https://github.com/udhos/groupcache_oidcpismo implements the OIDC flow for Pismo while cacheing tokens with distributed cache groupcache.
See:
https://developers.pismo.io/pismo-docs/docs/authentication-with-openid#generate-your-jwt
https://developers.pismo.io/pismo-docs/reference/post-passport-v1-oauth2-token-1
Create an HTTP client that can automatically obtain and refresh OIDC tokens for Pismo, while managing cached tokens in distributed cache groupcache.
NOTE: Do not forget to add the required header x-account-id.
privKeyPem, errRead := os.ReadFile("key-priv.pem")
privKey, errParse := jwt.ParseRSAPrivateKeyFromPEM(privKeyPem)
opt := oidcpismo.Options{
TokenURL: "https://sandbox.pismolabs.io/passport/v1/oauth2/token",
Client: http.DefaultClient,
PrivKey: privKey,
TenantID: "tenant-id",
Pismo: map[string]any{
"group": "pismo-v1:some-samplegroup:rw",
},
CustomClaims: map[string]any{
"custom1": "someValue",
"userexample": "user@user.com",
},
Issuer: "issuer",
Subject: "subject",
Audience: "audience",
Expire: time.Hour,
}
options := oidc.Options{
Options: opt,
GroupcacheWorkspace: groupcacheWorkspace,
}
client := oidc.New(options)
req, errReq := http.NewRequestWithContext(context.TODO(), "GET",
"http://example.com", nil)
req.Header.Add("x-account-id", "some-account-id")
resp, errDo = client.Do(req)See cmd/groupcache-oidcpismo-client-example/main.go for a complete example.
Start the token server oidcpismo-server from project https://github.com/udhos/oidcpismo:
oidcpismo-serverRun the example client:
groupcache-oidcpismo-client-example