Documentation
¶
Index ¶
- Variables
- func B64Decode(b64 []byte, reuse bool) ([]byte, error)
- func DecryptVerificationKeyDER(algo string, accessKey []byte) ([]byte, error)
- func GenAccessToken(timeout, maxTTL, user string, groups, orgs []string, secretKey []byte) (string, error)
- func GenAccessTokenWithAlgo(algo, timeout, maxTTL, user string, groups, orgs []string, keyDER []byte) (string, error)
- func GenRefreshToken(timeout, maxTTL, namespace, user string, secretKey []byte) (string, error)
- func GenerateEdDSAKey() []byte
- func GenerateKeyECDSA(c elliptic.Curve) []byte
- func GenerateKeyHMAC(bits int) []byte
- func GenerateKeyRSA(bits int) []byte
- func GenerateSigningKey(algo string) ([]byte, error)
- func GenerateSigningKeyHex(algo string) (string, error)
- func ParsePublicDER(algo string, der []byte) (any, error)
- func PrivateDER2Public(algo string, der []byte) (any, error)
- func PrivateDER2PublicDER(algo string, privateDER []byte) ([]byte, error)
- func SplitThreeParts(JWT []byte) (p1, p2 int, _ error)
- func ValidAccessToken(accessToken, algo string, verificationKeyDER []byte) error
- type AccessClaims
- type Base
- type BytesKey
- type ECDSA
- type ES256
- type ES384
- type ES512
- type EdDSA
- type HS256
- type HS384
- type HS512
- type RefreshClaims
- type Tokenizer
- type Verifier
Constants ¶
This section is empty.
Variables ¶
var ( ErrThreeParts = errors.New("JWT must be composed of three parts separated by periods") ErrJWTSignature = errors.New("JWT signature mismatch") ErrNoBase64JWT = errors.New("the token claims (second part of the JWT) is not base64-valid") ErrColumnInKey = errors.New("found a column symbol in the key string but tokens.NemHMAC() does not support AlgoKey scheme => use tokens.NewVerifier(algoKey)") ErrHMACKey = errors.New("cannot decode the HMAC key, please provide a key in hexadecimal or Base64 form (64, 96 or 128 hexadecimal digits ; 43, 64 or 86 Base64 characters)") ErrHS256PubKey = errors.New("cannot decode the HMAC-SHA256 key, please provide 64 hexadecimal digits or a Base64 string containing about 43 characters") ErrHS384PubKey = errors.New("cannot decode the HMAC-SHA384 key, please provide 96 hexadecimal digits or a Base64 string containing 64 characters") ErrHS512PubKey = errors.New("cannot decode the HMAC-SHA512 key, please provide 128 hexadecimal digits or a Base64 string containing about 86 characters") ErrEdDSAPubKey = errors.New("cannot decode the EdDSA public key, please provide 88 hexadecimal digits or a Base64 string containing about 59 characters") ErrES256PubKey = errors.New("cannot decode the ECDSA-P256-SHA256 public key, please provide 182 hexadecimal digits or a Base64 string containing about 122 characters") ErrES384PubKey = errors.New("cannot decode the ECDSA-P384-SHA384 public key, please provide 240 hexadecimal digits or a Base64 string containing 160 characters") ErrES512PubKey = errors.New("cannot decode the ECDSA-P512-SHA512 public key, please provide 316 hexadecimal digits or a Base64 string containing about 211 characters") ErrECDSAPubKey = errors.New("cannot parse the DER bytes as a valid ECDSA public key") )
Functions ¶
func B64Decode ¶
B64Decode avoid allocating memory when reuse=true by reusing the input buffer to return the base64-decoded result.
func DecryptVerificationKeyDER ¶
DecryptVerificationKeyDER returns the secret key for symmetric algos (like HMAC), or the public key for asymmetric algos (like RSA, EdDSA). The returned key is in DER format.
