ociauth

package module
v0.17.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 6, 2024 License: MPL-2.0 Imports: 20 Imported by: 6

README

Vault Plugin Auth OCI

Vault auth plugin for Oracle Cloud Infrastructure.

Acceptance tests

The acceptance tests can only be run from an OCI instance.

If you are running this code on an OCI instance, you can run them directly with make testacc. You will need to set the following environtment variables:

  • HOME_TENANCY_ID to the tenancy you are running under (or your root tenancy ID)
  • ROLE_OCID_LIST to a comma-separated list of group OCIDs to at least two groups. At least one should be a dynamic group that contains the instance, and another should be an identity group that contains your user.

For example:

make testacc HOME_TENANCY_ID=ocid1.tenancy.oc1..aaaaaaaasomecharacter ROLE_OCID_LIST=ocid1.group.oc1..aaaaaaaasomecharacters OCI_GO_SDK_DEBUG=info VAULT_LOG_LEVEL=debug
Terraform

You can run the acceptance tests with terraform as well.

You will need an OCI account.

You need to generate and download a private key in your account settings. This should give you a private key file, the fingerprint, your tenancy OCID, and your user OCID.

Using those, you can run the acceptance tests via:

cd tests/terraform
# download your private key to this directory
terraform init
terraform apply \
  -var "fingerprint=YOURFINGERPRINT" \
  -var "tenancy_ocid=YOUR_TENANCY_OCID" \
  -var "user_ocid=YOUR_USER_OCID" \
  -var "private_key_path=YOUR_PRIVATE_KEY" \
  -var "region=YOUR_REGION"

This downloads the current main branch from GitHub and runs the tests on an OCI instance. It takes about 5 minutes.

Don't forget to destroy the resources when you are done:

terraform destroy \
  -var "fingerprint=YOURFINGERPRINT" \
  -var "tenancy_ocid=YOUR_TENANCY_OCID" \
  -var "user_ocid=YOUR_USER_OCID" \
  -var "private_key_path=YOUR_PRIVATE_KEY" \
  -var "region=YOUR_REGION"

Documentation

Overview

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Copyright © 2019, Oracle and/or its affiliates.

Index

Constants

View Source 
const (
	PrincipalTypeUser     = "user"
	PrincipalTypeInstance = "instance"
)

These constants define types of principal

View Source 
const (
	PathVersionBase    = "/v1"
	PathBaseFormat     = "/auth/%s/login/%s"
	PathLoginMethod    = "get"
	PathSegmentAuth    = "auth"
	PathSegmentLogin   = "login"
	PathSegmentVersion = "v1"
)

These constants store the required http path & method information for validating the signed request

View Source 
const (
	// HdrRequestTarget represents the special header name used to refer to the HTTP verb and URI in the signature.
	HdrRequestTarget = `(request-target)`
)

Signing Header constants

View Source 
const (
	HomeTenancyIdConfigName = "home_tenancy_id"
)

These constants store the configuration keys

View Source 
const (
	// Increasing this above this limit might require implementing
	// client-side paging in the filterGroupMembership API
	MaxOCIDsPerRole = 100
)

Constants for role specific data

Variables

View Source 
var (
	ClaimPrincipalType = "ptype"
)

This constant defines the Principal type key

Functions

func Backend 

func Backend() (*backend, error)

func CreateLoginData 

func CreateLoginData(addr string, m map[string]string, path string) (map[string]interface{}, error)

CreateLoginData creates the interface required for a login request, signed using the corresponding OCI Identity Principal

func Factory 

func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error)

func GetSignedAPIRequestHeaders added in v0.13.0 

func GetSignedAPIRequestHeaders(addr, path string) (http.Header, error)

func GetSignedInstanceRequestHeaders added in v0.13.0 

func GetSignedInstanceRequestHeaders(addr, path string) (http.Header, error)

