hoauth2-2.10.0: Haskell OAuth2 authentication client

Safe Haskell | Safe-Inferred
Language | Haskell2010

Network.OAuth2.Experiment

Contents

- Application per Grant type
- Authorization Code
- Device Authorization
- Token Request
- Refresh Token Request
- UserInfo Request
- Types
- Utils

Description

This module contains a new way of doing OAuth2 authorization and authentication in order to obtain Access Token and maybe Refresh Token base on rfc6749.

This module will become default in future release.

The key concept/change is to introduce the Grant flow, which determines the entire work flow per spec. Each work flow will have slight different request parameters, which often time you'll see different configuration when creating OAuth2 application in the IdP developer application page.

Here are supported flows

1. Authorization Code. This flow requires authorize call to obtain an authorize code, then exchange the code for tokens.
2. Resource Owner Password. This flow only requires to hit token endpoint with, of course, username and password, to obtain tokens.
3. Client Credentials. This flow also only requires to hit token endpoint but with different parameters. Client credentials flow does not involve an end user hence you won't be able to hit userinfo endpoint with access token obtained.
4. PKCE (rfc7636). This is enhancement on top of authorization code flow.

Implicit flow is not supported because it is more for SPA (single page app) given it is deprecated by Authorization Code flow with PKCE.

Here is quick sample for how to use vocabularies from this new module.

Firstly, initialize your IdP (use google as example) and the application.

    import Network.OAuth2.Experiment
    import URI.ByteString.QQ

    data Google = Google deriving (Eq, Show)

    googleIdp :: Idp Google
    googleIdp =
      Idp
        { idpAuthorizeEndpoint = [uri|https://accounts.google.com/o/oauth2/v2/auth|]
        , idpTokenEndpoint = [uri|https://oauth2.googleapis.com/token|]
        , idpUserInfoEndpoint = [uri|https://www.googleapis.com/oauth2/v2/userinfo|]
        , idpDeviceAuthorizationEndpoint = Just [uri|https://oauth2.googleapis.com/device/code|]
        }

    fooApp :: AuthorizationCodeApplication
    fooApp =
      AuthorizationCodeApplication
        { acClientId = "xxxxx",
          acClientSecret = "xxxxx",
          acScope =
            Set.fromList
              [ "https://www.googleapis.com/auth/userinfo.email",
                "https://www.googleapis.com/auth/userinfo.profile"
              ],
          acAuthorizeState = "CHANGE_ME",
          acAuthorizeRequestExtraParams = Map.empty,
          acRedirectUri = [uri|http://localhost/oauth2/callback|],
          acName = "sample-google-authorization-code-app",
          acTokenRequestAuthenticationMethod = ClientSecretBasic,
        }

    fooIdpApplication :: IdpApplication AuthorizationCodeApplication Google
    fooIdpApplication = IdpApplication fooApp googleIdp

Secondly, construct the authorize URL.

    authorizeUrl = mkAuthorizationRequest fooIdpApplication

Thirdly, after a successful redirect with authorize code, you could exchange for access token

    mgr <- liftIO $ newManager tlsManagerSettings
    tokenResp <- conduitTokenRequest fooIdpApplication mgr authorizeCode

If you'd like to fetch user info, uses this method

    conduitUserInfoRequest fooIdpApplication mgr (accessToken tokenResp)

You could also find example from `hoauth2-providers-tutorials` module.

