token

Documentation

Index

• Constants
• func GenerateKeyID(priv interface{}) (string, error)
• type Claims
  • func DefaultClaims() *Claims
  • func NewClaims(opts ...Options) (*Claims, error)
  • func (c *Claims) Set(key string, value interface{})
  • func (c *Claims) SetHeader(key string, value interface{})
  • func (c *Claims) Sign(alg jose.SignatureAlgorithm, key interface{}) (string, error)
• type Options
  • func WithAudience(s string) Options
  • func WithClaim(name string, value interface{}) Options
  • func WithIssuer(s string) Options
  • func WithJWTID(s string) Options
  • func WithKid(s string) Options
  • func WithRootCA(path string) Options
  • func WithSubject(s string) Options
  • func WithValidity(notBefore, expiration time.Time) Options
• type Token

Constants

const (
	// DefaultIssuer when generating tokens.
	DefaultIssuer = "step-cli"
	// DefaultAudience when generating tokens.
	DefaultAudience = "https://ca/sign"
	// MinValidity token validity token duration.
	MinValidity = 10 * time.Second
	// MaxValidity token validity token duration.
	MaxValidity = 1 * time.Hour
	// DefaultValidity token validity duration.
	DefaultValidity = 5 * time.Minute
	// MaxValidityDelay allowable delay between Now and beginning of token validity period.
	MaxValidityDelay = 30 * time.Minute
)

const RootSHAClaim = "sha"

RootSHAClaim is the property name for a JWT claim that stores the SHA256 of a root certificate.

Functions

func GenerateKeyID

func GenerateKeyID(priv interface{}) (string, error)

GenerateKeyID returns the SHA256 of a public key.

Types

type Claims

type Claims struct {
	jose.Claims
	ExtraClaims  map[string]interface{}
	ExtraHeaders map[string]interface{}
}

Claims represents the claims that a token might have.

func DefaultClaims

func DefaultClaims() *Claims

DefaultClaims returns the default claims of any token.

func NewClaims

func NewClaims(opts ...Options) (*Claims, error)

NewClaims returns the default claims with the given options added.

func (*Claims) Set

func (c *Claims) Set(key string, value interface{})

Set adds the given key and value to the map of extra claims.

func (*Claims) SetHeader

func (c *Claims) SetHeader(key string, value interface{})

SetHeader adds the given key and value to the map of extra headers.

func (*Claims) Sign

func (c *Claims) Sign(alg jose.SignatureAlgorithm, key interface{}) (string, error)

Sign creates a JWT with the claims and signs it with the given key.

type Options

type Options func(c *Claims) error

Options is a function that set claims.

func WithAudience

func WithAudience(s string) Options

WithAudience returns a Options that sets the audience to use in the token claims. If Audience is not used the default audience will be used.

func WithClaim

func WithClaim(name string, value interface{}) Options

WithClaim is an Options function that adds a custom claim to the JWT.

func WithIssuer

func WithIssuer(s string) Options

WithIssuer returns an Options function that sets the issuer to use in the token claims. If Issuer is not used the default issuer will be used.

func WithJWTID

func WithJWTID(s string) Options

WithJWTID returns a Options that sets the jwtID to use in the token claims. If WithJWTID is not used a random identifier will be used.

func WithKid

func WithKid(s string) Options

WithKid returns a Options that sets the header kid claims. If WithKid is not used a thumbprint using SHA256 will be used.

func WithRootCA

func WithRootCA(path string) Options

WithRootCA returns an Options function that calculates the SHA256 of the given root certificate to be used in the token claims. If this method it's not used the default root certificate in the $STEPPATH secrets directory will be used.

func WithSubject

func WithSubject(s string) Options

WithSubject returns an Options that sets the subject to use in the token claims.

func WithValidity

func WithValidity(notBefore, expiration time.Time) Options

WithValidity validates boundary inputs and sets the 'nbf' (NotBefore) and 'exp' (expiration) options.

type Token

type Token interface {
	SignedString(sigAlg string, priv interface{}) (string, error)
}

Token interface which all token types should attempt to implement.