Types

type AuthenticateClientDetails 

type AuthenticateClientDetails struct {
	RequestHeaders map[string][]string `json:"requestHeaders"`
}

Stores the request headers required for authenticating the client

func (AuthenticateClientDetails) String 

func (m AuthenticateClientDetails) String() string

Prints the values of pointers in AuthenticateClientDetails, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type AuthenticateClientRequest 

type AuthenticateClientRequest struct {
	// Request object for AuthenticateClientRequest
	AuthenticateClientDetails `contributesTo:"body"`

	// A token that uniquely identifies a request so it can be retried in case of a timeout or
	// server error without risk of executing that same action again. Retry tokens expire after 24
	// hours, but can be invalidated before then due to conflicting operations (e.g., if a resource
	// has been deleted and purged from the system, then a retry of the original creation request
	// may be rejected).
	OpcRetryToken *string `mandatory:"false" contributesTo:"header" name:"opc-retry-token"`

	// Unique Oracle-assigned identifier for the request.
	// If you need to contact Oracle about a particular request, please provide the request ID.
	OpcRequestId *string `mandatory:"false" contributesTo:"header" name:"opc-request-id"`

	// Metadata about the request. This information will not be transmitted to the service, but
	// represents information that the SDK will consume to drive retry behavior.
	RequestMetadata common.RequestMetadata
}

Stores the request body and meta-data required for authenticating the client

func (AuthenticateClientRequest) BinaryRequestBody added in v0.15.0 

func (request AuthenticateClientRequest) BinaryRequestBody() (*common.OCIReadSeekCloser, bool)

BinaryRequestBody implements the OCIRequest interface

func (AuthenticateClientRequest) HTTPRequest 

func (request AuthenticateClientRequest) HTTPRequest(method, path string, binaryRequestBody *common.OCIReadSeekCloser, extraHeaders map[string]string) (http.Request, error)

HTTPRequest implements the OCIRequest interface

func (AuthenticateClientRequest) RetryPolicy 

func (request AuthenticateClientRequest) RetryPolicy() *common.RetryPolicy

RetryPolicy implements the OCIRetryableRequest interface. This retrieves the specified retry policy.

func (AuthenticateClientRequest) String 

func (request AuthenticateClientRequest) String() string

Prints the values of pointers in AuthenticateClientRequest, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type AuthenticateClientResponse 

type AuthenticateClientResponse struct {
	// The underlying http response
	RawResponse *http.Response

	// The AuthenticateClientResult instance
	AuthenticateClientResult `presentIn:"body"`

	// Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a
	// particular request, please provide the request ID.
	OpcRequestId *string `presentIn:"header" name:"opc-request-id"`

	// For optimistic concurrency control. See `if-match`.
	Etag *string `presentIn:"header" name:"etag"`
}

Stores the response of the AuthenticateClient request, including meta-data.

func (AuthenticateClientResponse) HTTPResponse 

func (response AuthenticateClientResponse) HTTPResponse() *http.Response

HTTPResponse implements the OCIResponse interface

func (AuthenticateClientResponse) String 

func (response AuthenticateClientResponse) String() string

Prints the values of pointers in AuthenticateClientResponse, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type AuthenticateClientResult 

type AuthenticateClientResult struct {
	Principal    *Principal `json:"principal"`
	ErrorMessage *string    `json:"errorMessage"`
	IsSuccess    *bool      `json:"success"`
}

Contains the result of the Authenticate Client request.

func (AuthenticateClientResult) String 

func (m AuthenticateClientResult) String() string

Prints the values of pointers in AuthenticateClientResult, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type AuthenticationClient 

type AuthenticationClient struct {
	common.BaseClient
	// contains filtered or unexported fields
}

AuthenticationClient stores the client and configuration details for authenticating

func NewAuthenticationClientWithConfigurationProvider 

func NewAuthenticationClientWithConfigurationProvider(configProvider common.ConfigurationProvider) (client AuthenticationClient, err error)

