auth

Documentation

Index

• Constants
• func CalculateAuthorizedCollectionActions(ctx context.Context, authResults VerifyResults, ...) (map[string]*structpb.ListValue, error)
• func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, opt ...Option) context.Context
• func NewVerifierContext(ctx context.Context, iamRepoFn common.IamRepoFactory, ...) context.Context
• type Option
  • func WithAction(action action.Type) Option
  • func WithAnonymousUserNotAllowed(notAllowed bool) Option
  • func WithId(id string) Option
  • func WithKms(kms *kms.Kms) Option
  • func WithPin(pin string) Option
  • func WithRecoveryTokenNotAllowed(notAllowed bool) Option
  • func WithResource(resource *perms.Resource) Option
  • func WithScopeId(id string) Option
  • func WithType(rt resource.Type) Option
  • func WithUserId(id string) Option
• type RequestInfo
• type TokenFormat
  • func GetTokenFromRequest(ctx context.Context, kmsCache *kms.Kms, req *http.Request) (string, string, TokenFormat)
• type VerifyResults
  • func Verify(ctx context.Context, opt ...Option) (ret VerifyResults)
  • func (r *VerifyResults) FetchActionSetForId(ctx context.Context, id string, availableActions action.ActionSet, ...) action.ActionSet
  • func (r *VerifyResults) FetchActionSetForType(ctx context.Context, typ resource.Type, availableActions action.ActionSet, ...) action.ActionSet
  • func (r *VerifyResults) FetchOutputFields(res perms.Resource, act action.Type) perms.OutputFieldsMap

Constants

const (
	AnonymousUserId = "u_anon"
)

Functions

func CalculateAuthorizedCollectionActions

func CalculateAuthorizedCollectionActions(ctx context.Context,
	authResults VerifyResults,
	mapToRange map[resource.Type]action.ActionSet,
	scopeId, pin string) (map[string]*structpb.ListValue, error)

CalculateAuthorizedCollectionActions returns authorized actions for the given inputs.

NOTE: Eventually we should unit test this, but for now every service handler is validating the results of this (as it was pulled out of the service handlers).

func DisabledAuthTestContext

func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, opt ...Option) context.Context

DisabledAuthTestContext is meant for testing, and uses a context that has auth checking entirely disabled. Supported options: WithScopeId an WithUserId are used directly; WithKms is passed through into the verifier context.

func NewVerifierContext

func NewVerifierContext(ctx context.Context,
	iamRepoFn common.IamRepoFactory,
	authTokenRepoFn common.AuthTokenRepoFactory,
	serversRepoFn common.ServersRepoFactory,
	kms *kms.Kms,
	requestInfo RequestInfo) context.Context

NewVerifierContext creates a context that carries a verifier object from the HTTP handlers to the gRPC service handlers. It should only be created in the HTTP handler and should exist for every request that reaches the service handlers.

Types

type Option

type Option func(*options)

Option - how Options are passed as arguments

func WithAction

func WithAction(action action.Type) Option

func WithAnonymousUserNotAllowed

func WithAnonymousUserNotAllowed(notAllowed bool) Option

func WithId

func WithId(id string) Option

func WithKms

func WithKms(kms *kms.Kms) Option

func WithPin

func WithPin(pin string) Option

func WithRecoveryTokenNotAllowed

func WithRecoveryTokenNotAllowed(notAllowed bool) Option

func WithResource

func WithResource(resource *perms.Resource) Option

WithResource specifies a resouce to use

func WithScopeId

func WithScopeId(id string) Option

func WithType

func WithType(rt resource.Type) Option

func WithUserId

func WithUserId(id string) Option

type RequestInfo

type RequestInfo struct {
	Path           string
	Method         string
	PublicId       string
	EncryptedToken string
	Token          string
	TokenFormat    TokenFormat

	DisableAuthzFailures bool
	DisableAuthEntirely  bool
	// contains filtered or unexported fields
}

RequestInfo contains request parameters necessary for checking authn/authz

type TokenFormat

type TokenFormat int

const (
	// We weren't given one or couldn't parse it
	AuthTokenTypeUnknown TokenFormat = iota

	// Came in via the Authentication: Bearer header
	AuthTokenTypeBearer

	// Came in via split cookies
	AuthTokenTypeSplitCookie

	// It's of recovery type
	AuthTokenTypeRecoveryKms
)

func GetTokenFromRequest

func GetTokenFromRequest(ctx context.Context, kmsCache *kms.Kms, req *http.Request) (string, string, TokenFormat)

GetTokenFromRequest pulls the token from either the Authorization header or split cookies and parses it. If it cannot be parsed successfully, the issue is logged and we return blank, so logic will continue as the anonymous user. The public ID and _encrypted_ token are returned along with the token format.

type VerifyResults

type VerifyResults struct {
	UserId      string
	AuthTokenId string
	Error       error
	Scope       *scopes.ScopeInfo

	// AuthenticatedFinished means that the request has passed through the
	// authentication system successfully. This does _not_ indicate whether a
	// token was provided on the request. Requests for `u_anon` will still have
	// this set true! This is because if a request has a token that is invalid,
	// we fall back to `u_anon` because the request may still be allowed for any
	// anonymous user; it simply fails to validate for and look up grants for an
	// actual known user.
	//
	// A good example is when running dev mode twice. The first time you can
	// authenticate and get a token which is saved by the token helper. The
	// second time, you run a command and it reads the token from the helper.
	// That token is no longer valid, but if the action is granted to `u_anon`
	// the action should still succeed. What happens internally is that the
	// token fails to look up a non-anonymous user, so we fallback to the
	// anonymous user, which is the default.
	//
	// If you want to know if the request had a valid token provided, use a
	// switch on UserId. Anything that isn't `u_anon` will have to have had a
	// valid token provided. And a valid token will never fall back to `u_anon`.
	AuthenticationFinished bool

	// RoundTripValue can be set to allow the function performing authentication
	// (often accompanied by lookup(s)) to return a result of that lookup to the
	// calling function. It is opaque to this package.
	RoundTripValue interface{}
	// contains filtered or unexported fields
}

func Verify

func Verify(ctx context.Context, opt ...Option) (ret VerifyResults)

Verify takes in a context that has expected parameters as values and runs an authn/authz check. It returns a user ID, the scope ID for the request (which may come from the URL and may come from the token) and whether or not to proceed, e.g. whether the authn/authz check resulted in failure. If an error occurs it's logged to the system log.

func (*VerifyResults) FetchActionSetForId

func (r *VerifyResults) FetchActionSetForId(ctx context.Context, id string, availableActions action.ActionSet, opt ...Option) action.ActionSet

FetchActionSetForId returns the allowed actions for a given ID using the current set of ACLs and all other parameters the same (user, etc.)

func (*VerifyResults) FetchActionSetForType

func (r *VerifyResults) FetchActionSetForType(ctx context.Context, typ resource.Type, availableActions action.ActionSet, opt ...Option) action.ActionSet

FetchActionSetForType returns the allowed actions for a given collection type using the current set of ACLs and all other parameters the same (user, etc.)

func (*VerifyResults) FetchOutputFields

func (r *VerifyResults) FetchOutputFields(res perms.Resource, act action.Type) perms.OutputFieldsMap