auth

Documentation

Index

• Constants
• func NewApiToken(claims *jwt.StandardClaims, issuer, userId string, validity time.Duration, ...) *jwt.AuthToken
• func NewAuthToken(claims *jwt.StandardClaims, issuer, userId string, validity time.Duration) *jwt.AuthToken
• func NewClusterBootstrapToken(claims *jwt.StandardClaims, issuer, userId string) *jwt.AuthToken
• func NewKubernetesAuthToken(claims *jwt.StandardClaims, clusterClaim *jwt.ClusterClaim, ...) *jwt.AuthToken
• type Client
  • func NewClient(config *ClientConfig) *Client
  • func (n *Client) Exchange(ctx context.Context, code, state string) (*jwt.StandardClaims, error)
  • func (n *Client) GetAuthCodeURL(redirectUrl string) (string, string, error)
  • func (n *Client) SetupOIDC(ctx context.Context) error
• type ClientConfig
• type Server
  • func NewServer(config *ServerConfig, signer jwt.JWTSigner, verifier jwt.JWTVerifier) *Server
  • func (n *Server) Authorize(ctx context.Context, token string, claims interface{}) error
  • func (n *Server) IssueToken(ctx context.Context, upstreamClaims *jwt.StandardClaims, userId string) (string, *jwt.AuthToken, error)
  • func (n *Server) Keys() *jose.JSONWebKeySet
• type ServerConfig
• type State
  • func DecodeState(encoded string) (*State, error)
  • func (state *State) Encode() (string, error)
  • func (state *State) IsValid() bool

Constants

const (
	AudienceAPI     = "m8api"
	AudienceK8sAuth = "k8sauth"
)

const (
	HeaderAuthId              = "x-auth-id"
	HeaderAuthName            = "x-auth-name"
	HeaderAuthEmail           = "x-auth-email"
	HeaderAuthNotBefore       = "x-auth-not-before"
	HeaderAuthNotBeforeFormat = time.RFC3339
	HeaderForwardedClientCert = "x-forwarded-client-cert"
)

const (
	ClusterBootstrapTokenValidity = 10 * time.Minute
)

Functions

func NewApiToken

func NewApiToken(claims *jwt.StandardClaims, issuer, userId string, validity time.Duration, scopes []gateway.AuthorizationScope) *jwt.AuthToken

func NewAuthToken

func NewAuthToken(claims *jwt.StandardClaims, issuer, userId string, validity time.Duration) *jwt.AuthToken

func NewClusterBootstrapToken

func NewClusterBootstrapToken(claims *jwt.StandardClaims, issuer, userId string) *jwt.AuthToken

func NewKubernetesAuthToken

func NewKubernetesAuthToken(claims *jwt.StandardClaims, clusterClaim *jwt.ClusterClaim, issuer, userId string, validity time.Duration) *jwt.AuthToken

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Implements an OIDC client which authenticates to an upstream IDP

func NewClient

func NewClient(config *ClientConfig) *Client

func (*Client) Exchange

func (n *Client) Exchange(ctx context.Context, code, state string) (*jwt.StandardClaims, error)

Exchange exchanges the auth code with a token of the upstream IDP and verifies the claims

func (*Client) GetAuthCodeURL

func (n *Client) GetAuthCodeURL(redirectUrl string) (string, string, error)

AuthCodeURL returns a URL to OAuth 2.0 provider's consent page that asks for permissions for the required scopes explicitly.

func (*Client) SetupOIDC

func (n *Client) SetupOIDC(ctx context.Context) error

type ClientConfig

type ClientConfig struct {
	IdentityProvider string // URL of the upstream identity provider
	Scopes           []string
	OfflineAsScope   bool
	Nonce            string
	ClientId         string
	ClientSecret     string
	RedirectURIs     []string
}

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server implements a very basic OIDC server which issues and validates tokens

func NewServer

func NewServer(config *ServerConfig, signer jwt.JWTSigner, verifier jwt.JWTVerifier) *Server

NewServer creates a new OIDC server

func (*Server) Authorize

func (n *Server) Authorize(ctx context.Context, token string, claims interface{}) error

Authorize parses the raw JWT, verifies the content against the public key of the verifier and parses the claims

func (*Server) IssueToken

func (n *Server) IssueToken(ctx context.Context, upstreamClaims *jwt.StandardClaims, userId string) (string, *jwt.AuthToken, error)

IssueToken wraps the upstream claims in a JWT signed by Monoskope

func (*Server) Keys

func (n *Server) Keys() *jose.JSONWebKeySet

type ServerConfig

type ServerConfig struct {
	URL           string
	TokenValidity time.Duration
}

type State

type State struct {
	Callback string `form:"callback" json:"callback,omitempty"`
}

func DecodeState

func DecodeState(encoded string) (*State, error)

func (*State) Encode

func (state *State) Encode() (string, error)

func (*State) IsValid

func (state *State) IsValid() bool