x509

Documentation

Overview

Package x509 provides authentication strategy, to authenticate HTTPS requests and builds, extracts user informations from client certificates.

Example

opts := x509.VerifyOptions{}
opts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
opts.Roots = x509.NewCertPool()
// Read Root Ca Certificate
opts.Roots.AddCert(readCertificates("ca")[0])

// create strategy and authenticator
strategy := New(opts)

// user request
req, _ := http.NewRequest("GET", "/", nil)
req.TLS = &tls.ConnectionState{PeerCertificates: readCertificates("client_valid")}

// validate request
info, err := strategy.Authenticate(req.Context(), req)
fmt.Println(info.GetUserName(), err)

// validate expired client certificate
req.TLS = &tls.ConnectionState{PeerCertificates: readCertificates("client_expired")}
info, err = strategy.Authenticate(req.Context(), req)
fmt.Println(info, err)

Output:

host.test.com <nil>
<nil> x509: certificate has expired or is not yet valid

Index

• Variables
• func New(vopt x509.VerifyOptions, opts ...auth.Option) auth.Strategy
• func SetInfoBuilder(builder InfoBuilder) auth.Option
• type InfoBuilder

Examples

• Package
• InfoBuilder

Variables

var (
	// ErrMissingCN is returned by DefaultBuilder when Certificate CommonName missing.
	ErrMissingCN = errors.New("strategies/x509: Certificate subject CN missing")
	// ErrInvalidRequest is returned by x509 strategy when a non TLS request received.
	ErrInvalidRequest = errors.New("strategy/x509: Invalid request, missing TLS parameters")
)

Functions

func New

func New(vopt x509.VerifyOptions, opts ...auth.Option) auth.Strategy

New returns auth.Strategy authenticate request from client certificates

func SetInfoBuilder

func SetInfoBuilder(builder InfoBuilder) auth.Option

SetInfoBuilder sets x509 info builder.

Types

type InfoBuilder

type InfoBuilder func(chain [][]*x509.Certificate) (auth.Info, error)

InfoBuilder declare a function signature for building Info from certificate chain.

Example

opts := x509.VerifyOptions{}
opts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
opts.Roots = x509.NewCertPool()
// Read Root Ca Certificate
opts.Roots.AddCert(readCertificates("ca")[0])

builder := SetInfoBuilder(func(chain [][]*x509.Certificate) (auth.Info, error) {
	return auth.NewDefaultUser("user-info-builder", "10", nil, nil), nil
})

// create strategy and authenticator
strategy := New(opts, builder)

// user request
req, _ := http.NewRequest("GET", "/", nil)
req.TLS = &tls.ConnectionState{PeerCertificates: readCertificates("client_valid")}

// validate request
info, err := strategy.Authenticate(req.Context(), req)
fmt.Println(info.GetUserName(), err)

Output:

user-info-builder <nil>