role

Documentation

Overview

Package role represents the processing logic of role token.

Index

• Constants
• Variables
• type BaseClaim
  • func (c *BaseClaim) Valid() error
• type Option
  • func WithClientCertificateGoBackSeconds(t string) Option
  • func WithClientCertificateOffsetSeconds(t string) Option
  • func WithEnableMTLSCertificateBoundAccessToken(b bool) Option
  • func WithJWKProvider(jwkp jwk.Provider) Option
  • func WithPubkeyProvider(pkp pubkey.Provider) Option
• type Processor
  • func New(opts ...Option) (Processor, error)
• type RoleJWTClaim
• type Token
  • func (r *Token) Expired() bool
  • func (r *Token) SetParams(key, value string) error
• type ZTSAccessTokenClaim

Constants

const (
	CONFIRM_METHOD_MEMBER = "x5t#S256"
)

Variables

var (
	// ErrRoleTokenInvalid "Access denied due to invalid RoleToken"
	ErrRoleTokenInvalid = errors.New("Access denied due to invalid RoleToken")

	// ErrRoleTokenExpired "Access denied due to expired RoleToken"
	ErrRoleTokenExpired = errors.New("Access denied due to expired RoleToken")
)

Types

type BaseClaim

type BaseClaim struct {
	jwt.StandardClaims
}

func (*BaseClaim) Valid

func (c *BaseClaim) Valid() error

Valid is copy from source code, and changed c.VerifyExpiresAt parameter.

type Option

type Option func(*rtp) error

Option represents a functional options pattern interface

func WithClientCertificateGoBackSeconds

func WithClientCertificateGoBackSeconds(t string) Option

WithClientCertificateGoBackSeconds represents set clientCertificateGoBackSeconds functional option

func WithClientCertificateOffsetSeconds

func WithClientCertificateOffsetSeconds(t string) Option

WithClientCertificateOffsetSeconds represents set clientCertificateOffsetSeconds functional option

func WithEnableMTLSCertificateBoundAccessToken

func WithEnableMTLSCertificateBoundAccessToken(b bool) Option

WithEnableMTLSCertificateBoundAccessToken represents set enableMTLSCertificateBoundAccessToken functional option

func WithJWKProvider

func WithJWKProvider(jwkp jwk.Provider) Option

WithJWKProvider represents set pubkey provider functional option

func WithPubkeyProvider

func WithPubkeyProvider(pkp pubkey.Provider) Option

WithPubkeyProvider represents set pubkey provider functional option

type Processor

type Processor interface {
	ParseAndValidateRoleToken(tok string) (*Token, error)
	ParseAndValidateRoleJWT(cred string) (*RoleJWTClaim, error)
	ParseAndValidateZTSAccessToken(cred string, cert *x509.Certificate) (*ZTSAccessTokenClaim, error)
}

Processor represents the role token parser interface.

func New

func New(opts ...Option) (Processor, error)

New returns the Role instance.

type RoleJWTClaim

type RoleJWTClaim struct {
	Domain   string `json:"d"`
	Email    string `json:"email"`
	KeyID    string `json:"k"`
	MFA      string `json:"mfa"`
	Role     string `json:"r"`
	Salt     string `json:"a"`
	UserID   string `json:"u"`
	UserName string `json:"n"`
	Version  string `json:"v"`
	BaseClaim
}

RoleJWTClaim represents role jwt claim data.

type Token

type Token struct {
	// Version    string   // required
	Domain string   // required
	Roles  []string // required
	// Principal  string   // required
	// Host       string
	// Salt       string    // required
	// TimeStamp  time.Time // required
	ExpiryTime time.Time // required
	KeyID      string    // required
	// IP         string
	// ProxyUser  string
	Signature string // required

	UnsignedToken string
}

Token represents role token data.

func (*Token) Expired

func (r *Token) Expired() bool

Expired returns if the role token is expired or not.

func (*Token) SetParams

func (r *Token) SetParams(key, value string) error

SetParams sets the value for corresponding key data.

type ZTSAccessTokenClaim

type ZTSAccessTokenClaim struct {
	AuthTime       int64             `json:"auth_time"`
	Version        int               `json:"ver"`
	ClientID       string            `json:"client_id"`
	UserID         string            `json:"uid"`
	ProxyPrincipal string            `json:"proxy,omitempty"`
	Scope          []string          `json:"scp"`
	Confirm        map[string]string `json:"cnf"`
	BaseClaim
}

ZTSAccessTokenClaim represents access token claim data. based on https://github.com/yahoo/athenz/blob/0e7335dbfa9d41eef0b049c07e7f846bff0f3169/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/AccessToken.java#L382