func GenAccessToken ¶
func GenAccessToken(timeout, maxTTL, user string, groups, orgs []string, secretKey []byte) (string, error)
GenAccessToken generates an access token with HS256 signing algo. Deprecated: Use `GenAccessTokenWithAlgo("HMAC", ...)`
func GenAccessTokenWithAlgo ¶
func GenAccessTokenWithAlgo(algo, timeout, maxTTL, user string, groups, orgs []string, keyDER []byte) (string, error)
GenAccessTokenWithAlgo creates an Access Token with the JSON fields "exp", "usr", "grp" and "org".
func GenRefreshToken ¶
GenRefreshToken generates a refresh token for a user in a namespace.
func GenerateEdDSAKey ¶
func GenerateEdDSAKey() []byte
GenerateEdDSAKey generates a random EdDSA-25519 key in DER format.
func GenerateKeyECDSA ¶
GenerateKeyECDSA generates a random ECDSA private key in DER format.
func GenerateKeyHMAC ¶
GenerateKeyHMAC generates a random HMAC-SHA256 key.
func GenerateKeyRSA ¶
GenerateKeyRSA generates a random RSA private key in DER format.
func GenerateSigningKey ¶
GenerateSigningKey produces the private key of the given algorithm. Supported algorithms:
- HS256 = HMAC using SHA-256 - HS384 = HMAC using SHA-384 - HS512 = HMAC using SHA-512 - RS256 = RSASSA-PKCS-v1.5 using SHA-256 - RS384 = RSASSA-PKCS-v1.5 using SHA-384 - RS512 = RSASSA-PKCS-v1.5 using SHA-512 - ES256 = ECDSA using P-256 and SHA-256 - ES384 = ECDSA using P-384 and SHA-384 - ES512 = ECDSA using P-521 and SHA-512 - EdDSA = Ed25519
func GenerateSigningKeyHex ¶
GenerateSigningKeyHex produces the private key in hexadecimal form.
func ParsePublicDER ¶
ParsePublicDER converts a public key in DER form into the original public key.
func PrivateDER2Public ¶
PrivateDER2Public converts a private key into a public key depending on the algo.
func PrivateDER2PublicDER ¶
PrivateDER2PublicDER converts a private key into a public key depending on the algo. The input and output are in DER form.
func SplitThreeParts ¶
SplitThreeParts returns the period position decompose the JWT in three parts
func ValidAccessToken ¶
Types ¶
type AccessClaims ¶
type AccessClaims struct {
Username string `json:"usr,omitempty"`
Groups []string `json:"grp,omitempty"`
Orgs []string `json:"org,omitempty"`
jwt.RegisteredClaims
}
AccessClaims is the standard claims for a user access token.
func AccessClaimsFromBase64 ¶
func AccessClaimsFromBase64(payload []byte, reuse bool) (*AccessClaims, error)
type HS256 ¶
type HS256 struct{ BytesKey }
func (*HS256) GenAccessToken ¶
type RefreshClaims ¶
type RefreshClaims struct {
Namespace string `json:"namespace,omitempty"`
Username string `json:"username,omitempty"`
jwt.RegisteredClaims
}
RefreshClaims is the standard claims for a user refresh token.
type Tokenizer ¶
type Verifier ¶
type Verifier interface {
Claims(accessToken []byte) (*AccessClaims, error)
Verify(headerPayload, signature []byte) bool
Reuse() bool
}
func NewVerifier ¶
NewVerifier creates a new Verifier to speed up the verification of many Access Tokens with the same verification key.
The parameter algoKey accepts three different schemes:
only a HMAC secret key: algoKey = "9d2e0a02121179a3c3de1b035ae1355b1548781c8ce8538a1dc0853a12dfb13d"
both the signing algo and its verification key: algoKey = "HS256:9d2e0a02121179a3c3de1b035ae1355b1548781c8ce8538a1dc0853a12dfb13d"
the Quid URL to fetch the algo/key info from a given namespace algoKey = "https://quid.teal.finance/v1?ns=foobar"
In the two first forms, NewVerifier accepts the key to be in hexadecimal, or in Base64 form. NewVerifier converts the verification key into binary DER form depending on the key string length and the optional algo name. The algo name is case insensitive.
Source Files