README.md

idp

Tier: Adapter · Status: Full (port + types) · Java original: firefly-idp · .NET project: FireflyFramework.Idp

Overview

idp is the identity-provider port every concrete IDP adapter satisfies. It defines:

• Adapter — the interface (Login, Refresh, Validate, plus user CRUD).
• User — the IDP-agnostic principal view.
• Token — the OIDC-shaped token envelope.
• ErrInvalidCredentials, ErrUserNotFound — the canonical error sentinels.

Concrete implementations live in dedicated modules:

Adapter	Backing tech	Status
idpinternaldb	bcrypt + HS256 JWT, in-memory user store	Full
idpkeycloak	Keycloak OIDC + admin REST	Stub (sentinel-error guard)
idpazuread	MSAL + Microsoft Graph	Stub (sentinel-error guard)
idpawscognito	AWS Cognito SDK	Stub (sentinel-error guard)

Public surface

type User struct {
    ID         string
    Username   string
    Email      string
    Roles      []string
    Attributes map[string]any
    Enabled    bool
    CreatedAt  time.Time
}

type Token struct {
    AccessToken  string
    TokenType    string  // "Bearer"
    ExpiresIn    int64
    RefreshToken string
    IDToken      string
    Scope        string
    IssuedAt     time.Time
}

type Adapter interface {
    Login(ctx, username, password) (Token, error)
    Refresh(ctx, refreshToken string) (Token, error)
    Validate(ctx, accessToken string) (User, error)
    GetUser(ctx, id string) (User, error)
    CreateUser(ctx, u User, password string) (User, error)
    UpdateUser(ctx, u User) (User, error)
    DeleteUser(ctx, id string) error
    Name() string
}

var ErrInvalidCredentials = errors.New("…invalid credentials")
var ErrUserNotFound       = errors.New("…user not found")

Wiring with security

verifier := security.VerifierFunc(func(ctx context.Context, token string) (security.Authentication, error) {
    u, err := idpAdapter.Validate(ctx, token)
    if err != nil {
        return security.Authentication{}, err
    }
    return security.Authentication{
        Principal: u.ID,
        Username:  u.Username,
        Roles:     u.Roles,
    }, nil
})

bearer := security.BearerMiddleware(security.BearerConfig{Verifier: verifier})

Testing

cd idp
go test ./...

Sentinel-error guard ensures the canonical error variables exist and have non-empty messages. The substantive end-to-end tests live in idpinternaldb.