Synopsis

- data AuthorizationCodeApplication = AuthorizationCodeApplication {
  - acName :: Text
  - acClientId :: ClientId
  - acClientSecret :: ClientSecret
  - acScope :: Set Scope
  - acRedirectUri :: URI
  - acAuthorizeState :: AuthorizeState
  - acAuthorizeRequestExtraParams :: Map Text Text
  - acTokenRequestAuthenticationMethod :: ClientAuthenticationMethod
  }
- data DeviceAuthorizationApplication = DeviceAuthorizationApplication {
  - daName :: Text
  - daClientId :: ClientId
  - daClientSecret :: ClientSecret
  - daScope :: Set Scope
  - daAuthorizationRequestExtraParam :: Map Text Text
  - daAuthorizationRequestAuthenticationMethod :: Maybe ClientAuthenticationMethod
  }
- pollDeviceTokenRequest :: MonadIO m => IdpApplication i DeviceAuthorizationApplication -> Manager -> DeviceAuthorizationResponse -> ExceptT TokenResponseError m OAuth2Token
- data ClientCredentialsApplication = ClientCredentialsApplication {
  - ccClientId :: ClientId
  - ccClientSecret :: ClientSecret
  - ccName :: Text
  - ccScope :: Set Scope
  - ccTokenRequestExtraParams :: Map Text Text
  - ccTokenRequestAuthenticationMethod :: ClientAuthenticationMethod
  }
- data ResourceOwnerPasswordApplication = ResourceOwnerPasswordApplication {
  - ropClientId :: ClientId
  - ropClientSecret :: ClientSecret
  - ropName :: Text
  - ropScope :: Set Scope
  - ropUserName :: Username
  - ropPassword :: Password
  - ropTokenRequestExtraParams :: Map Text Text
  }
- data JwtBearerApplication = JwtBearerApplication {
  - jbName :: Text
  - jbJwtAssertion :: ByteString
  }
- class HasAuthorizeRequest a
- mkAuthorizationRequest :: HasAuthorizeRequest a => IdpApplication i a -> URI
- mkPkceAuthorizeRequest :: (MonadIO m, HasPkceAuthorizeRequest a) => IdpApplication i a -> m (URI, CodeVerifier)
- data DeviceAuthorizationResponse = DeviceAuthorizationResponse {
  - deviceCode :: DeviceCode
  - userCode :: Text
  - verificationUri :: URI
  - verificationUriComplete :: Maybe URI
  - expiresIn :: Integer
  - interval :: Maybe Int
  }
- class HasOAuth2Key a => HasDeviceAuthorizationRequest a
- conduitDeviceAuthorizationRequest :: (MonadIO m, HasDeviceAuthorizationRequest a) => IdpApplication i a -> Manager -> ExceptT ByteString m DeviceAuthorizationResponse
- class (HasOAuth2Key a, HasTokenRequestClientAuthenticationMethod a) => HasTokenRequest a where
  - data TokenRequest a
  - type ExchangeTokenInfo a
- data NoNeedExchangeToken = NoNeedExchangeToken
- conduitPkceTokenRequest :: (HasTokenRequest a, ToQueryParam (TokenRequest a), MonadIO m) => IdpApplication i a -> Manager -> (ExchangeTokenInfo a, CodeVerifier) -> ExceptT TokenResponseError m OAuth2Token
- conduitTokenRequest :: (HasTokenRequest a, ToQueryParam (TokenRequest a), MonadIO m) => IdpApplication i a -> Manager -> ExchangeTokenInfo a -> ExceptT TokenResponseError m OAuth2Token
- class (HasOAuth2Key a, HasTokenRequestClientAuthenticationMethod a) => HasRefreshTokenRequest a
- conduitRefreshTokenRequest :: (MonadIO m, HasRefreshTokenRequest a) => IdpApplication i a -> Manager -> RefreshToken -> ExceptT TokenResponseError m OAuth2Token
- class HasUserInfoRequest a
- conduitUserInfoRequest :: (MonadIO m, HasUserInfoRequest a, FromJSON b) => IdpApplication i a -> Manager -> AccessToken -> ExceptT ByteString m b
- conduitUserInfoRequestWithCustomMethod :: (MonadIO m, HasUserInfoRequest a, FromJSON b) => (Manager -> AccessToken -> URI -> ExceptT ByteString m b) -> IdpApplication i a -> Manager -> AccessToken -> ExceptT ByteString m b
- newtype AuthorizeState = AuthorizeState {
  - unAuthorizeState :: Text
  }
- newtype ClientId = ClientId {
  - unClientId :: Text
  }
- newtype ClientSecret = ClientSecret {
  - unClientSecret :: Text
  }
- class HasOAuth2Key a
- data Idp (i :: k) = Idp {
  - idpUserInfoEndpoint :: URI
  - idpAuthorizeEndpoint :: URI
  - idpTokenEndpoint :: URI
  - idpDeviceAuthorizationEndpoint :: Maybe URI
  }
- data IdpApplication (i :: k) a = IdpApplication {
  - idp :: Idp i
  - application :: a
  }
- newtype Password = Password {
  - unPassword :: Text
  }
- newtype RedirectUri = RedirectUri {
  - unRedirectUri :: URI
  }
- newtype Scope = Scope {
  - unScope :: Text
  }
- newtype Username = Username {
  - unUsername :: Text
  }
- newtype CodeVerifier = CodeVerifier {
  - unCodeVerifier :: Text
  }
- data ClientAuthenticationMethod
  - = ClientSecretBasic
  - | ClientSecretPost
  - | ClientAssertionJwt
- uriToText :: URI -> Text

