authenticate

Documentation

Index

• Variables
• func ValidateOptions(o config.Options) error
• type Authenticate
  • func New(opts config.Options) (*Authenticate, error)
  • func (a *Authenticate) ExchangeToken(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) Handler() http.Handler
  • func (a *Authenticate) OAuthCallback(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) RobotsTxt(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) SignOut(w http.ResponseWriter, r *http.Request)
  • func (a *Authenticate) VerifySession(next http.Handler) http.Handler

Variables

var CSPHeaders = map[string]string{
	"Content-Security-Policy": "default-src 'none'; style-src 'self'" +
		" 'sha256-z9MsgkMbQjRSLxzAfN55jB3a9pP0PQ4OHFH8b4iDP6s=' " +
		" 'sha256-qnVkQSG7pWu17hBhIw0kCpfEB3XGvt0mNRa6+uM6OUU=' " +
		" 'sha256-qOdRsNZhtR+htazbcy7guQl3Cn1cqOw1FcE4d3llae0='; " +
		"img-src 'self';",
	"Referrer-Policy": "Same-origin",
}

CSPHeaders are the content security headers added to the service's handlers https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

Functions

func ValidateOptions

func ValidateOptions(o config.Options) error

ValidateOptions checks that configuration are complete and valid. Returns on first error found.

Types

type Authenticate

type Authenticate struct {
	SharedKey   string
	RedirectURL *url.URL
	// contains filtered or unexported fields
}

Authenticate contains data required to run the authenticate service.

func New

func New(opts config.Options) (*Authenticate, error)

New validates and creates a new authenticate service from a set of Options.

func (*Authenticate) ExchangeToken

func (a *Authenticate) ExchangeToken(w http.ResponseWriter, r *http.Request)

ExchangeToken takes an identity provider issued JWT as input ('id_token) and exchanges that token for a pomerium session. The provided token's audience ('aud') attribute must match Pomerium's client_id.

func (*Authenticate) Handler

func (a *Authenticate) Handler() http.Handler

Handler returns the authenticate service's HTTP multiplexer, and routes.

func (*Authenticate) OAuthCallback

func (a *Authenticate) OAuthCallback(w http.ResponseWriter, r *http.Request)

OAuthCallback handles the callback from the identity provider.

https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse

func (*Authenticate) RobotsTxt

func (a *Authenticate) RobotsTxt(w http.ResponseWriter, r *http.Request)

RobotsTxt handles the /robots.txt route.

func (*Authenticate) SignIn

func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request)

SignIn handles to authenticating a user.

func (*Authenticate) SignOut

func (a *Authenticate) SignOut(w http.ResponseWriter, r *http.Request)

SignOut signs the user out and attempts to revoke the user's identity session Handles both GET and POST.

func (*Authenticate) VerifySession

func (a *Authenticate) VerifySession(next http.Handler) http.Handler

VerifySession is the middleware used to enforce a valid authentication session state is attached to the users's request context.