athenzutils

README

athenzutils

Go library to return zts client given private key and certificate.

License

Copyright The Athenz Authors

Licensed under the Apache License, Version 2.0

Documentation

Index

• func ExtractHostname(x509Cert x509.Certificate) string
• func ExtractInstanceId(x509Cert x509.Certificate) (string, error)
• func ExtractServicePrincipal(x509Cert x509.Certificate) (string, error)
• func FetchIdToken(...) (string, error)
• func FetchIdTokenExpiryTime(idToken string) (*time.Time, error)
• func GenerateAccessTokenRequestString(domain, service, roles, authzDetails, proxyPrincipalSpiffeUris string, ...) string
• func GetK8SClientAuthCredential(idToken string) (string, error)
• func LoadPublicKey(publicKeyPEM []byte) (interface{}, error)
• func LoadX509Certificate(certFile string) (*x509.Certificate, error)
• func ParseAthenzRoleName(roleName string) (string, string, error)
• func ParseGCPResourceName(resource, objectType string) (string, string, error)
• func ParsePrincipal(principal string) (string, string, error)
• func ZmsClient(zmsURL, keyFile, certFile, caCertFile string, proxy bool) (*zms.ZMSClient, error)
• func ZtsClient(ztsURL, keyFile, certFile, caCertFile string, proxy bool) (*zts.ZTSClient, error)
• type Config
  • func ReadDefaultConfig() (*Config, error)

Functions

func ExtractHostname

func ExtractHostname(x509Cert x509.Certificate) string

ExtractHostname returns the hostname from the SAN URIs field of the given certificate: https://golang.org/pkg/crypto/x509/#Certificate.URIs. If the certificate does not have the hostname in the SAN URIs field, an empty string is returned.

func ExtractInstanceId

func ExtractInstanceId(x509Cert x509.Certificate) (string, error)

func ExtractServicePrincipal

func ExtractServicePrincipal(x509Cert x509.Certificate) (string, error)

ExtractServicePrincipal returns the Athenz Service principal for the given certificate which could be either a service certificate or a role certificate. If the certificate does not have the Athenz expected name format the method will an appropriate error.

func FetchIdToken

func FetchIdToken(ztsURL, svcKeyFile, svcCertFile, svcCACertFile, clientId, redirectUri, scope, nonce, state, keyType string, fullArn *bool, proxy bool, expireTime *int32) (string, error)

func FetchIdTokenExpiryTime

func FetchIdTokenExpiryTime(idToken string) (*time.Time, error)

func GenerateAccessTokenRequestString

func GenerateAccessTokenRequestString(domain, service, roles, authzDetails, proxyPrincipalSpiffeUris string, expiryTime int) string

GenerateAccessTokenRequestString generates and urlencodes an access token string.

func GetK8SClientAuthCredential

func GetK8SClientAuthCredential(idToken string) (string, error)

func LoadPublicKey

func LoadPublicKey(publicKeyPEM []byte) (interface{}, error)

LoadPublicKey returns public key object for the given PEM data

func LoadX509Certificate

func LoadX509Certificate(certFile string) (*x509.Certificate, error)

LoadX509Certificate reads and parses the x509.Certificate from the specified file.

func ParseAthenzRoleName

func ParseAthenzRoleName(roleName string) (string, string, error)

func ParseGCPResourceName

func ParseGCPResourceName(resource, objectType string) (string, string, error)

func ParsePrincipal

func ParsePrincipal(principal string) (string, string, error)

func ZmsClient

func ZmsClient(zmsURL, keyFile, certFile, caCertFile string, proxy bool) (*zms.ZMSClient, error)

ZmsClient creates and returns a ZMS client instance.

func ZtsClient

func ZtsClient(ztsURL, keyFile, certFile, caCertFile string, proxy bool) (*zts.ZTSClient, error)

ZtsClient creates and returns a ZTS client instance.

Types

type Config

type Config struct {
	PrivateKey string `yaml:"svc-key-file,omitempty"`  // principal service private key file
	PublicCert string `yaml:"svc-cert-file,omitempty"` // principal service public certificate file
	Zts        string `yaml:"zts,omitempty"`           // zts server hostname
	Zms        string `yaml:"zms,omitempty"`           // zms server hostname
}

func ReadDefaultConfig

func ReadDefaultConfig() (*Config, error)

ReadDefaultConfig reads default configuration from the user's HOME directory