# Application per Grant type

data AuthorizationCodeApplication Source #

An Application that supports "Authorization code" flow

https://www.rfc-editor.org/rfc/rfc6749#section-4.1

Constructors

AuthorizationCodeApplication |

Fields

- acName :: Text
- acClientId :: ClientId
- acClientSecret :: ClientSecret
- acScope :: Set Scope
- acRedirectUri :: URI
- acAuthorizeState :: AuthorizeState
- acAuthorizeRequestExtraParams :: Map Text Text
- acTokenRequestAuthenticationMethod :: ClientAuthenticationMethod

#### Instances

Instances details

HasAuthorizeRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkAuthorizationRequestParam :: AuthorizationCodeApplication -> AuthorizationRequestParam Source #
HasPkceAuthorizeRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkPkceAuthorizeRequestParam :: MonadIO m => AuthorizationCodeApplication -> m (AuthorizationRequestParam, CodeVerifier) Source #
HasRefreshTokenRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkRefreshTokenRequestParam :: AuthorizationCodeApplication -> RefreshToken -> RefreshTokenRequest Source #
HasTokenRequest AuthorizationCodeApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Associated Types data TokenRequest AuthorizationCodeApplication Source # type ExchangeTokenInfo AuthorizationCodeApplication Source # Methods mkTokenRequestParam :: AuthorizationCodeApplication -> ExchangeTokenInfo AuthorizationCodeApplication -> TokenRequest AuthorizationCodeApplication Source #
HasTokenRequestClientAuthenticationMethod AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods getClientAuthenticationMethod :: AuthorizationCodeApplication -> ClientAuthenticationMethod Source #
HasOAuth2Key AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkOAuth2Key :: AuthorizationCodeApplication -> OAuth2 Source #
HasUserInfoRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode
ToQueryParam (TokenRequest AuthorizationCodeApplication) Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods toQueryParam :: TokenRequest AuthorizationCodeApplication -> Map Text Text Source #
type ExchangeTokenInfo AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode type ExchangeTokenInfo AuthorizationCodeApplication = ExchangeToken
data TokenRequest AuthorizationCodeApplication Source # |

Instance details

Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode

data TokenRequest AuthorizationCodeApplication = AuthorizationCodeTokenRequest {

- trCode :: ExchangeToken
- trGrantType :: GrantTypeValue
- trRedirectUri :: RedirectUri

}

data DeviceAuthorizationApplication Source #

An Application that supports "Device Authorization Grant"

https://www.rfc-editor.org/rfc/rfc8628#section-3.1

Constructors

DeviceAuthorizationApplication |

Fields

- daName :: Text
- daClientId :: ClientId
- daClientSecret :: ClientSecret
- daScope :: Set Scope
- daAuthorizationRequestExtraParam :: Map Text Text

  Additional parameters to the device authorization request. Most of identity providers follow the spec strictly but AzureAD requires "tenant" parameter.

- daAuthorizationRequestAuthenticationMethod :: Maybe ClientAuthenticationMethod

  The spec requires similar authentication method as /token request. Most of identity providers doesn't required it but some does like Okta.

