authorizerd

package module
v0.0.0-...-52d9772 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2019 License: Apache-2.0 Imports: 13 Imported by: 0

README

Athenz authorizer

release CircleCI codecov Go Report Card GolangCI Codacy Badge GoDoc

What is Athenz authorizer

Athenz authorizer is a library to cache the policies of Athenz to authorizer authenication and authorization check of user request.

Overview

Usage

To initialize authorizer.


// Initialize authorizerd
daemon, err := authorizerd.New(
    authorizerd.WithAthenzURL("www.athenz.io"), // set athenz URL
    authorizerd.WithAthenzDomains("domain1", "domain2" ... "domain N"), // set athenz domains
    authorizerd.WithPubkeyRefreshDuration(time.Hour * 24), // set athenz public key refresh duration
    authorizerd.WithPolicyRefreshDuration(time.Hour), // set policy refresh duration
)
if err != nil {
   // cannot initialize authorizer daemon
}

// Start authorizer daemon
ctx := context.Background() // user can control authorizer daemon lifetime using this context
errs := daemon.Start(ctx)
go func() {
    err := <-errs
    // user should handle errors return from the daemon
}()

// Verify role token
if err := daemon.VerifyRoleToken(ctx, roleTok, act, res); err != nil {
    // token not authorizated
}

How it works

To do the authentication and authorization check, the user needs to specify which domain data to be cache. The authorizer will periodically refresh the policies and Athenz public key data to verify and decode the domain data. The verified domain data will cache into the memory, and use for authentication and authorization check.

The authorizer contains two sub-module, Athenz pubkey daemon (pubkeyd) and Athenz policy daemon (policyd).

Athenz pubkey daemon

Athenz pubkey daemon (pubkeyd) is responsible for periodically update the Athenz public key data from Athenz server to verify the policy data received from Athenz policy daemon and verify the role token.

Athenz policy daemon

Athenz policy daemon (policyd) is responsible for periodically update the policy data of specified Athenz domain from Athenz server. The received policy data will be verified using the public key got from pubkeyd, and cache into memory. Whenever user requesting for the access check, the verification check will be used instead of asking Athenz server everytime.

Configuratrion

The authorizer uses functional options pattern to initialize the instance. All the options are defined here.

Option name Description Default Value Required Example
AthenzURL The Athenz server URL "www.athenz.com/zts/v1" No
AthenzDomains Athenz domain name of Policy cache Yes "domName1", "domName2"
Transport The HTTP transport for getting policy data and Athenz public key data nil No
CacheExp The TTL of the success cache 1 Minute No
PubkeyRefreshDuration The refresh duration to update the Athenz public key data 24 Hours No
PubkeySysAuthDomain System authority domain name to retrieve Athenz public key data sys.auth No
PubkeyEtagExpTime ETag cache TTL of Athenz public key data 168 Hours (1 Week) No
PubkeyEtagFlushDur ETag cache purge duration 84 Hours No
PolicyRefreshDuration The refresh duration to update Athenz policy data 30 Minutes No
PolicyExpireMargin The expire margin to update the policy data. It forces update the policy data before the policy expiration margin. 3 Hours No
PolicyEtagExpTime ETag cache TTL of policy data 24 Hours No
PolicyEtagFlushDur Policy data cache purge duration 12 Hours No

License

Copyright (C)  2018 Yahoo Japan Corporation Athenz team.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Contributor License Agreement

This project requires contributors to agree to a Contributor License Agreement (CLA).

Note that only for contributions to the garm repository on the GitHub, the contributors of them shall be deemed to have agreed to the CLA without individual written agreements.

Authors

Documentation

Overview

Copyright (C) 2018 Yahoo Japan Corporation Athenz team.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Package authorizerd represents the policy updater daemon.

Copyright (C) 2018 Yahoo Japan Corporation Athenz team.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Copyright (C) 2018 Yahoo Japan Corporation Athenz team.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Copyright (C) 2018 Yahoo Japan Corporation Athenz team.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrRoleTokenInvalid "Access denied due to invalid RoleToken"
	ErrRoleTokenInvalid = role.ErrRoleTokenInvalid
	// ErrRoleTokenExpired "Access denied due to expired RoleToken"
	ErrRoleTokenExpired = role.ErrRoleTokenExpired

	// ErrDomainMismatch "Access denied due to domain mismatch between Resource and RoleToken"
	ErrDomainMismatch = policy.ErrDomainMismatch
	// ErrDomainNotFound "Access denied due to domain not found in library cache"
	ErrDomainNotFound = policy.ErrDomainNotFound
	// ErrDomainExpired "Access denied due to expired domain policy file"
	ErrDomainExpired = policy.ErrDomainExpired
	// ErrNoMatch "Access denied due to no match to any of the assertions defined in domain policy file"
	ErrNoMatch = policy.ErrNoMatch
	// ErrInvalidPolicyResource "Access denied due to invalid/empty policy resources"
	ErrInvalidPolicyResource = policy.ErrInvalidPolicyResource
	// ErrDenyByPolicy "Access Check was explicitly denied"
	ErrDenyByPolicy = policy.ErrDenyByPolicy
	// ErrFetchPolicy "Error fetching athenz policy"
	ErrFetchPolicy = policy.ErrFetchPolicy

	// ErrInvalidParameters "Access denied due to invalid/empty action/resource values"
	ErrInvalidParameters = errors.New("Access denied due to invalid/empty action/resource values")
)

Functions

This section is empty.

