asgard

Documentation

Overview

Package asgard provides middleware for use in HTTP API servers that require client certificate (mTLS) authentication.

In Norse mythology Heimdallr is the gatekeeper of the celestial bridge, the Bifröst. Hofund is Heimdallr's sword. No mythical significance, just a cool name.

Here Heimdallr returns a middleware that parses client certs from a request header. Hofund returns a middleware that parses client certs from the TLS connection. Use Heimdallr if you have a reverse proxy that terminates TLS connections. Use Hofund if you are directly serving TLS connections.

Index

• func ClientCert(ctx context.Context) (*bifrost.Certificate, bool)
• func Heimdallr(h HeaderName, ns uuid.UUID) func(http.Handler) http.Handler
• func Hofund(h HeaderName, ns uuid.UUID) func(http.Handler) http.Handler
• type HeaderName
  • func (i HeaderName) String() string

Functions

func ClientCert

func ClientCert(ctx context.Context) (*bifrost.Certificate, bool)

ClientCert returns the client certificate from the request context. If the client certificate is not present, the second return value is false. Use this function to access the client certificate in a HTTP handler that has been wrapped with Heimdallr.

func Heimdallr

func Heimdallr(h HeaderName, ns uuid.UUID) func(http.Handler) http.Handler

Heimdallr returns a middleware that parses a client certificate from the h request header.

If a certificate is not found or is invalid, the middleware responds with a 503 Service Unavailable. If the certificate namespace does not match ns, the middleware responds with a 403 Forbidden.

Use this if you have a reverse proxy that terminates TLS connections and passes the client certificate in a request header.

func Hofund

func Hofund(h HeaderName, ns uuid.UUID) func(http.Handler) http.Handler

Hofund returns a middleware that validates a client certificate and sets the certificate in the h request header.

If a certificate is not found or is invalid, the middleware responds with a 401 Unauthorized. If the certificate namespace does not match ns, the middleware responds with a 403 Forbidden.

Use this if you are directly serving TLS connections.

Types

type HeaderName

type HeaderName int

const (
	HeaderNameClientCertLeaf HeaderName = iota // X-Amzn-Mtls-Clientcert-Leaf
	HeaderNameClientCert                       // X-Amzn-Mtls-Clientcert
)

func (HeaderName) String

func (i HeaderName) String() string