azure

Documentation

Index

• Constants
• Variables
• func New(ctx context.Context, opts Options) (auth.Interface, error)
• func NewSWPoPKey() (*swPoPKey, error)
• func NewSwkKey() (*swKey, error)
• type Authenticator
  • func (s Authenticator) Check(ctx context.Context, token string) (*authv1.UserInfo, error)
  • func (s Authenticator) UID() string
• type Claims
• type Options
  • func NewOptions() Options
  • func (o *Options) AddFlags(fs *pflag.FlagSet)
  • func (o Options) Apply(d *apps.Deployment) (extraObjs []runtime.Object, err error)
  • func (o *Options) Validate() []error
• type PoPToken
• type PoPTokenBuilderImpl
  • func NewPoPTokenBuilder() *PoPTokenBuilderImpl
  • func (b *PoPTokenBuilderImpl) GetToken() (string, error)
  • func (b *PoPTokenBuilderImpl) SetHeader() error
  • func (b *PoPTokenBuilderImpl) SetHostName(hostName string) *PoPTokenBuilderImpl
  • func (b *PoPTokenBuilderImpl) SetKid(kid string) *PoPTokenBuilderImpl
  • func (b *PoPTokenBuilderImpl) SetPayload() error
  • func (b *PoPTokenBuilderImpl) SetSignature() error
  • func (b *PoPTokenBuilderImpl) SetTimestamp(ts int64) *PoPTokenBuilderImpl
• type PoPTokenVerifier
  • func NewPoPVerifier(hostName string, popTokenValidityDuration time.Duration) *PoPTokenVerifier
  • func (p *PoPTokenVerifier) ValidatePopToken(token string) (string, error)

Constants

const (
	AKSAuthMode              = "aks"
	ARCAuthMode              = "arc"
	OBOAuthMode              = "obo"
	ClientCredentialAuthMode = "client-credential"
	PassthroughAuthMode      = "passthrough"
)

const (
	BadTokenKey         = "badToken"
	HeaderBadKeyID      = "headerBadKeyID"
	HeaderBadAlgo       = "headerBadAlgo"
	HeaderBadtyp        = "headerBadtyp"
	HeaderBadtypType    = "headerBadtypType"
	HeaderBadtypMissing = "headerBadtypMissing"
	UClaimsMissing      = "uClaimsMissing"
	TsClaimsMissing     = "tsClaimsMissing"
	AtClaimsMissing     = "atClaimsMissing"
	AtClaimIncorrect    = "atClaimIncorrect"
	CnfClaimsMissing    = "cnfClaimsMissing"
	CnfJwkClaimsEmpty   = "cnfJwkClaimsEmpty"
	CnfJwkClaimsWrong   = "cnfJwkClaimsWrong"
	CnfJwkClaimsMissing = "cnfJwkClaimsMissing"
	AccessTokenCnfWrong = "accessTokenCnfWrong"
	AtClaimsWrongType   = "atClaimsWrongType"
	AtCnfClaimMissing   = "atCnfClaimMissing"
	AtCnfClaimWrong     = "atCnfClaimWrong"
	TsClaimsTypeString  = "tsClaimsTypeString"
	TsClaimsTypeUnknown = "tsClaimsTypeUnknown"
	UClaimsWrongType    = "uClaimsWrongType"
	SignatureWrongType  = "signatureWrongType"
)

const (
	OrgType = "azure"
)

Variables

var ErrClaimNotFound = fmt.Errorf("claim not found")

ErrorClaimNotFound indicates the given key was not found in the claims

Functions

func New

func New(ctx context.Context, opts Options) (auth.Interface, error)

New is called per authentication request

func NewSWPoPKey

func NewSWPoPKey() (*swPoPKey, error)

func NewSwkKey

func NewSwkKey() (*swKey, error)

Types

type Authenticator

type Authenticator struct {
	Options
	// contains filtered or unexported fields
}

func (Authenticator) Check

func (s Authenticator) Check(ctx context.Context, token string) (*authv1.UserInfo, error)

func (Authenticator) UID

func (s Authenticator) UID() string

type Claims

type Claims map[string]interface{}

Claims maintains token claims

type Options

type Options struct {
	Environment                              string
	ClientID                                 string
	ClientSecret                             string
	TenantID                                 string
	UseGroupUID                              bool
	AuthMode                                 string
	AKSTokenURL                              string
	EnablePOP                                bool
	POPTokenHostname                         string
	PoPTokenValidityDuration                 time.Duration
	ResolveGroupMembershipOnlyOnOverageClaim bool
	SkipGroupMembershipResolution            bool
	VerifyClientID                           bool
	ResourceId                               string
	AzureRegion                              string
	HttpClientRetryCount                     int
}

func NewOptions

func NewOptions() Options

func (*Options) AddFlags

func (o *Options) AddFlags(fs *pflag.FlagSet)

func (Options) Apply

func (o Options) Apply(d *apps.Deployment) (extraObjs []runtime.Object, err error)

func (*Options) Validate

func (o *Options) Validate() []error

type PoPToken

type PoPToken struct {
	Header    string
	Payload   string
	Signature string
}

A struct that represents a PoP token

type PoPTokenBuilderImpl

type PoPTokenBuilderImpl struct {
	// contains filtered or unexported fields
}

A concrete builder struct that implements the steps to build a PoP token

func NewPoPTokenBuilder

func NewPoPTokenBuilder() *PoPTokenBuilderImpl

A constructor function that returns a new PoPTokenBuilderImpl

func (*PoPTokenBuilderImpl) GetToken

func (b *PoPTokenBuilderImpl) GetToken() (string, error)

A method that returns the final PoP token as a string

func (*PoPTokenBuilderImpl) SetHeader

func (b *PoPTokenBuilderImpl) SetHeader() error

A method that sets the header of the PoP token

func (*PoPTokenBuilderImpl) SetHostName

func (b *PoPTokenBuilderImpl) SetHostName(hostName string) *PoPTokenBuilderImpl

func (*PoPTokenBuilderImpl) SetKid

func (b *PoPTokenBuilderImpl) SetKid(kid string) *PoPTokenBuilderImpl

func (*PoPTokenBuilderImpl) SetPayload

func (b *PoPTokenBuilderImpl) SetPayload() error

A method that sets the payload of the PoP token

func (*PoPTokenBuilderImpl) SetSignature

func (b *PoPTokenBuilderImpl) SetSignature() error

A method that sets the signature of the PoP token

func (*PoPTokenBuilderImpl) SetTimestamp

func (b *PoPTokenBuilderImpl) SetTimestamp(ts int64) *PoPTokenBuilderImpl

type PoPTokenVerifier

type PoPTokenVerifier struct {
	PoPTokenValidityDuration time.Duration
	// contains filtered or unexported fields
}

PopTokenVerifier is validator for PoP tokens.

func NewPoPVerifier

func NewPoPVerifier(hostName string, popTokenValidityDuration time.Duration) *PoPTokenVerifier

func (*PoPTokenVerifier) ValidatePopToken

func (p *PoPTokenVerifier) ValidatePopToken(token string) (string, error)

ValidatePopToken is validating the pop token RFC : https://datatracker.ietf.org/doc/html/rfc7800