// DefaultOAuthProvider returns default(means cloud-based) OAuth client
548294
func (s *Service) DefaultOAuthProvider() *OAuthProvider {
	oap := OAuthProvider{}
	oap.BaseURL = s.DefaultBaseURL
	oap.Service = s.Name
	if s.DefaultOAuth2 != nil {
		oap.ID = s.DefaultOAuth2.ClientID
		oap.Secret = s.DefaultOAuth2.ClientSecret
	} else if s.DefaultOAuth1 != nil {
		oap.ID = s.DefaultOAuth1.Key
		oap.Secret = s.DefaultOAuth1.Secret
	} else {
		s.Log().Error("Can't get OAuth client")
	}
	return &oap
}
865679
func (m ModuleInstance) ProviderConfigDefault(name string) AbsProviderConfig {
	return AbsProviderConfig{
		Module: m,
		ProviderConfig: ProviderConfig{
			Type: name,
		},
	}
}
1052533
func (user *User) OauthRedirectURL() string {
	providerID := user.ctx.OAuthProvider().internalID()
	if providerID == user.ctx.ServiceName {
		return fmt.Sprintf("%s/auth/%s", Config.BaseURL, user.ctx.ServiceName)
	}

	return fmt.Sprintf("%s/auth/%s/%s", Config.BaseURL, user.ctx.ServiceName, providerID)
}
534104
func CloudOrProvider(cloudName string, cloudByNameFunc func(string) (*jujucloud.Cloud, error)) (cloud *jujucloud.Cloud, err error) {
	if cloud, err = cloudByNameFunc(cloudName); err != nil {
		if !errors.IsNotFound(err) {
			return nil, err
		}
		builtInClouds, err := BuiltInClouds()
		if err != nil {
			return nil, errors.Trace(err)
		}
		if builtIn, ok := builtInClouds[cloudName]; !ok {
			return nil, errors.NotValidf("cloud %v", cloudName)
		} else {
			cloud = &builtIn
		}
	}
	return cloud, nil
}
503008
func NewGoogleProvider(client, secret, redirect string) *GoogleProvider {
	goog := GoogleProvider{}
	goog.AuthorizationURL = "https://accounts.google.com/o/oauth2/auth"
	goog.AccessTokenURL   = "https://accounts.google.com/o/oauth2/token"
	goog.RedirectURL      = redirect
	goog.ClientId         = client
	goog.ClientSecret     = secret
	return &goog
}
99179
func (user *User) OauthInitURL() string {
	authTempToken := user.AuthTempToken()
	s := user.ctx.Service()
	if authTempToken == "" {
		user.ctx.Log().Error("authTempToken is empty")
		return ""
	}
	if s.DefaultOAuth2 != nil {
		provider := user.ctx.OAuthProvider()

		return provider.OAuth2Client(user.ctx).AuthCodeURL(authTempToken, oauth2.AccessTypeOffline)
	}
	if s.DefaultOAuth1 != nil {
		return fmt.Sprintf("%s/oauth1/%s/%s", Config.BaseURL, s.Name, authTempToken)
	}
	return ""
}
1128438
func newOpenShiftOAuthClientConfig(clientId, clientSecret, masterPublicURL, masterURL string) *osincli.ClientConfig {
	config := &osincli.ClientConfig{
		ClientId:                 clientId,
		ClientSecret:             clientSecret,
		ErrorsInStatusCode:       true,
		SendClientSecretInParams: true,
		AuthorizeUrl:             urls.OpenShiftOAuthAuthorizeURL(masterPublicURL),
		TokenUrl:                 urls.OpenShiftOAuthTokenURL(masterURL),
		Scope:                    "",
	}
	return config
}
52380
func (q *SimpleQueryStringQuery) DefaultOperator(defaultOperator string) *SimpleQueryStringQuery {
	q.defaultOperator = defaultOperator
	return q
}
200314
func NewProvider(issuer string, clientIDs []string) (Provider, error) {
	p := Provider{issuer, clientIDs}