NewAuthenticationClientWithConfigurationProvider Creates a new default Authentication client with the given configuration provider. the configuration provider will be used for the default signer as well as reading the region

func (AuthenticationClient) AuthenticateClient 

func (client AuthenticationClient) AuthenticateClient(ctx context.Context, request AuthenticateClientRequest) (response AuthenticateClientResponse, err error)

AuthenticateClient takes in a request to authenticate a client, makes the API request to OCI Identity and returns the Response. If the authentication is successful, the AuthenticateClientResult member of the response will contain the Principal of the authenticated entity.

func (AuthenticationClient) FilterGroupMembership 

func (client AuthenticationClient) FilterGroupMembership(ctx context.Context, request FilterGroupMembershipRequest) (response FilterGroupMembershipResponse, err error)

FilterGroupMembership takes in a list of Group or Dynamic Group IDs and a Principal context and makes an API request to OCI Identity. If the request is successful, it returns the subset of the request groups that the entity corresponding to the Principal is a part of.

func (*AuthenticationClient) SetHost 

func (client *AuthenticationClient) SetHost(host string)

SetRegion overrides the region of this client.

func (*AuthenticationClient) SetRegion 

func (client *AuthenticationClient) SetRegion(region string)

SetRegion overrides the region of this client.

type CLIHandler 

type CLIHandler struct{}

func (*CLIHandler) Auth 

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error)

func (*CLIHandler) Help 

func (h *CLIHandler) Help() string

type Claim 

type Claim struct {
	Key    *string `json:"key"`
	Value  *string `json:"value"`
	Issuer *string `json:"issuer"`
}

Stores a list of claims of a Principal

func (Claim) String 

func (m Claim) String() string

Prints the values of pointers in Claim, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type FilterGroupMembershipDetails 

type FilterGroupMembershipDetails struct {
	Principal Principal `json:"principal"`
	GroupIds  []string  `json:"groupIds"`
}

Stores the Principal and list of Group or Dynamic Group Ids required for the filtering request

func (FilterGroupMembershipDetails) String 

func (m FilterGroupMembershipDetails) String() string

Prints the values of pointers in FilterGroupMembershipDetails, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type FilterGroupMembershipRequest 

type FilterGroupMembershipRequest struct {

	// Request object for FilterGroupMembershipRequest
	FilterGroupMembershipDetails `contributesTo:"body"`

	// A token that uniquely identifies a request so it can be retried in case of a timeout or
	// server error without risk of executing that same action again. Retry tokens expire after 24
	// hours, but can be invalidated before then due to conflicting operations (e.g., if a resource
	// has been deleted and purged from the system, then a retry of the original creation request
	// may be rejected).
	OpcRetryToken *string `mandatory:"false" contributesTo:"header" name:"opc-retry-token"`

	// Unique Oracle-assigned identifier for the request.
	// If you need to contact Oracle about a particular request, please provide the request ID.
	OpcRequestId *string `mandatory:"false" contributesTo:"header" name:"opc-request-id"`

	// Metadata about the request. This information will not be transmitted to the service, but
	// represents information that the SDK will consume to drive retry behavior.
	RequestMetadata common.RequestMetadata
}

Stores the request body and meta-data required for filtering the group membership

func (FilterGroupMembershipRequest) BinaryRequestBody added in v0.15.0 

func (request FilterGroupMembershipRequest) BinaryRequestBody() (*common.OCIReadSeekCloser, bool)

BinaryRequestBody implements the OCIRequest interface

func (FilterGroupMembershipRequest) HTTPRequest 

func (request FilterGroupMembershipRequest) HTTPRequest(method, path string, binaryRequestBody *common.OCIReadSeekCloser, extraHeaders map[string]string) (http.Request, error)

