aksk

README

aksk

access key/secret key auth middleware for kratos

the logic behind can refer amazon s3 authentication

Authorization = AuthorizationHeader + " " + AccessKeyId + ":" + Signature;

Signature = Base64( HashMethod( UTF-8-Encoding-Of(YourSecretKey), UTF-8-Encoding-Of( StringToSign ) ) );

StringToSign = HTTP-Verb + "\n" +
	Content-MD5 + "\n" +
	Content-Type + "\n" +
    UnixTimeStamp + "\n" +
	requestURL;

the client unixTimestamp should be passed from request header in ms. the middleware has some options:

    baseAuthHeaderKey string
	timeStampKey      string
	encodeUrl         bool
	hashHelper        hasher.AkSKHashHelper
	secretKeyProvider SecretKeyProvider

default options:

• hashHelper Sha1
• baseAuthHeader X-API-KEY
• timestampKey ts
• url not encoded encodeUrl = false

reference:

• https://github.com/dynuc/gophercloud/blob/master/auth/aksk/aksk_signer.go

• https://blog.csdn.net/makenothing/article/details/81158481

• https://docs.emqx.com/zh/fabric/latest/api_auth/ak_sk.html#%E4%BD%BF%E7%94%A8ak-sk

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3_Authentication2.html

Documentation

Index

• Constants
• Variables
• func Server(opts ...Option) middleware.Middleware
• type Opt
  • func WithContent(content []byte) Opt
  • func WithContentType(contentType string) Opt
  • func WithHttpVerb(httpVerb string) Opt
  • func WithRequestUrl(requestUrl string) Opt
  • func WithUnixTimeStamp(unixTimeStamp string) Opt
• type Option
  • func WithAuthorizationHeader(header string) Option
  • func WithEncodeUrl(encodeUrl bool) Option
  • func WithHashHelper(helper hasher.AkSKHashHelper) Option
  • func WithSecretKeyProvider(provider SecretKeyProvider) Option
  • func WithTimeStampKey(timeStamp string) Option
• type SecretKeyProvider
• type SignGenerator
  • func New(secretKey []byte, hashHelper hasher.AkSKHashHelper, options ...Opt) *SignGenerator
  • func (g *SignGenerator) Calculate() ([]byte, error)
  • func (g *SignGenerator) CheckSignValid(targetSign []byte) (bool, error)
  • func (g *SignGenerator) GetSignContent() (string, error)

Constants

const (
	ContentTypeHeader string = "Content-Type"
)

Variables

var (
	ErrMissingAuthorizationHeader = errors.Unauthorized(reason, "Authorization Header is missing")
	ErrSecretKeyProviderNotSet    = errors.Unauthorized(reason, "Secret Key Provider Not Set")
	ErrHashHelperNotSet           = errors.Unauthorized(reason, "Hash Helper Not Set")
	ErrSignCheckFailed            = errors.Unauthorized(reason, "Sign Check failed")
	ErrAuthorizationInvalid       = errors.Unauthorized(reason, "Authorization is invalid")
	ErrAuthorizationExpired       = errors.Unauthorized(reason, "Authorization has expired")
	ErrAuthorizationParseFail     = errors.Unauthorized(reason, "Fail to parse Authorization")
	ErrUnSupportSigningMethod     = errors.Unauthorized(reason, "Wrong signing method")
	ErrWrongContext               = errors.Unauthorized(reason, "Wrong context for middleware")
	ErrNeedTokenProvider          = errors.Unauthorized(reason, "Authorization provider is missing")
	ErrSignToken                  = errors.Unauthorized(reason, "Can not sign Authorization.Is the key correct?")
	ErrGetKey                     = errors.Unauthorized(reason, "Can not get key while signing Authorization")
)

Functions

func Server

func Server(opts ...Option) middleware.Middleware

Types

type Opt

type Opt func(generator *SignGenerator)

func WithContent

func WithContent(content []byte) Opt

func WithContentType

func WithContentType(contentType string) Opt

func WithHttpVerb

func WithHttpVerb(httpVerb string) Opt

func WithRequestUrl

func WithRequestUrl(requestUrl string) Opt

func WithUnixTimeStamp

func WithUnixTimeStamp(unixTimeStamp string) Opt

type Option

type Option func(*options)

Option is ak/sk option.

func WithAuthorizationHeader

func WithAuthorizationHeader(header string) Option

WithAuthorizationHeader set the authorization header

func WithEncodeUrl

func WithEncodeUrl(encodeUrl bool) Option

WithEncodeUrl set whether to encode url

func WithHashHelper

func WithHashHelper(helper hasher.AkSKHashHelper) Option

WithHashHelper set the hash helper for hash logic

func WithSecretKeyProvider

func WithSecretKeyProvider(provider SecretKeyProvider) Option

WithSecretKeyProvider set the provider to get the secret key

func WithTimeStampKey

func WithTimeStampKey(timeStamp string) Option

WithTimeStampKey custom the WithTimeStamp key to fetch the timestamp

type SecretKeyProvider

type SecretKeyProvider interface {
	GetSecretKey(accessKey string) (secretKey string, err error)
}

type SignGenerator

type SignGenerator struct {
	// contains filtered or unexported fields
}

func New

func New(secretKey []byte, hashHelper hasher.AkSKHashHelper, options ...Opt) *SignGenerator

func (*SignGenerator) Calculate

func (g *SignGenerator) Calculate() ([]byte, error)

func (*SignGenerator) CheckSignValid

func (g *SignGenerator) CheckSignValid(targetSign []byte) (bool, error)

func (*SignGenerator) GetSignContent

func (g *SignGenerator) GetSignContent() (string, error)