Install
go get github.com/libraz/[email protected]If you use the SQL, Redis, or DynamoDB adapter sub-modules, pin them to the same tag:
go get github.com/libraz/go-oidc-provider/op/storeadapter/[email protected]
go get github.com/libraz/go-oidc-provider/op/storeadapter/[email protected]
go get github.com/libraz/go-oidc-provider/op/storeadapter/[email protected]The module needs Go 1.26.0 or newer (the go.mod directive is go 1.26.0). The release itself is built and tested with the pinned toolchain go1.27.3. Use that toolchain or newer if you want the same TLS and dependency security baseline the project CI runs on.
Packages and sub-modules
| Import path | When to import |
|---|---|
github.com/libraz/go-oidc-provider/op | Always. This is the public API. |
github.com/libraz/go-oidc-provider/op/storeadapter/inmem | Reference, dev and test store. Part of the main module. |
github.com/libraz/go-oidc-provider/op/storeadapter/sql | Durable store on SQLite, MySQL or Postgres. Sub-module, so DB drivers stay out of your go.sum until you use it. |
github.com/libraz/go-oidc-provider/op/storeadapter/redis | Volatile substores (sessions, interactions, consumed JTIs), meant to be paired with a durable store through composite. Sub-module. |
github.com/libraz/go-oidc-provider/op/storeadapter/dynamodb | DynamoDB store. Sub-module, so the AWS SDK stays out of your go.sum until you use it. |
github.com/libraz/go-oidc-provider/op/storeadapter/composite | Hot/cold splitter. Part of the main module. |
Sub-modules
The SQL, Redis, and DynamoDB adapters are published as Go sub-modules. You only pay the driver or AWS SDK dependency cost in modules that use them.
Stability
v1.5.0 changes defaults and folds options that did the same job under several names, so every deployment works through the checklist at the top of its entry in CHANGELOG.md before upgrading. The checklist maps each old name to its replacement and lists the configurations op.New now refuses.
A deployment on the SQL adapter applies the migration files from Store.Migrations() (explained in MIGRATIONS.md) before it runs a new release. Either apply them with your migration tool, or call Store.Migrate(ctx) once from a deploy job: it applies the same files in order and records its progress in a golang-migrate-compatible version table. Store.Schema() returns the complete current schema for reference. Also, op.New refuses to start when a table the configuration uses lacks a column the adapter needs.
Symbols marked Experimental: in godoc are exempt from the minor-release compatibility promise. The generated experimental API manifest is the current list: Grant Management (op.GrantManagementAction and op.WithGrantManagement), Client ID Metadata Documents (op.WithClientIDMetadataDocuments), the ID-JAG profile of the JWT bearer grant and of token exchange, and the RISC event types delivered through Shared Signals (op.AccountDisabled and its siblings). Each follows a draft specification whose wire format may still change.
Everything else is under the SemVer promise, including the login and interaction surface (op.LoginFlow, op.WithLoginFlow, op.WithInteractions, op.WithUI with op.HTMLUI, op.SPAUI and op.DriverUI, and the op/interaction package) and the DynamoDB adapter (op/storeadapter/dynamodb).
Next
- Minimal OP: an OP you can run with
go run, in about 30 lines. - Required options: what
op.Newinsists on, and what it refuses to start without. - Mount on your router: putting the handler on
net/http,chiorgin.