使用Golang实现OpenID Connect认证：oidc库指南

OpenID Connect (OIDC) 是构建在OAuth 2.0之上的身份认证层，允许客户端验证用户的身份并获取基本用户信息。在Go语言中，coreos/go-oidc库提供了实现OIDC客户端和服务端的便捷方式。

安装oidc库

go get github.com/coreos/go-oidc/v3/oidc

客户端实现

1. 基本配置

package main

import (
	"context"
	"log"
	"net/http"

	"github.com/coreos/go-oidc/v3/oidc"
	"golang.org/x/oauth2"
)

var (
	clientID     = "your-client-id"
	clientSecret = "your-client-secret"
	redirectURL  = "http://localhost:8080/auth/callback"
	
	// 例如: https://accounts.google.com
	issuerURL    = "your-oidc-provider-url"
)

func main() {
	ctx := context.Background()
	
	// 初始化provider
	provider, err := oidc.NewProvider(ctx, issuerURL)
	if err != nil {
		log.Fatal(err)
	}

	// 配置OAuth2
	oauth2Config := oauth2.Config{
		ClientID:     clientID,
		ClientSecret: clientSecret,
		RedirectURL:  redirectURL,
		Endpoint:     provider.Endpoint(),
		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
	}

	// 初始化oidc配置
	oidcConfig := &oidc.Config{
		ClientID: clientID,
	}

	verifier := provider.Verifier(oidcConfig)

	// 设置HTTP路由
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		// 生成随机state防止CSRF攻击
		state := "random-state"
		http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
	})

	http.HandleFunc("/auth/callback", func(w http.ResponseWriter, r *http.Request) {
		// 验证state
		if r.URL.Query().Get("state") != "random-state" {
			http.Error(w, "Invalid state", http.StatusBadRequest)
			return
		}

		// 交换授权码获取token
		oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
		if err != nil {
			http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
			return
		}

		// 提取ID Token
		rawIDToken, ok := oauth2Token.Extra("id_token").(string)
		if !ok {
			http.Error(w, "No id_token field in oauth2 token.", http.StatusInternalServerError)
			return
		}

		// 验证ID Token
		idToken, err := verifier.Verify(ctx, rawIDToken)
		if err != nil {
			http.Error(w, "Failed to verify ID Token: "+err.Error(), http.StatusInternalServerError)
			return
		}

		// 提取用户信息
		var claims struct {
			Email    string `json:"email"`
			Name     string `json:"name"`
			Picture  string `json:"picture"`
		}
		if err := idToken.Claims(&claims); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}

		// 在这里处理用户认证逻辑...
		w.Write([]byte("Hello, " + claims.Name))
	})

	log.Fatal(http.ListenAndServe(":8080", nil))
}

服务端实现

虽然OIDC服务端通常由专门的身份提供商(如Keycloak, Auth0等)实现，但我们可以使用oidc库来验证令牌：

package main

import (
	"context"
	"log"
	"net/http"

	"github.com/coreos/go-oidc/v3/oidc"
)

var (
	issuerURL = "your-oidc-provider-url"
	clientID  = "your-client-id"
)

func main() {
	ctx := context.Background()
	
	provider, err := oidc.NewProvider(ctx, issuerURL)
	if err != nil {
		log.Fatal(err)
	}

	verifier := provider.Verifier(&oidc.Config{ClientID: clientID})

	http.HandleFunc("/protected", func(w http.ResponseWriter, r *http.Request) {
		// 从Authorization头获取token
		rawToken := r.Header.Get("Authorization")
		if rawToken == "" {
			http.Error(w, "Authorization header required", http.StatusUnauthorized)
			return
		}

		// 验证token
		token, err := verifier.Verify(ctx, rawToken)
		if err != nil {
			http.Error(w, "Invalid token: "+err.Error(), http.StatusUnauthorized)
			return
		}

		// 提取claims
		var claims struct {
			Email    string `json:"email"`
			Name     string `json:"name"`
		}
		if err := token.Claims(&claims); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}

		// 在这里处理授权逻辑...
		w.Write([]byte("Protected resource accessed by: " + claims.Name))
	})

	log.Fatal(http.ListenAndServe(":8081", nil))
}

高级用法

1. 自定义claims验证

type customClaims struct {
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
}

func verifyToken(ctx context.Context, verifier *oidc.IDTokenVerifier, rawToken string) (*customClaims, error) {
	token, err := verifier.Verify(ctx, rawToken)
	if err != nil {
		return nil, err
	}

	var claims customClaims
	if err := token.Claims(&claims); err != nil {
		return nil, err
	}

	if !claims.EmailVerified {
		return nil, fmt.Errorf("email not verified")
	}

	return &claims, nil
}

2. 刷新令牌

func refreshToken(ctx context.Context, oauth2Config oauth2.Config, refreshToken string) (*oauth2.Token, error) {
	token := &oauth2.Token{
		RefreshToken: refreshToken,
		Expiry:       time.Now().Add(-time.Hour), // 强制过期
	}
	
	return oauth2Config.TokenSource(ctx, token).Token()
}

安全注意事项

1. 始终验证state参数以防止CSRF攻击
2. 使用HTTPS保护所有通信
3. 安全存储客户端密钥和令牌
4. 设置适当的令牌有效期
5. 实现令牌撤销机制

通过go-oidc库，我们可以相对容易地在Go应用中实现OpenID Connect认证流程。无论是构建客户端还是验证令牌的服务端组件，该库都提供了简洁的API来处理OIDC协议的大部分复杂性。