Function ResolveIssuer

coderd/authlink/authlink.go:80–111

ResolveIssuer uses OIDC discovery to fetch the canonical issuer string from the provider's .well-known/openid-configuration endpoint. This does not require OIDC client credentials. This works the same as `oidc.NewProvider`. The `oidc` package does not expose a method to extract the Issuer. So we ha

(ctx context.Context, cli *http.Client, issuerURL string)

// expose a method to extract the Issuer. So we have to manually make the
// http request.
func ResolveIssuer(ctx context.Context, cli *http.Client, issuerURL string) (string, error) {
	wellKnownURL, err := url.JoinPath(issuerURL, "/.well-known/openid-configuration")
	if err != nil {
		return "", xerrors.Errorf("resolve issuer URL: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wellKnownURL, nil)
	if err != nil {
		return "", xerrors.Errorf("create discovery request: %w", err)
	}

	resp, err := cli.Do(req)
	if err != nil {
		return "", xerrors.Errorf("fetch OIDC discovery document: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", xerrors.Errorf("OIDC discovery returned HTTP %d", resp.StatusCode)
	}

	var discovery struct {
		Issuer string `json:"issuer"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&discovery); err != nil {
		return "", xerrors.Errorf("decode OIDC discovery document: %w", err)
	}
	if discovery.Issuer == "" {
		return "", xerrors.New("OIDC discovery document has empty issuer field")
	}
	return discovery.Issuer, nil
}

// PrintAnalysis writes a human-readable summary of the OIDC link analysis.
// Used for the cli command and debugging.