interceptors

Documentation

Overview

Package interceptors defines a set of JWT interceptors that are capable of extracting information from the request JWT, check its validity and pass the information to downstream methods in the context.

Index

• Constants
• func AddClaimToContext(claim *njwt.Claim, ctx context.Context) (context.Context, error)
• func CreateTestIncomingContext(header string, token string) (context.Context, context.CancelFunc)
• func CreateTestOutgoingContext(header string, token string) (context.Context, context.CancelFunc)
• func GetClaimFromContext(ctx context.Context) (*njwt.ExtendedAuthxClaim, error)
• func GetTestAuthxClaim() *njwt.AuthxClaim
• func GetTestJWTConfig() config.JWTConfig
• func JwtInterceptor(config config.JWTConfig) grpc.UnaryServerInterceptor
• func JwtStreamInterceptor(config config.JWTConfig) grpc.StreamServerInterceptor
• func WithServerJWTInterceptor(config config.JWTConfig) grpc.ServerOption
• func WithServerJWTStreamInterceptor(config config.JWTConfig) grpc.ServerOption
• func WithZoneAwareJWTInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.ServerOption
• func WithZoneAwareJWTStreamInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.ServerOption
• func ZoneAwareJWTInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.UnaryServerInterceptor
• func ZoneAwareJWTStreamInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.StreamServerInterceptor
• type CachedSecret
  • func (cs *CachedSecret) Clone() *CachedSecret
• type InterceptorZoneSecretManager
  • func (izsm *InterceptorZoneSecretManager) Evict()
  • func (izsm *InterceptorZoneSecretManager) GetZoneSecret(zoneID string) (*string, error)
• type SecretProvider
  • func NewInterceptorZoneSecretManager(config config.JWTConfig, secretsClient grpc_jwt_go.SecretsClient, ...) SecretProvider
• type StreamContextWrapper

Constants

const ClientTimeout = 30 * time.Second

Functions

func AddClaimToContext

func AddClaimToContext(claim *njwt.Claim, ctx context.Context) (context.Context, error)

AddClaimToContext returns new Context joining the claim information

func CreateTestIncomingContext

func CreateTestIncomingContext(header string, token string) (context.Context, context.CancelFunc)

func CreateTestOutgoingContext

func CreateTestOutgoingContext(header string, token string) (context.Context, context.CancelFunc)

func GetClaimFromContext

func GetClaimFromContext(ctx context.Context) (*njwt.ExtendedAuthxClaim, error)

GetClaimFromContext gets user info from context

func GetTestAuthxClaim

func GetTestAuthxClaim() *njwt.AuthxClaim

GetTestAuthxClaim returns a random AuthxClaim to use in the tests

func GetTestJWTConfig

func GetTestJWTConfig() config.JWTConfig

GetTestJWTConfig returns a JWTConfig to use in the tests

func JwtInterceptor

func JwtInterceptor(config config.JWTConfig) grpc.UnaryServerInterceptor

JwtInterceptor verifies the JWT token and adds the claim information in the context

func JwtStreamInterceptor

func JwtStreamInterceptor(config config.JWTConfig) grpc.StreamServerInterceptor

JwtStreamInterceptor verifies the JWT token and adds the claim information in the context

func WithServerJWTInterceptor

func WithServerJWTInterceptor(config config.JWTConfig) grpc.ServerOption

WithServerJWTInterceptor creates a gRPC interceptor that verifies the JWT received is valid

func WithServerJWTStreamInterceptor

func WithServerJWTStreamInterceptor(config config.JWTConfig) grpc.ServerOption

func WithZoneAwareJWTInterceptor

func WithZoneAwareJWTInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.ServerOption

WithZoneAwareJWTInterceptor creates a gRPC interceptor that verifies if the JWT received is valid attending to the zone that issued it.

func WithZoneAwareJWTStreamInterceptor

func WithZoneAwareJWTStreamInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.ServerOption

WithZoneAwareJWTStreamInterceptor creates a gRPC stream interceptor that verifies if the JWT received is // valid attending to the zone that issued it.

func ZoneAwareJWTInterceptor

func ZoneAwareJWTInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.UnaryServerInterceptor

ZoneAwareJWTInterceptor verifies the JWT token and adds the claim information in the context

func ZoneAwareJWTStreamInterceptor

func ZoneAwareJWTStreamInterceptor(config config.JWTConfig, secretProvider SecretProvider) grpc.StreamServerInterceptor

ZoneAwareJWTStreamInterceptor verifies the JWT token and adds the claim information in the context

Types

type CachedSecret

type CachedSecret struct {
	// contains filtered or unexported fields
}

CachedSecret stores a JWT secret with the timestamp in which it has been retrieved.

func (*CachedSecret) Clone

func (cs *CachedSecret) Clone() *CachedSecret

Clone a cached secret.

type InterceptorZoneSecretManager

type InterceptorZoneSecretManager struct {
	sync.RWMutex

	SecretCache map[string]*CachedSecret
	// contains filtered or unexported fields
}

InterceptorZoneSecretManager offers a cached zone JWT signing secret retrieval interface. Elements retrieved from the SecretsClient are stored in an internal cache for a period of time before being evicted.

func (*InterceptorZoneSecretManager) Evict

func (izsm *InterceptorZoneSecretManager) Evict()

Evict old entries of the cache attending to the creation timestamp.

func (*InterceptorZoneSecretManager) GetZoneSecret

func (izsm *InterceptorZoneSecretManager) GetZoneSecret(zoneID string) (*string, error)

GetZoneSecret retrieves JWT signing secret associated with a given zone identifier.

type SecretProvider

type SecretProvider interface {
	// GetZoneSecret retrieves the signing secret associated with a Zone so that
	// it can be used in the token validation process.
	GetZoneSecret(zoneID string) (*string, error)
}

SecretProvider defines the methods required for a secret provider. This enables the JWT interceptor to retrieve the secret that corresponds to the signing zone to check the validity of the token.

func NewInterceptorZoneSecretManager

func NewInterceptorZoneSecretManager(config config.JWTConfig, secretsClient grpc_jwt_go.SecretsClient, zoneCacheTTL time.Duration) SecretProvider

NewInterceptorZoneSecretManager creates a zone manager that communicates with the secrets service to retrieve zone signing secrets.

type StreamContextWrapper

type StreamContextWrapper interface {
	grpc.ServerStream
	SetContext(context.Context)
}

StreamContextWrapper is an interface that allows to set new context to stream