credential

Documentation

Overview

Package credential defines interfaces shared by other packages that manage credentials for Boundary sessions.

Index

• func Register(subtype subtypes.Subtype, prefixes ...string) error
• func SubtypeFromId(id string) subtypes.Subtype
• func SubtypeFromType(t string) subtypes.Subtype
• type Credential
• type Dynamic
• type Issuer
• type Library
• type Purpose
• type Request
• type Revoker
• type SecretData
• type Store

Functions

func Register

func Register(subtype subtypes.Subtype, prefixes ...string) error

Register registers all the prefixes for a provided Subtype. Register returns an error if the subtype has already been registered or if any of the prefixes are associated with another subtype.

func SubtypeFromId

func SubtypeFromId(id string) subtypes.Subtype

SubtypeFromId returns the Subtype from the provided id if the id's prefix was registered with a Subtype. Otherwise Unknown is returned.

func SubtypeFromType

func SubtypeFromType(t string) subtypes.Subtype

SubtypeFromType returns the Subtype from the provided string or if no Subtype was registered with that string Unknown is returned.

Types

type Credential

type Credential interface {
	boundary.Entity
	Secret() SecretData
}

Credential is an entity containing secret data.

type Dynamic

type Dynamic interface {
	Credential
	GetSessionId() string
	Library() Library
	Purpose() Purpose
}

Dynamic is a credential generated by a library for a specific session.

type Issuer

type Issuer interface {
	// Issue issues dynamic credentials for a session from the requested
	// libraries and for the requested purposes. The sessionId must be a
	// valid sessionId. The SourceId in each request must be the public id
	// of a library the Issuer can issue credentials from.
	//
	// If Issue encounters an error, it returns no credentials and revokes
	// any credentials issued before encountering the error.
	Issue(ctx context.Context, sessionId string, requests []Request) ([]Dynamic, error)
}

Issuer issues dynamic credentials.

type Library

type Library interface {
	boundary.Resource
	GetStoreId() string
}

A Library is a resource that provides credentials that are of the same type and access level from a single store.

type Purpose

type Purpose string

Purpose is the purpose of the credential.

const (
	// ApplicationPurpose is a credential used for application specific
	// purposes. Application credentials are returned to the user.
	ApplicationPurpose Purpose = "application"

	// IngressPurpose is a credential used by a boundary worker to secure
	// the connection between the user and the worker. Ingress credentials
	// are never returned to the user.
	IngressPurpose Purpose = "ingress"

	// EgressPurpose is a credential used by a boundary worker to secure
	// the connection between the worker and the endpoint. Egress
	// credentials are never returned to the user.
	EgressPurpose Purpose = "egress"
)

Credential purpose values.

type Request

type Request struct {
	SourceId string
	Purpose  Purpose
}

A Request represents a request for a credential from the SourceId for the given purpose. For dynamic credentials, the SourceId is the PublicId of a credential library.

type Revoker

type Revoker interface {
	// Revoke revokes the dynamic credentials issued for sessionid.
	Revoke(ctx context.Context, sessionId string) error
}

Revoker revokes dynamic credentials.

type SecretData

type SecretData interface{}

SecretData represents secret data.

type Store

type Store interface {
	boundary.Resource
	GetScopeId() string
}

A Store is a resource that can store, retrieve, and potentially generate credentials of differing types and access levels. It belongs to a scope and must support the principle of least privilege by providing mechanisms to limit the credentials it can access to the minimum necessary for the scope it is in.