git.iko.soy/typeable/oauth2-proxy
on proxy-mapping help sign in
typeable/oauth2-proxy/providers/linkedin.go
99 lines 2.7 kB history raw
1package providers
3import (
4 "context"
5 "errors"
6 "net/http"
7 "net/url"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
13// LinkedInProvider represents an LinkedIn based Identity Provider
14type LinkedInProvider struct {
15 *ProviderData
18var _ Provider = (*LinkedInProvider)(nil)
20const (
21 linkedinProviderName = "LinkedIn"
22 linkedinDefaultScope = "r_emailaddress r_basicprofile"
25var (
26 // Default Login URL for LinkedIn.
27 // Pre-parsed URL of https://www.linkedin.com/uas/oauth2/authorization.
28 linkedinDefaultLoginURL = &url.URL{
29 Scheme: "https",
30 Host: "www.linkedin.com",
31 Path: "/uas/oauth2/authorization",
32 }
34 // Default Redeem URL for LinkedIn.
35 // Pre-parsed URL of https://www.linkedin.com/uas/oauth2/accessToken.
36 linkedinDefaultRedeemURL = &url.URL{
37 Scheme: "https",
38 Host: "www.linkedin.com",
39 Path: "/uas/oauth2/accessToken",
40 }
42 // Default Profile URL for LinkedIn.
43 // Pre-parsed URL of https://www.linkedin.com/v1/people/~/email-address.
44 linkedinDefaultProfileURL = &url.URL{
45 Scheme: "https",
46 Host: "www.linkedin.com",
47 Path: "/v1/people/~/email-address",
48 }
51// NewLinkedInProvider initiates a new LinkedInProvider
52func NewLinkedInProvider(p *ProviderData) *LinkedInProvider {
53 p.setProviderDefaults(providerDefaults{
54 name: linkedinProviderName,
55 loginURL: linkedinDefaultLoginURL,
56 redeemURL: linkedinDefaultRedeemURL,
57 profileURL: linkedinDefaultProfileURL,
58 validateURL: linkedinDefaultProfileURL,
59 scope: linkedinDefaultScope,
60 })
61 return &LinkedInProvider{ProviderData: p}
64func makeLinkedInHeader(accessToken string) http.Header {
65 // extra headers required by the LinkedIn API when making authenticated requests
66 extraHeaders := map[string]string{
67 acceptHeader: acceptApplicationJSON,
68 "x-li-format": "json",
69 }
70 return makeAuthorizationHeader(tokenTypeBearer, accessToken, extraHeaders)
73// GetEmailAddress returns the Account email address
74func (p *LinkedInProvider) GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error) {
75 if s.AccessToken == "" {
76 return "", errors.New("missing access token")
77 }
79 requestURL := p.ProfileURL.String() + "?format=json"
80 json, err := requests.New(requestURL).
81 WithContext(ctx).
82 WithHeaders(makeLinkedInHeader(s.AccessToken)).
83 Do().
84 UnmarshalJSON()
85 if err != nil {
86 return "", err
87 }
89 email, err := json.String()
90 if err != nil {
91 return "", err
92 }
93 return email, nil
96// ValidateSessionState validates the AccessToken
97func (p *LinkedInProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
98 return validateToken(ctx, p, s.AccessToken, makeLinkedInHeader(s.AccessToken))