auth

Documentation

Index

• Variables
• func GetClaimsFromTokenInRequest(req *http.Request) (*models.Principal, error)
• func GetConsoleCredentialsForOperator(jwt string) (*credentials.Credentials, error)
• func GetCredentialsFromLDAP(client *http.Client, endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error)
• func GetTokenFromRequest(r *http.Request) (string, error)
• func IsSessionTokenValid(token string) bool
• func NewEncryptedTokenForClient(credentials *credentials.Value, accountAccessKey string, actions []string) (string, error)
• type IdentityProvider
  • func (c IdentityProvider) GenerateLoginURL() string
  • func (c IdentityProvider) VerifyIdentity(ctx context.Context, code, state string) (*credentials.Credentials, error)
• type IdentityProviderI
• type OperatorClient
• type TokenClaims
  • func SessionTokenAuthenticate(token string) (*TokenClaims, error)

Variables

var (
	ErrNoAuthToken = errors.New("session token missing")
)

Session token errors

Functions

func GetClaimsFromTokenInRequest

func GetClaimsFromTokenInRequest(req *http.Request) (*models.Principal, error)

func GetConsoleCredentialsForOperator

func GetConsoleCredentialsForOperator(jwt string) (*credentials.Credentials, error)

GetConsoleCredentialsForOperator will validate the provided JWT (service account token) and return it in the form of credentials.Login

func GetCredentialsFromLDAP

func GetCredentialsFromLDAP(client *http.Client, endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error)

GetCredentialsFromLDAP authenticates the user against MinIO when the LDAP integration is enabled if the authentication succeed *credentials.Login object is returned and we continue with the normal STSAssumeRole flow

func GetTokenFromRequest

func GetTokenFromRequest(r *http.Request) (string, error)

GetTokenFromRequest returns a token from a http Request either defined on a cookie `token` or on Authorization header.

Authorization Header needs to be like "Authorization Bearer <token>"

func IsSessionTokenValid

func IsSessionTokenValid(token string) bool

IsSessionTokenValid returns true or false depending if the provided session token is valid or not

func NewEncryptedTokenForClient

func NewEncryptedTokenForClient(credentials *credentials.Value, accountAccessKey string, actions []string) (string, error)

NewEncryptedTokenForClient generates a new session token with claims based on the provided STS credentials, first encrypts the claims and the sign them

Types

type IdentityProvider

type IdentityProvider struct {
	Client *oauth2.Provider
}

Interface implementation

Define the structure of a IdentityProvider with Client inside and define the functions that are used during the authentication flow.

func (IdentityProvider) GenerateLoginURL

func (c IdentityProvider) GenerateLoginURL() string

GenerateLoginURL returns a new URL used by the user to login against the idp

func (IdentityProvider) VerifyIdentity

func (c IdentityProvider) VerifyIdentity(ctx context.Context, code, state string) (*credentials.Credentials, error)

VerifyIdentity will verify the user identity against the idp using the authorization code flow

type IdentityProviderI

type IdentityProviderI interface {
	VerifyIdentity(ctx context.Context, code, state string) (*credentials.Credentials, error)
	GenerateLoginURL() string
}

IdentityProviderI interface with all functions to be implemented by mock when testing, it should include all IdentityProvider respective api calls that are used within this project.

type OperatorClient

type OperatorClient interface {
	Authenticate(context.Context) ([]byte, error)
}

OperatorClient interface with all functions to be implemented by mock when testing, it should include all OperatorClient respective api calls that are used within this project.

type TokenClaims

type TokenClaims struct {
	STSAccessKeyID     string   `json:"stsAccessKeyID,omitempty"`
	STSSecretAccessKey string   `json:"stsSecretAccessKey,omitempty"`
	STSSessionToken    string   `json:"stsSessionToken,omitempty"`
	AccountAccessKey   string   `json:"accountAccessKey,omitempty"`
	Actions            []string `json:"actions,omitempty"`
}

TokenClaims claims struct for decrypted credentials

func SessionTokenAuthenticate

func SessionTokenAuthenticate(token string) (*TokenClaims, error)

SessionTokenAuthenticate takes a session token, decode it, extract claims and validate the signature if the session token claims are valid we proceed to decrypt the information inside

returns claims after validation in the following format:

type TokenClaims struct {
	STSAccessKeyID
	STSSecretAccessKey
	STSSessionToken
	AccountAccessKey
	Actions
}