#### Instances

Instances details

HasDeviceAuthorizationRequest DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods mkDeviceAuthorizationRequestParam :: DeviceAuthorizationApplication -> DeviceAuthorizationRequestParam Source #
HasTokenRequest DeviceAuthorizationApplication Source # | https://www.rfc-editor.org/rfc/rfc8628#section-3.4
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Associated Types data TokenRequest DeviceAuthorizationApplication Source # type ExchangeTokenInfo DeviceAuthorizationApplication Source # Methods mkTokenRequestParam :: DeviceAuthorizationApplication -> ExchangeTokenInfo DeviceAuthorizationApplication -> TokenRequest DeviceAuthorizationApplication Source #
HasTokenRequestClientAuthenticationMethod DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods getClientAuthenticationMethod :: DeviceAuthorizationApplication -> ClientAuthenticationMethod Source #
HasOAuth2Key DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods mkOAuth2Key :: DeviceAuthorizationApplication -> OAuth2 Source #
HasUserInfoRequest DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization
ToQueryParam (TokenRequest DeviceAuthorizationApplication) Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods toQueryParam :: TokenRequest DeviceAuthorizationApplication -> Map Text Text Source #
type ExchangeTokenInfo DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization type ExchangeTokenInfo DeviceAuthorizationApplication = DeviceCode
data TokenRequest DeviceAuthorizationApplication Source # |

Instance details

Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization

data TokenRequest DeviceAuthorizationApplication = AuthorizationCodeTokenRequest {

- trCode :: DeviceCode
- trGrantType :: GrantTypeValue
- trClientId :: Maybe ClientId

}

pollDeviceTokenRequest :: MonadIO m => IdpApplication i DeviceAuthorizationApplication -> Manager -> DeviceAuthorizationResponse -> ExceptT TokenResponseError m OAuth2Token Source #

data ClientCredentialsApplication Source #

An Application that supports "Client Credentials" flow

https://www.rfc-editor.org/rfc/rfc6749#section-4.4

Constructors

ClientCredentialsApplication |

Fields

- ccClientId :: ClientId
- ccClientSecret :: ClientSecret
- ccName :: Text
- ccScope :: Set Scope
- ccTokenRequestExtraParams :: Map Text Text
- ccTokenRequestAuthenticationMethod :: ClientAuthenticationMethod

#### Instances

Instances details

HasTokenRequest ClientCredentialsApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Associated Types data TokenRequest ClientCredentialsApplication Source # type ExchangeTokenInfo ClientCredentialsApplication Source # Methods mkTokenRequestParam :: ClientCredentialsApplication -> ExchangeTokenInfo ClientCredentialsApplication -> TokenRequest ClientCredentialsApplication Source #
HasTokenRequestClientAuthenticationMethod ClientCredentialsApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Methods getClientAuthenticationMethod :: ClientCredentialsApplication -> ClientAuthenticationMethod Source #
HasOAuth2Key ClientCredentialsApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Methods mkOAuth2Key :: ClientCredentialsApplication -> OAuth2 Source #
ToQueryParam (TokenRequest ClientCredentialsApplication) Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Methods toQueryParam :: TokenRequest ClientCredentialsApplication -> Map Text Text Source #
type ExchangeTokenInfo ClientCredentialsApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials type ExchangeTokenInfo ClientCredentialsApplication = NoNeedExchangeToken
data TokenRequest ClientCredentialsApplication Source # |

Instance details

Defined in Network.OAuth2.Experiment.Grants.ClientCredentials

data TokenRequest ClientCredentialsApplication = ClientCredentialsTokenRequest {

- trScope :: Set Scope
- trGrantType :: GrantTypeValue
- trClientSecret :: ClientSecret
- trClientId :: ClientId
- trExtraParams :: Map Text Text
- trClientAuthenticationMethod :: ClientAuthenticationMethod

}

data ResourceOwnerPasswordApplication Source #

An Application that supports "Resource Owner Password" flow

https://www.rfc-editor.org/rfc/rfc6749#section-4.3

Constructors

ResourceOwnerPasswordApplication |

Fields

- ropClientId :: ClientId
- ropClientSecret :: ClientSecret
- ropName :: Text
- ropScope :: Set Scope
- ropUserName :: Username
- ropPassword :: Password
- ropTokenRequestExtraParams :: Map Text Text