	if err := p.validate(); err != nil {
		return Provider{}, err
	}

	return p, nil
}
119983
func (user *User) ResetOAuthToken() error {
	err := user.saveProtectedSetting("OAuthToken", "")
	if err != nil {
		user.ctx.Log().WithError(err).Error("ResetOAuthToken error")
	}
	return err
}
901743
func (m *Module) AddProvider(p *Provider) {
	m.oauthConfigs = append(m.oauthConfigs, p)
}
1268641
func NewAuthorizer(client *http.Client, f func(string) (string, string, error)) Authorizer {
	if client == nil {
		client = http.DefaultClient
	}
	return &dockerAuthorizer{
		credentials: f,
		client:      client,
		auth:        map[string]string{},
	}
}
628690
func getOAuth() *oauth.Config {
	return oauth.OAuth(viper.GetString("auth-server"), &oauth.Client{
		ID:     "ttnctl",
		Secret: "ttnctl",
		ExtraHeaders: map[string]string{
			"User-Agent": GetUserAgent(),
		},
	})
}
1167865
func NewOpenIDProvider(issuerURL string) (*OpenIDProvider, error) {
	configURL := issuerURL + "/.well-known/openid-configuration"
	resp, err := http.Get(configURL)
	if err != nil {
		return nil, errors.Annotatef(err, "Unable to retrieve OpenID Provider Configuration at %s", configURL)
	}
	defer resp.Body.Close()
	decoder := json.NewDecoder(resp.Body)
	config := OPConfig{}
	err = decoder.Decode(&config)
	if err != nil {
		return nil, errors.Annotate(err, "Unable to decode OpenID Provider Configuration")
	}
	return &OpenIDProvider{Config: config}, nil
}
295510
func (cs *CloudStackClient) DefaultOptions(options ...OptionFunc) {
	if options != nil {
		cs.options = options
	} else {
		cs.options = []OptionFunc{}
	}
}
872780
func OAuth(server string, client *Client) *Config {
	return &Config{
		Server: server,
		Client: client,
		cache:  cache.EmptyCache,
	}
}
373305
func NewOAuthServerConfig(oauthConfig osinv1.OAuthConfig, userClientConfig *rest.Config, genericConfig *genericapiserver.RecommendedConfig) (*OAuthServerConfig, error) {
	// TODO: there is probably some better way to do this
	decoder := codecs.UniversalDecoder(osinv1.GroupVersion)
	for i, idp := range oauthConfig.IdentityProviders {
		if idp.Provider.Object != nil {
			// depending on how you get here, the IDP objects may or may not be filled out
			break
		}
		idpObject, err := runtime.Decode(decoder, idp.Provider.Raw)
		if err != nil {
			return nil, err
		}
		oauthConfig.IdentityProviders[i].Provider.Object = idpObject
	}

	// this leaves the embedded OAuth server code path alone
	if genericConfig == nil {
		genericConfig = genericapiserver.NewRecommendedConfig(codecs)
	}

	genericConfig.LoopbackClientConfig = userClientConfig

	userClient, err := userclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	oauthClient, err := oauthclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	eventsClient, err := corev1.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	routeClient, err := routeclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	kubeClient, err := kclientset.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}

	bootstrapUserDataGetter := bootstrap.NewBootstrapUserDataGetter(kubeClient.CoreV1(), kubeClient.CoreV1())

	var sessionAuth session.SessionAuthenticator
	if oauthConfig.SessionConfig != nil {
		// TODO we really need to enforce HTTPS always
		secure := isHTTPS(oauthConfig.MasterPublicURL)
		auth, err := buildSessionAuth(secure, oauthConfig.SessionConfig, bootstrapUserDataGetter)
		if err != nil {
			return nil, err
		}
		sessionAuth = auth

		// session capability is the only thing required to enable the bootstrap IDP
		// we dynamically enable or disable its UI based on the backing secret
		// this must be the first IDP to make sure that it can handle basic auth challenges first
		// this mostly avoids weird cases with the allow all IDP
		oauthConfig.IdentityProviders = append(
			[]osinv1.IdentityProvider{
				{
					Name:            bootstrap.BootstrapUser, // will never conflict with other IDPs due to the :
					UseAsChallenger: true,
					UseAsLogin:      true,
					MappingMethod:   string(identitymapper.MappingMethodClaim), // irrelevant, but needs to be valid
					Provider: runtime.RawExtension{
						Object: &config.BootstrapIdentityProvider{},
					},
				},
			},
			oauthConfig.IdentityProviders...,
		)
	}

	if len(oauthConfig.IdentityProviders) == 0 {
		oauthConfig.IdentityProviders = []osinv1.IdentityProvider{
			{
				Name:            "defaultDenyAll",
				UseAsChallenger: true,
				UseAsLogin:      true,
				MappingMethod:   string(identitymapper.MappingMethodClaim),
				Provider: runtime.RawExtension{
					Object: &osinv1.DenyAllPasswordIdentityProvider{},
				},
			},
		}
	}

	ret := &OAuthServerConfig{
		GenericConfig: genericConfig,
		ExtraOAuthConfig: ExtraOAuthConfig{
			Options:                        oauthConfig,
			KubeClient:                     kubeClient,
			EventsClient:                   eventsClient.Events(""),
			RouteClient:                    routeClient,
			UserClient:                     userClient.Users(),
			IdentityClient:                 userClient.Identities(),
			UserIdentityMappingClient:      userClient.UserIdentityMappings(),
			OAuthAccessTokenClient:         oauthClient.OAuthAccessTokens(),
			OAuthAuthorizeTokenClient:      oauthClient.OAuthAuthorizeTokens(),
			OAuthClientClient:              oauthClient.OAuthClients(),
			OAuthClientAuthorizationClient: oauthClient.OAuthClientAuthorizations(),
			SessionAuth:                    sessionAuth,
			BootstrapUserDataGetter:        bootstrapUserDataGetter,
		},
	}
	genericConfig.BuildHandlerChainFunc = ret.buildHandlerChainForOAuth

	return ret, nil
}