authenticate

Documentation

Overview

Package authenticate is a pomerium service that handles user authentication and refersh (AuthN).

Index

• func ValidateOptions(o *config.Options) error
• type Authenticate
  • func New(cfg *config.Config) (*Authenticate, error)
  • func (a *Authenticate) Dashboard(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) FrontchannelLogout(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) Handler() http.Handler
  • func (a *Authenticate) Impersonate(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) Mount(r *mux.Router)
  • func (a *Authenticate) OAuthCallback(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) OnConfigChange(cfg *config.Config)
  • func (a *Authenticate) RetrieveSession(next http.Handler) http.Handler
  • func (a *Authenticate) RobotsTxt(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) SignOut(w http.ResponseWriter, r *http.Request) error
  • func (a *Authenticate) VerifySession(next http.Handler) http.Handler

Functions

func ValidateOptions

func ValidateOptions(o *config.Options) error

ValidateOptions checks that configuration are complete and valid. Returns on first error found.

Types

type Authenticate

type Authenticate struct {
	// contains filtered or unexported fields
}

Authenticate contains data required to run the authenticate service.

func New

func New(cfg *config.Config) (*Authenticate, error)

New validates and creates a new authenticate service from a set of Options.

func (*Authenticate) Dashboard

func (a *Authenticate) Dashboard(w http.ResponseWriter, r *http.Request) error

Dashboard renders the /.pomerium/ user dashboard.

func (*Authenticate) FrontchannelLogout

func (a *Authenticate) FrontchannelLogout(w http.ResponseWriter, r *http.Request) error

FrontchannelLogout uses HTTP GETs to Relying Party URLs (Pomerium) to clear a user's login state. This endpoint implements OpenID Connect Front-Channel Logout and reuses the Relying Party-initiated logout functionality specified in Section 5 of OpenID Connect Session Management 1.0 (RP-Initiated Logout).

https://openid.net/specs/openid-connect-frontchannel-1_0.html https://ldapwiki.com/wiki/OpenID%20Connect%20Front-Channel%20Logout

func (*Authenticate) Handler

func (a *Authenticate) Handler() http.Handler

Handler returns the authenticate service's handler chain.

func (*Authenticate) Impersonate

func (a *Authenticate) Impersonate(w http.ResponseWriter, r *http.Request) error

Impersonate takes the result of a form and adds user impersonation details to the user's current user sessions state if the user is currently an administrative user. Requests are redirected back to the user dashboard.

func (*Authenticate) Mount

func (a *Authenticate) Mount(r *mux.Router)

Mount mounts the authenticate routes to the given router.

func (*Authenticate) OAuthCallback

func (a *Authenticate) OAuthCallback(w http.ResponseWriter, r *http.Request) error

OAuthCallback handles the callback from the identity provider.

https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse

func (*Authenticate) OnConfigChange

func (a *Authenticate) OnConfigChange(cfg *config.Config)

OnConfigChange updates internal structures based on config.Options

func (*Authenticate) RetrieveSession

func (a *Authenticate) RetrieveSession(next http.Handler) http.Handler

RetrieveSession is the middleware used retrieve session by the sessionLoaders

func (*Authenticate) RobotsTxt

func (a *Authenticate) RobotsTxt(w http.ResponseWriter, r *http.Request)

RobotsTxt handles the /robots.txt route.

func (*Authenticate) SignIn

func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request) error

SignIn handles authenticating a user.

func (*Authenticate) SignOut

func (a *Authenticate) SignOut(w http.ResponseWriter, r *http.Request) error

SignOut signs the user out and attempts to revoke the user's identity session Handles both GET and POST.

func (*Authenticate) VerifySession

func (a *Authenticate) VerifySession(next http.Handler) http.Handler

VerifySession is the middleware used to enforce a valid authentication session state is attached to the users's request context.