#### Instances

Instances details

HasRefreshTokenRequest ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods mkRefreshTokenRequestParam :: ResourceOwnerPasswordApplication -> RefreshToken -> RefreshTokenRequest Source #
HasTokenRequest ResourceOwnerPasswordApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Associated Types data TokenRequest ResourceOwnerPasswordApplication Source # type ExchangeTokenInfo ResourceOwnerPasswordApplication Source # Methods mkTokenRequestParam :: ResourceOwnerPasswordApplication -> ExchangeTokenInfo ResourceOwnerPasswordApplication -> TokenRequest ResourceOwnerPasswordApplication Source #
HasTokenRequestClientAuthenticationMethod ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods getClientAuthenticationMethod :: ResourceOwnerPasswordApplication -> ClientAuthenticationMethod Source #
HasOAuth2Key ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods mkOAuth2Key :: ResourceOwnerPasswordApplication -> OAuth2 Source #
HasUserInfoRequest ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword
ToQueryParam (TokenRequest ResourceOwnerPasswordApplication) Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods toQueryParam :: TokenRequest ResourceOwnerPasswordApplication -> Map Text Text Source #
type ExchangeTokenInfo ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword type ExchangeTokenInfo ResourceOwnerPasswordApplication = NoNeedExchangeToken
data TokenRequest ResourceOwnerPasswordApplication Source # |

Instance details

Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword

data TokenRequest ResourceOwnerPasswordApplication = PasswordTokenRequest {

- trScope :: Set Scope
- trUsername :: Username
- trPassword :: Password
- trGrantType :: GrantTypeValue
- trExtraParams :: Map Text Text

}

data JwtBearerApplication Source #

An Application that supports "JWT Bearer" flow

https://datatracker.ietf.org/doc/html/rfc7523

Constructors

JwtBearerApplication |

Fields

- jbName :: Text
- jbJwtAssertion :: ByteString

#### Instances

Instances details

HasTokenRequest JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Associated Types data TokenRequest JwtBearerApplication Source # type ExchangeTokenInfo JwtBearerApplication Source # Methods mkTokenRequestParam :: JwtBearerApplication -> ExchangeTokenInfo JwtBearerApplication -> TokenRequest JwtBearerApplication Source #
HasTokenRequestClientAuthenticationMethod JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Methods getClientAuthenticationMethod :: JwtBearerApplication -> ClientAuthenticationMethod Source #
HasOAuth2Key JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Methods mkOAuth2Key :: JwtBearerApplication -> OAuth2 Source #
HasUserInfoRequest JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer
ToQueryParam (TokenRequest JwtBearerApplication) Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Methods toQueryParam :: TokenRequest JwtBearerApplication -> Map Text Text Source #
type ExchangeTokenInfo JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer type ExchangeTokenInfo JwtBearerApplication = NoNeedExchangeToken
data TokenRequest JwtBearerApplication Source # |

Instance details

Defined in Network.OAuth2.Experiment.Grants.JwtBearer

data TokenRequest JwtBearerApplication = JwtBearerTokenRequest {

- trGrantType :: GrantTypeValue
- trAssertion :: ByteString

}

# Authorization Code

class HasAuthorizeRequest a Source #

Minimal complete definition

mkAuthorizationRequestParam

#### Instances

Instances details

HasAuthorizeRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkAuthorizationRequestParam :: AuthorizationCodeApplication -> AuthorizationRequestParam Source #

mkAuthorizationRequest :: HasAuthorizeRequest a => IdpApplication i a -> URI Source #

Constructs Authorization Code request URI https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1

mkPkceAuthorizeRequest :: (MonadIO m, HasPkceAuthorizeRequest a) => IdpApplication i a -> m (URI, CodeVerifier) Source #

Constructs Authorization Code (PKCE) request URI and the Code Verifier. https://datatracker.ietf.org/doc/html/rfc7636

# Device Authorization

data DeviceAuthorizationResponse Source #

https://www.rfc-editor.org/rfc/rfc8628#section-3.2

Constructors

DeviceAuthorizationResponse |

Fields

- deviceCode :: DeviceCode
- userCode :: Text
- verificationUri :: URI
- verificationUriComplete :: Maybe URI
- expiresIn :: Integer
- interval :: Maybe Int