Types

type Authorizerd 

type Authorizerd interface {
	Start(ctx context.Context) <-chan error
	VerifyRoleToken(ctx context.Context, tok, act, res string) error
	VerifyRoleJWT(ctx context.Context, tok, act, res string) error
	VerifyRoleCert(ctx context.Context, peerCerts []*x509.Certificate, act, res string) error
	GetPolicyCache(ctx context.Context) map[string]interface{}
}

Authorizerd represents a daemon for user to verify the role token

func New 

func New(opts ...Option) (Authorizerd, error)

New return Authorizerd This function will initialize the Authorizerd object with the options

type Option 

type Option func(*authorizer) error

Option represents a functional options pattern interface

func WithAthenzDomains 

func WithAthenzDomains(domains ...string) Option

WithAthenzDomains represents a AthenzDomains functional option

func WithAthenzURL 

func WithAthenzURL(url string) Option

WithAthenzURL represents a AthenzURL functional option

func WithCacheExp 

func WithCacheExp(exp time.Duration) Option

WithCacheExp represents the cache expiration time

func WithDisableJwkd 

func WithDisableJwkd() Option

WithDisableJwkd represents a DisableJwkd functional optiond

func WithDisablePolicyd 

func WithDisablePolicyd() Option

WithDisablePolicyd represents a DisablePolicyd functional optiond

func WithDisablePubkeyd 

func WithDisablePubkeyd() Option

WithDisablePubkeyd represents a DisablePubkey functional optiond

func WithEnableJwkd 

func WithEnableJwkd() Option

WithEnableJwkd represents a EnableJwkd functional optiond

func WithEnablePolicyd 

func WithEnablePolicyd() Option

WithEnablePolicyd represents a EnablePolicyd functional optiond

func WithEnablePubkeyd 

func WithEnablePubkeyd() Option

WithEnablePubkeyd represents a EnablePubkey functional optiond

func WithJwkErrRetryInterval 

func WithJwkErrRetryInterval(i string) Option

WithJwkErrRetryInterval represents a JwkErrRetryInterval functional option

func WithJwkRefreshDuration 

func WithJwkRefreshDuration(t string) Option

WithJwkRefreshDuration represents a JwkRefreshDuration functional option

func WithPolicyErrRetryInterval 

func WithPolicyErrRetryInterval(i string) Option

WithPolicyErrRetryInterval represents a PolicyErrRetryInterval functional option

func WithPolicyEtagExpTime 

func WithPolicyEtagExpTime(t string) Option

WithPolicyEtagExpTime represents a PolicyEtagExpTime functional option

func WithPolicyEtagFlushDuration 

func WithPolicyEtagFlushDuration(t string) Option

WithPolicyEtagFlushDuration represents a PolicyEtagFlushDur functional option

func WithPolicyExpireMargin 

func WithPolicyExpireMargin(t string) Option

WithPolicyExpireMargin represents a PolicyExpireMargin functional option

func WithPolicyRefreshDuration 

func WithPolicyRefreshDuration(t string) Option

WithPolicyRefreshDuration represents a PolicyRefreshDuration functional option

func WithPubkeyErrRetryInterval 

func WithPubkeyErrRetryInterval(i string) Option

WithPubkeyErrRetryInterval represents a PubkeyErrRetryInterval functional option

func WithPubkeyEtagExpTime 

func WithPubkeyEtagExpTime(t string) Option

WithPubkeyEtagExpTime represents a PubkeyEtagExpTime functional option

func WithPubkeyEtagFlushDuration 

func WithPubkeyEtagFlushDuration(t string) Option

WithPubkeyEtagFlushDuration represents a PubkeyEtagFlushDur functional option

func WithPubkeyRefreshDuration 

func WithPubkeyRefreshDuration(t string) Option

WithPubkeyRefreshDuration represents a PubkeyRefreshDuration functional option

func WithPubkeySysAuthDomain 

func WithPubkeySysAuthDomain(domain string) Option

WithPubkeySysAuthDomain represents a PubkeySysAuthDomain functional option

func WithRoleCertURIPrefix 

func WithRoleCertURIPrefix(t string) Option

WithRoleCertURIPrefix represents a RoleCertURIPrefix functional option

func WithTransport 

func WithTransport(t *http.Transport) Option

WithTransport represents a Transport functional option

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.