClient via the "context" mechanism for use by the OAuth2 transport.

Change-Id: Ic83342ec1d224d3acdabf00d863249330424fc54
GitHub-Last-Rev: 07e4849
GitHub-Pull-Request: #630
Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/470396
Run-TryBot: Matthew Hickford <[email protected]>
Reviewed-by: Shin Fan <[email protected]>
Run-TryBot: Shin Fan <[email protected]>
Reviewed-by: Matthew Hickford <[email protected]>
Reviewed-by: Andy Zhao <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
  • Loading branch information
andyrzhao authored and shinfan committed Mar 3, 2023
1 parent 6f9c1a1 commit 885f294
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
4 changes: 4 additions & 0 deletions google/default.go
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,10 @@ type CredentialsParams struct {

// PKCE is used to support PKCE flow. Optional for 3LO flow.
PKCE *authhandler.PKCEParams

// The OAuth2 TokenURL default override. This value overrides the default TokenURL,
// unless explicitly specified by the credentials config file. Optional.
TokenURL string
}

func (params CredentialsParams) deepCopy() CredentialsParams {
Expand Down
9 changes: 8 additions & 1 deletion google/google.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ var Endpoint = oauth2.Endpoint{
AuthStyle: oauth2.AuthStyleInParams,
}

// MTLSTokenURL is Google's OAuth 2.0 default mTLS endpoint.
const MTLSTokenURL = "https://oauth2.mtls.googleapis.com/token"

// JWTTokenURL is Google's OAuth 2.0 token URL to use with the JWT flow.
const JWTTokenURL = "https://oauth2.googleapis.com/token"

Expand Down Expand Up @@ -172,7 +175,11 @@ func (f *credentialsFile) tokenSource(ctx context.Context, params CredentialsPar
cfg.Endpoint.AuthURL = Endpoint.AuthURL
}
if cfg.Endpoint.TokenURL == "" {
cfg.Endpoint.TokenURL = Endpoint.TokenURL
if params.TokenURL != "" {
cfg.Endpoint.TokenURL = params.TokenURL
} else {
cfg.Endpoint.TokenURL = Endpoint.TokenURL
}
}
tok := &oauth2.Token{RefreshToken: f.RefreshToken}
return cfg.TokenSource(ctx, tok), nil
Expand Down

0 comments on commit 885f294

Please sign in to comment.