HTTPRequest implements the OCIRequest interface

func (FilterGroupMembershipRequest) RetryPolicy 

func (request FilterGroupMembershipRequest) RetryPolicy() *common.RetryPolicy

RetryPolicy implements the OCIRetryableRequest interface. This retrieves the specified retry policy.

func (FilterGroupMembershipRequest) String 

func (request FilterGroupMembershipRequest) String() string

type FilterGroupMembershipResponse 

type FilterGroupMembershipResponse struct {

	// The underlying http response
	RawResponse *http.Response

	// The FilterGroupMembershipResult instance
	FilterGroupMembershipResult `presentIn:"body"`

	// Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a
	// particular request, please provide the request ID.
	OpcRequestId *string `presentIn:"header" name:"opc-request-id"`

	// For optimistic concurrency control. See `if-match`.
	Etag *string `presentIn:"header" name:"etag"`
}

Stores the response of the FilterGroupMembership request, including meta-data.

func (FilterGroupMembershipResponse) HTTPResponse 

func (response FilterGroupMembershipResponse) HTTPResponse() *http.Response

HTTPResponse implements the OCIResponse interface

func (FilterGroupMembershipResponse) String 

func (response FilterGroupMembershipResponse) String() string

type FilterGroupMembershipResult 

type FilterGroupMembershipResult struct {
	Principal Principal `json:"principal"`
	GroupIds  []string  `json:"groupIds"`
}

Contains the result of the FilterGroupMembership request.

func (FilterGroupMembershipResult) String 

func (m FilterGroupMembershipResult) String() string

Prints the values of pointers in FilterGroupMembershipResult, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

type InternalClaim 

type InternalClaim struct {
	Issuer string `json:"issuer"`
	Key    string `json:"key"`
	Value  string `json:"value"`
}

Claim is a representation of a JWT claim

func FromClaim 

func FromClaim(claim Claim) InternalClaim

FromClaims takes in a claim and coverts it to an InternalClaim

type InternalClaims 

type InternalClaims map[string][]InternalClaim

Claims represents a collection of JWT claims

func FromClaims 

func FromClaims(claimList []Claim) InternalClaims

FromClaims takes in a list of claims and coverts it to InternalClaims

func (InternalClaims) GetSingleClaim 

func (c InternalClaims) GetSingleClaim(key string) InternalClaim

GetSingleClaim returns single claim given a claim type.

func (InternalClaims) GetString 

func (c InternalClaims) GetString(key string) string

GetString returns the claim value given a claim type.

type OCIConfigEntry 

type OCIConfigEntry struct {
	HomeTenancyId string `json:"home_tenancy_id" `
}

Struct to hold the information associated with an OCI config

type OCIRoleEntry 

type OCIRoleEntry struct {
	tokenutil.TokenParams

	OcidList []string `json:"ocid_list"`
}

Struct to hold the information associated with an OCI role

type OciClient 

type OciClient struct {
	common.BaseClient
	// contains filtered or unexported fields
}

OciClient stores the client and configuration details for making API requests to OCI Identity Service

func NewOciClientWithConfigurationProvider 

func NewOciClientWithConfigurationProvider(configProvider common.ConfigurationProvider) (client OciClient, err error)

NewIdentityClientWithConfigurationProvider Creates a new default Identity client with the given configuration provider. the configuration provider will be used for the default signer as well as reading the region

func (OciClient) ConstructLoginRequest 

func (client OciClient) ConstructLoginRequest(path string) (request http.Request, err error)

ConstructLoginRequest takes in a path and returns a signed http request

type Principal 

type Principal struct {
	TenantId  *string `json:"tenantId"`
	SubjectId *string `json:"subjectId"`
	Claims    []Claim `json:"claims"`
}

Stores the details about a Principal

func (Principal) String 

func (m Principal) String() string

Prints the values of pointers in Principal, producing a human friendly string for an struct with pointers. Useful when debugging the values of a struct.

Source Files

View all Source files

Directories

Path Synopsis
cmd
vault-plugin-auth-oci

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.