Documentation
¶
Index ¶
- func HTTPMiddleware(aud *Audience, next gateway.HandlerFunc) gateway.HandlerFunc
- func StreamServerInterceptor(aud *Audience) grpc.StreamServerInterceptor
- func UnaryServerInterceptor(aud *Audience) grpc.UnaryServerInterceptor
- func WithOpen(ctx context.Context) context.Context
- type Audience
- type Claims
- type Issuer
- type Permission
- type TokenOptions
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HTTPMiddleware ¶
func HTTPMiddleware(aud *Audience, next gateway.HandlerFunc) gateway.HandlerFunc
HTTPMiddleware is a HTTP middleware variant of UnaryServerInterceptor. It should be used for non-gRPC HTTP endpoints.
func StreamServerInterceptor ¶
func StreamServerInterceptor(aud *Audience) grpc.StreamServerInterceptor
StreamServerInterceptor is the streaming variant of UnaryServerInterceptor.
func UnaryServerInterceptor ¶
func UnaryServerInterceptor(aud *Audience) grpc.UnaryServerInterceptor
UnaryServerInterceptor is a middleware for setting claims on runtime server requests. The assigned claims can be retrieved using GetClaims. If the interceptor succeeds, a Claims value is guaranteed to be set on the ctx. The claim parsing logic is as follows - When aud is nil, auth is considered disabled. We set a Claims that allows all actions (openClaims). - When aud is not nil, we set a Claims based on a JWT set as a bearer token in the authorization header (jwtClaims). - When aud is not nil and no authoriation header is passed, we set a Claims that denies any action (anonClaims).
Types ¶
type Audience ¶
type Audience struct {
// contains filtered or unexported fields
}
Audience represents a receiver of tokens from Issuer. The Audience is used by the runtime to parse claims from a JWT. It parses and validates tokens and resolves permissions. It refreshes its JWKS in the background from {issuerURL}/.well-known/jwks.json.
func OpenAudience ¶
OpenAudience creates an Audience. Remember to call Close() when done. The issuerURL should be the external URL of the issuing admin server. The issuerURL is expected to serve a JWKS on /.well-known/jwks.json. The audienceURL should be the external URL of the receiving runtime server.
type Claims ¶
type Claims interface { // Subject returns the token subject if present (usually a user or service ID) Subject() string // Can resolves system-level permissions. Can(p Permission) bool // CanInstance resolves instance-level permissions. CanInstance(instanceID string, p Permission) bool }
Claims resolves permissions for a requester.
type Issuer ¶
type Issuer struct {
// contains filtered or unexported fields
}
Issuer creates JWTs with claims for an Audience. The Issuer is used by the admin server to create JWTs for the runtimes it manages based on a user's control-plane permissions.
func NewEphemeralIssuer ¶
NewEphemeralIssuer creates an Issuer using a generated JWKS. It is useful for development and testing, but should not be used in production.
func NewIssuer ¶
NewIssuer creates an issuer from a JWKS. The JWKS must contain private keys. The key identified by signingKeyID will be used to sign new JWTs.
func (*Issuer) NewToken ¶
func (i *Issuer) NewToken(opts TokenOptions) (string, error)
NewToken issues a new JWT based on the provided options.
func (*Issuer) WellKnownHandleFunc ¶
func (i *Issuer) WellKnownHandleFunc(w http.ResponseWriter, r *http.Request)
WellKnownHandleFunc serves the public keys of the Issuer's JWKS. The Audience expects it to be mounted on {issuerURL}/.well-known/jwks.json.
type Permission ¶
type Permission int
Permission represents runtime access permissions.
const ( // System-level permissions ManageInstances Permission = 0x01 // Instance-level permissions ReadInstance Permission = 0x11 EditInstance Permission = 0x12 ReadRepo Permission = 0x13 EditRepo Permission = 0x14 ReadObjects Permission = 0x15 ReadOLAP Permission = 0x16 ReadMetrics Permission = 0x17 ReadProfiling Permission = 0x18 )
type TokenOptions ¶
type TokenOptions struct { AudienceURL string Subject string TTL time.Duration SystemPermissions []Permission InstancePermissions map[string][]Permission }
TokenOptions provides options for Issuer.NewToken.