#### Instances

Instances details

FromJSON DeviceAuthorizationResponse Source # |
Instance details Defined in Network.OAuth2.Experiment.Flows.DeviceAuthorizationRequest Methods parseJSON :: Value -> Parser DeviceAuthorizationResponse Source # parseJSONList :: Value -> Parser [DeviceAuthorizationResponse] Source #

class HasOAuth2Key a => HasDeviceAuthorizationRequest a Source #

Minimal complete definition

mkDeviceAuthorizationRequestParam

#### Instances

Instances details

HasDeviceAuthorizationRequest DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods mkDeviceAuthorizationRequestParam :: DeviceAuthorizationApplication -> DeviceAuthorizationRequestParam Source #

conduitDeviceAuthorizationRequest :: (MonadIO m, HasDeviceAuthorizationRequest a) => IdpApplication i a -> Manager -> ExceptT ByteString m DeviceAuthorizationResponse Source #

Makes Device Authorization Request https://www.rfc-editor.org/rfc/rfc8628#section-3.1

# Token Request

class (HasOAuth2Key a, HasTokenRequestClientAuthenticationMethod a) => HasTokenRequest a Source #

Minimal complete definition

mkTokenRequestParam

Associated Types

data TokenRequest a Source #

type ExchangeTokenInfo a Source #

#### Instances

Instances details

HasTokenRequest AuthorizationCodeApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Associated Types data TokenRequest AuthorizationCodeApplication Source # type ExchangeTokenInfo AuthorizationCodeApplication Source # Methods mkTokenRequestParam :: AuthorizationCodeApplication -> ExchangeTokenInfo AuthorizationCodeApplication -> TokenRequest AuthorizationCodeApplication Source #
HasTokenRequest ClientCredentialsApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Associated Types data TokenRequest ClientCredentialsApplication Source # type ExchangeTokenInfo ClientCredentialsApplication Source # Methods mkTokenRequestParam :: ClientCredentialsApplication -> ExchangeTokenInfo ClientCredentialsApplication -> TokenRequest ClientCredentialsApplication Source #
HasTokenRequest DeviceAuthorizationApplication Source # | https://www.rfc-editor.org/rfc/rfc8628#section-3.4
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Associated Types data TokenRequest DeviceAuthorizationApplication Source # type ExchangeTokenInfo DeviceAuthorizationApplication Source # Methods mkTokenRequestParam :: DeviceAuthorizationApplication -> ExchangeTokenInfo DeviceAuthorizationApplication -> TokenRequest DeviceAuthorizationApplication Source #
HasTokenRequest JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Associated Types data TokenRequest JwtBearerApplication Source # type ExchangeTokenInfo JwtBearerApplication Source # Methods mkTokenRequestParam :: JwtBearerApplication -> ExchangeTokenInfo JwtBearerApplication -> TokenRequest JwtBearerApplication Source #
HasTokenRequest ResourceOwnerPasswordApplication Source # | https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Associated Types data TokenRequest ResourceOwnerPasswordApplication Source # type ExchangeTokenInfo ResourceOwnerPasswordApplication Source # Methods mkTokenRequestParam :: ResourceOwnerPasswordApplication -> ExchangeTokenInfo ResourceOwnerPasswordApplication -> TokenRequest ResourceOwnerPasswordApplication Source #

data NoNeedExchangeToken Source #

Only Authorization Code Grant involves a Exchange Token (Authorization Code). ResourceOwnerPassword and Client Credentials make token request directly.

Constructors

NoNeedExchangeToken |

conduitPkceTokenRequest :: (HasTokenRequest a, ToQueryParam (TokenRequest a), MonadIO m) => IdpApplication i a -> Manager -> (ExchangeTokenInfo a, CodeVerifier) -> ExceptT TokenResponseError m OAuth2Token Source #

Make Token Request (PKCE) https://datatracker.ietf.org/doc/html/rfc7636#section-4.5

conduitTokenRequest :: (HasTokenRequest a, ToQueryParam (TokenRequest a), MonadIO m) => IdpApplication i a -> Manager -> ExchangeTokenInfo a -> ExceptT TokenResponseError m OAuth2Token Source #

Make Token Request https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3

# Refresh Token Request

class (HasOAuth2Key a, HasTokenRequestClientAuthenticationMethod a) => HasRefreshTokenRequest a Source #

