auth

Documentation

Index

• Constants
• func CreateSession(ctx context.Context, session *Session) error
• func DeleteSession(ctx context.Context, token string) error
• func FetchCertificates(discoveryURL string, log zerolog.Logger) (map[string]CertificateList, error)
• func GetUser(ctx context.Context) *service.User
• func Init(db *sql.DB)
• func JWTValidator(certificates map[string]CertificateList, audience string) jwt.Keyfunc
• func SetUser(ctx context.Context, user *service.User) context.Context
• func TrimNaisTeamPrefix(team string) string
• type Azure
  • func NewAzure(clientID, clientSecret, clientTenant, redirectURL string) *Azure
  • func (a *Azure) KeyDiscoveryURL() string
  • func (a *Azure) Middleware(keyDiscoveryURL string, azureGroups *AzureGroupClient, ...) MiddlewareHandler
  • func (a *Azure) Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error)
• type AzureGroupClient
  • func NewAzureGroups(client *http.Client, clientID, clientSecret, tenantID string, ...) *AzureGroupClient
  • func (a *AzureGroupClient) GroupsForUser(ctx context.Context, token, email string) (service.Groups, error)
• type CertificateList
• type EncodedCertificate
  • func (c EncodedCertificate) Decode() (*x509.Certificate, error)
• type GoogleGroupClient
  • func NewGoogleGroups(ctx context.Context, credentailFile, subject string) (*GoogleGroupClient, error)
  • func (g *GoogleGroupClient) Groups(ctx context.Context, email *string) (service.Groups, error)
• type Key
• type KeyDiscovery
  • func Discover(reader io.Reader) (*KeyDiscovery, error)
  • func DiscoverURL(url string) (*KeyDiscovery, error)
  • func (k *KeyDiscovery) Map() (result map[string]CertificateList, err error)
• type MemberOfGroup
• type MemberOfResponse
• type Middleware
  • func (m *Middleware) Handler(next http.Handler) http.Handler
• type MiddlewareHandler
• type Session
  • func GetSession(ctx context.Context, token string) (*Session, error)
• type SessionRetriever
• type TokenResponse

Constants

const (
	AzureGraphMemberOfEndpoint = "https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.group?$select=mail,groupTypes,displayName"
	CacheDuration              = 1 * time.Hour
)

const ContextUserKey contextKey = 1

Functions

func CreateSession

func CreateSession(ctx context.Context, session *Session) error

func DeleteSession

func DeleteSession(ctx context.Context, token string) error

func FetchCertificates

func FetchCertificates(discoveryURL string, log zerolog.Logger) (map[string]CertificateList, error)

func GetUser

func GetUser(ctx context.Context) *service.User

func Init

func Init(db *sql.DB)

func JWTValidator

func JWTValidator(certificates map[string]CertificateList, audience string) jwt.Keyfunc

func SetUser

func SetUser(ctx context.Context, user *service.User) context.Context

func TrimNaisTeamPrefix

func TrimNaisTeamPrefix(team string) string

Types

type Azure

type Azure struct {
	oauth2.Config
	// contains filtered or unexported fields
}

func NewAzure

func NewAzure(clientID, clientSecret, clientTenant, redirectURL string) *Azure

func (*Azure) KeyDiscoveryURL

func (a *Azure) KeyDiscoveryURL() string

func (*Azure) Middleware

func (a *Azure) Middleware(
	keyDiscoveryURL string,
	azureGroups *AzureGroupClient,
	googleGroups *GoogleGroupClient,
	db *sql.DB,
	log zerolog.Logger,
) MiddlewareHandler

func (*Azure) Verify

func (a *Azure) Verify(ctx context.Context, rawIDToken string) (*oidc.IDToken, error)

type AzureGroupClient

type AzureGroupClient struct {
	Client            *http.Client
	OAuthClientID     string
	OAuthClientSecret string
	OAuthTenantID     string
	// contains filtered or unexported fields
}

func NewAzureGroups

func NewAzureGroups(client *http.Client, clientID, clientSecret, tenantID string, log zerolog.Logger) *AzureGroupClient

func (*AzureGroupClient) GroupsForUser

func (a *AzureGroupClient) GroupsForUser(ctx context.Context, token, email string) (service.Groups, error)

type CertificateList

type CertificateList []*x509.Certificate

type EncodedCertificate

type EncodedCertificate string

func (EncodedCertificate) Decode

func (c EncodedCertificate) Decode() (*x509.Certificate, error)

Decode a base64 encoded certificate into a X509 structure.

type GoogleGroupClient

type GoogleGroupClient struct {
	// contains filtered or unexported fields
}

func NewGoogleGroups

func NewGoogleGroups(ctx context.Context, credentailFile, subject string) (*GoogleGroupClient, error)

func (*GoogleGroupClient) Groups

func (g *GoogleGroupClient) Groups(ctx context.Context, email *string) (service.Groups, error)

type Key

type Key struct {
	Kid string               `json:"kid"`
	X5c []EncodedCertificate `json:"x5c"`
}

type KeyDiscovery

type KeyDiscovery struct {
	Keys []Key `json:"keys"`
}

func Discover

func Discover(reader io.Reader) (*KeyDiscovery, error)

func DiscoverURL

func DiscoverURL(url string) (*KeyDiscovery, error)

func (*KeyDiscovery) Map

func (k *KeyDiscovery) Map() (result map[string]CertificateList, err error)

Map transform a KeyDiscovery object into a dictionary with "kid" as key and lists of decoded X509 certificates as values.

Returns an error if any certificate does not decode.

type MemberOfGroup

type MemberOfGroup struct {
	DisplayName string   `json:"displayName"`
	Mail        string   `json:"mail"`
	GroupTypes  []string `json:"groupTypes"`
}

type MemberOfResponse

type MemberOfResponse struct {
	Groups []MemberOfGroup `json:"value"`
}

type Middleware

type Middleware struct {
	// contains filtered or unexported fields
}

func (*Middleware) Handler

func (m *Middleware) Handler(next http.Handler) http.Handler

type MiddlewareHandler

type MiddlewareHandler func(http.Handler) http.Handler

type Session

type Session struct {
	Token       string
	AccessToken string
	Email       string `json:"preferred_username"`
	Name        string `json:"name"`
	Created     time.Time
	Expires     time.Time
}

func GetSession

func GetSession(ctx context.Context, token string) (*Session, error)

type SessionRetriever

type SessionRetriever interface {
	GetSession(ctx context.Context, token string) (*Session, error)
}

type TokenResponse

type TokenResponse struct {
	AccessToken string `json:"access_token"`
}