Minimal complete definition

mkRefreshTokenRequestParam

#### Instances

Instances details

HasRefreshTokenRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkRefreshTokenRequestParam :: AuthorizationCodeApplication -> RefreshToken -> RefreshTokenRequest Source #
HasRefreshTokenRequest ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods mkRefreshTokenRequestParam :: ResourceOwnerPasswordApplication -> RefreshToken -> RefreshTokenRequest Source #

conduitRefreshTokenRequest :: (MonadIO m, HasRefreshTokenRequest a) => IdpApplication i a -> Manager -> RefreshToken -> ExceptT TokenResponseError m OAuth2Token Source #

Make Refresh Token Request https://www.rfc-editor.org/rfc/rfc6749#section-6

# UserInfo Request

class HasUserInfoRequest a Source #

#### Instances

Instances details

HasUserInfoRequest AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode
HasUserInfoRequest DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization
HasUserInfoRequest JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer
HasUserInfoRequest ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword

conduitUserInfoRequest :: (MonadIO m, HasUserInfoRequest a, FromJSON b) => IdpApplication i a -> Manager -> AccessToken -> ExceptT ByteString m b Source #

Standard approach of fetching /userinfo

conduitUserInfoRequestWithCustomMethod :: (MonadIO m, HasUserInfoRequest a, FromJSON b) => (Manager -> AccessToken -> URI -> ExceptT ByteString m b) -> IdpApplication i a -> Manager -> AccessToken -> ExceptT ByteString m b Source #

Usually `conduitUserInfoRequest` is good enough. But some IdP has different approach to fetch user information rather than GET. This method gives the flexiblity.

# Types

newtype AuthorizeState Source #

Constructors

AuthorizeState |

Fields

- unAuthorizeState :: Text

#### Instances

Instances details

IsString AuthorizeState Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> AuthorizeState Source #
Eq AuthorizeState Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: AuthorizeState -> AuthorizeState -> Bool Source # (/=) :: AuthorizeState -> AuthorizeState -> Bool Source #
ToQueryParam AuthorizeState Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: AuthorizeState -> Map Text Text Source #

newtype ClientId Source #

Constructors

ClientId |

Fields

- unClientId :: Text

#### Instances

Instances details

IsString ClientId Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> ClientId Source #
Show ClientId Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods showsPrec :: Int -> ClientId -> ShowS Source # show :: ClientId -> String Source # showList :: [ClientId] -> ShowS Source #
Eq ClientId Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: ClientId -> ClientId -> Bool Source # (/=) :: ClientId -> ClientId -> Bool Source #
ToQueryParam ClientId Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: ClientId -> Map Text Text Source #

newtype ClientSecret Source #

Can be either "Client Secret" or JWT base on client authentication method

Constructors

ClientSecret |

Fields

- unClientSecret :: Text

#### Instances

Instances details

IsString ClientSecret Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> ClientSecret Source #
Eq ClientSecret Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: ClientSecret -> ClientSecret -> Bool Source # (/=) :: ClientSecret -> ClientSecret -> Bool Source #
ToQueryParam ClientSecret Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: ClientSecret -> Map Text Text Source #

class HasOAuth2Key a Source #

Minimal complete definition

mkOAuth2Key

#### Instances

Instances details

HasOAuth2Key AuthorizationCodeApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.AuthorizationCode Methods mkOAuth2Key :: AuthorizationCodeApplication -> OAuth2 Source #
HasOAuth2Key ClientCredentialsApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ClientCredentials Methods mkOAuth2Key :: ClientCredentialsApplication -> OAuth2 Source #
HasOAuth2Key DeviceAuthorizationApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.DeviceAuthorization Methods mkOAuth2Key :: DeviceAuthorizationApplication -> OAuth2 Source #
HasOAuth2Key JwtBearerApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.JwtBearer Methods mkOAuth2Key :: JwtBearerApplication -> OAuth2 Source #
HasOAuth2Key ResourceOwnerPasswordApplication Source # |
Instance details Defined in Network.OAuth2.Experiment.Grants.ResourceOwnerPassword Methods mkOAuth2Key :: ResourceOwnerPasswordApplication -> OAuth2 Source #

data Idp (i :: k) Source #

`Idp i` consists various endpoints endpoints.

The `i` is actually phantom type for information only (Idp name) at this moment. And it is PolyKinds.

Hence whenever `Idp i` or `IdpApplication i a` is used as function parameter, PolyKinds need to be enabled.

Constructors

Idp |

Fields

- idpUserInfoEndpoint :: URI

  Userinfo Endpoint

- idpAuthorizeEndpoint :: URI

  Authorization Endpoint

- idpTokenEndpoint :: URI

  Token Endpoint

- idpDeviceAuthorizationEndpoint :: Maybe URI

  Apparently not all IdP support device code flow

data IdpApplication (i :: k) a Source #

An OAuth2 Application "a" of IdP "i". "a" can be one of following type:

- `AuthorizationCodeApplication`
- `DeviceAuthorizationApplication`
- `ClientCredentialsApplication`
- `ResourceOwnerPasswordApplication`
- `JwtBearerApplication`

Constructors

IdpApplication |

Fields

- idp :: Idp i
- application :: a

newtype Password Source #

Constructors

Password |

Fields

- unPassword :: Text

#### Instances

Instances details

IsString Password Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> Password Source #
Eq Password Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: Password -> Password -> Bool Source # (/=) :: Password -> Password -> Bool Source #
ToQueryParam Password Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: Password -> Map Text Text Source #

newtype RedirectUri Source #

Constructors

RedirectUri |

Fields

- unRedirectUri :: URI

#### Instances

Instances details

Eq RedirectUri Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: RedirectUri -> RedirectUri -> Bool Source # (/=) :: RedirectUri -> RedirectUri -> Bool Source #
ToQueryParam RedirectUri Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: RedirectUri -> Map Text Text Source #

newtype Scope Source #

Constructors

Scope |

Fields

- unScope :: Text

#### Instances

Instances details

IsString Scope Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> Scope Source #
Eq Scope Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: Scope -> Scope -> Bool Source # (/=) :: Scope -> Scope -> Bool Source #
Ord Scope Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods compare :: Scope -> Scope -> Ordering Source # (<) :: Scope -> Scope -> Bool Source # (<=) :: Scope -> Scope -> Bool Source # (>) :: Scope -> Scope -> Bool Source # (>=) :: Scope -> Scope -> Bool Source # max :: Scope -> Scope -> Scope Source # min :: Scope -> Scope -> Scope Source #
ToQueryParam (Set Scope) Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: Set Scope -> Map Text Text Source #

newtype Username Source #

Constructors

Username |

Fields

- unUsername :: Text

#### Instances

Instances details

IsString Username Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods fromString :: String -> Username Source #
Eq Username Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods (==) :: Username -> Username -> Bool Source # (/=) :: Username -> Username -> Bool Source #
ToQueryParam Username Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: Username -> Map Text Text Source #

newtype CodeVerifier Source #

Constructors

CodeVerifier |

Fields

- unCodeVerifier :: Text

#### Instances

Instances details

ToQueryParam CodeVerifier Source # |
Instance details Defined in Network.OAuth2.Experiment.Types Methods toQueryParam :: CodeVerifier -> Map Text Text Source #

data ClientAuthenticationMethod Source #

https://www.rfc-editor.org/rfc/rfc6749#section-2.3 According to spec:

The client MUST NOT use more than one authentication method in each request.

Which means use Authorization header or Post body.

However, I found I have to include authentication in the header all the time in real world.

In other words, `ClientSecretBasic` is always assured. `ClientSecretPost` is optional.

Maybe consider an alternative implementation that boolean kind of data type is good enough.

Constructors

ClientSecretBasic |
ClientSecretPost |
ClientAssertionJwt |

#### Instances

Instances details

Eq ClientAuthenticationMethod Source # |
Instance details Defined in Network.OAuth.OAuth2.Internal Methods (==) :: ClientAuthenticationMethod -> ClientAuthenticationMethod -> Bool Source # (/=) :: ClientAuthenticationMethod -> ClientAuthenticationMethod -> Bool Source #

# Utils

uriToText :: URI -> Text Source #