authorization

Documentation

Overview

Package authorization is a generated GoMock package.

Package authorization is a generated GoMock package.

Index

• Constants
• func NewAuthorizationInterceptor(claimMapper ClaimMapper, authorizer Authorizer, metrics metrics.Client) grpc.UnaryServerInterceptor
• func NewRSAKeyProvider(cfg *config.Config) *rsaKeyProvider
• type AuthInfo
• type Authorizer
  • func NewDefaultAuthorizer() Authorizer
  • func NewNopAuthorizer() Authorizer
• type CallTarget
• type ClaimMapper
  • func NewDefaultJWTClaimMapper(provider TokenKeyProvider, cfg *config.Config) ClaimMapper
  • func NewNoopClaimMapper(_ *config.Config) ClaimMapper
• type Claims
• type Decision
• type MockAuthorizer
  • func NewMockAuthorizer(ctrl *gomock.Controller) *MockAuthorizer
  • func (m *MockAuthorizer) Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
  • func (m *MockAuthorizer) EXPECT() *MockAuthorizerMockRecorder
• type MockAuthorizerMockRecorder
  • func (mr *MockAuthorizerMockRecorder) Authorize(ctx, caller, target interface{}) *gomock.Call
• type MockClaimMapper
  • func NewMockClaimMapper(ctrl *gomock.Controller) *MockClaimMapper
  • func (m *MockClaimMapper) EXPECT() *MockClaimMapperMockRecorder
  • func (m *MockClaimMapper) GetClaims(authInfo *AuthInfo) (*Claims, error)
• type MockClaimMapperMockRecorder
  • func (mr *MockClaimMapperMockRecorder) GetClaims(authInfo interface{}) *gomock.Call
• type MockrequestWithName
  • func NewMockrequestWithName(ctrl *gomock.Controller) *MockrequestWithName
  • func (m *MockrequestWithName) EXPECT() *MockrequestWithNameMockRecorder
  • func (m *MockrequestWithName) GetName() string
• type MockrequestWithNameMockRecorder
  • func (mr *MockrequestWithNameMockRecorder) GetName() *gomock.Call
• type MockrequestWithNamespace
  • func NewMockrequestWithNamespace(ctrl *gomock.Controller) *MockrequestWithNamespace
  • func (m *MockrequestWithNamespace) EXPECT() *MockrequestWithNamespaceMockRecorder
  • func (m *MockrequestWithNamespace) GetNamespace() string
• type MockrequestWithNamespaceMockRecorder
  • func (mr *MockrequestWithNamespaceMockRecorder) GetNamespace() *gomock.Call
• type Result
• type Role
  • func (b Role) IsValid() bool
• type TokenKeyProvider

Constants

const (
	RoleWorker = Role(1 << iota)
	RoleReader
	RoleWriter
	RoleAdmin
	RoleUndefined = Role(0)
)

User authz within the context of an entity, such as system, namespace or workflow. User may have any combination of these authz within each context, except for RoleUndefined, as a bitmask.

const (
	ContextKeyMappedClaims = "auth-mappedClaims"
)

Functions

func NewAuthorizationInterceptor

func NewAuthorizationInterceptor(
	claimMapper ClaimMapper,
	authorizer Authorizer,
	metrics metrics.Client,
) grpc.UnaryServerInterceptor

GetAuthorizationInterceptor creates an authorization interceptor and return a func that points to its Interceptor method

func NewRSAKeyProvider

func NewRSAKeyProvider(cfg *config.Config) *rsaKeyProvider

Types

type AuthInfo

type AuthInfo struct {
	AuthToken     string
	TLSSubject    *pkix.Name
	TLSConnection *credentials.TLSInfo
}

Authentication information from subject's JWT token or/and mTLS certificate

type Authorizer

type Authorizer interface {
	Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
}

Authorizer is an interface for authorization

func NewDefaultAuthorizer

func NewDefaultAuthorizer() Authorizer

NewDefaultAuthorizer creates a default authorizer

func NewNopAuthorizer

func NewNopAuthorizer() Authorizer

NewNopAuthorizer creates a no-op authority

type CallTarget

type CallTarget struct {
	APIName   string
	Namespace string
}

Attributes is input for authority to make decision. It can be extended in future if required auth on resources like WorkflowType and TaskQueue

type ClaimMapper

type ClaimMapper interface {
	GetClaims(authInfo *AuthInfo) (*Claims, error)
}

Converts authorization info of a subject into Temporal claims (permissions) for authorization

func NewDefaultJWTClaimMapper

func NewDefaultJWTClaimMapper(provider TokenKeyProvider, cfg *config.Config) ClaimMapper

func NewNoopClaimMapper

func NewNoopClaimMapper(_ *config.Config) ClaimMapper

type Claims

type Claims struct {
	// Identity of the subject
	Subject string
	// Role within the context of the whole Temporal cluster or a multi-cluster setup
	System Role
	// Roles within specific namespaces
	Namespaces map[string]Role
}

Contains identity of the subject and subject's roles at the system level and for individual namespaces

type Decision

type Decision int

Decision is enum type for auth decision

const (
	// DecisionDeny means auth decision is deny
	DecisionDeny Decision = iota + 1
	// DecisionAllow means auth decision is allow
	DecisionAllow
)

type MockAuthorizer

type MockAuthorizer struct {
	// contains filtered or unexported fields
}

MockAuthorizer is a mock of Authorizer interface.

func NewMockAuthorizer

func NewMockAuthorizer(ctrl *gomock.Controller) *MockAuthorizer

NewMockAuthorizer creates a new mock instance.

func (*MockAuthorizer) Authorize

func (m *MockAuthorizer) Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)

Authorize mocks base method.

func (*MockAuthorizer) EXPECT

func (m *MockAuthorizer) EXPECT() *MockAuthorizerMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

type MockAuthorizerMockRecorder

type MockAuthorizerMockRecorder struct {
	// contains filtered or unexported fields
}

MockAuthorizerMockRecorder is the mock recorder for MockAuthorizer.

func (*MockAuthorizerMockRecorder) Authorize

func (mr *MockAuthorizerMockRecorder) Authorize(ctx, caller, target interface{}) *gomock.Call

Authorize indicates an expected call of Authorize.

type MockClaimMapper

type MockClaimMapper struct {
	// contains filtered or unexported fields
}

MockClaimMapper is a mock of ClaimMapper interface.

func NewMockClaimMapper

func NewMockClaimMapper(ctrl *gomock.Controller) *MockClaimMapper

NewMockClaimMapper creates a new mock instance.

func (*MockClaimMapper) EXPECT

func (m *MockClaimMapper) EXPECT() *MockClaimMapperMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockClaimMapper) GetClaims

func (m *MockClaimMapper) GetClaims(authInfo *AuthInfo) (*Claims, error)

GetClaims mocks base method.

type MockClaimMapperMockRecorder

type MockClaimMapperMockRecorder struct {
	// contains filtered or unexported fields
}

MockClaimMapperMockRecorder is the mock recorder for MockClaimMapper.

func (*MockClaimMapperMockRecorder) GetClaims

func (mr *MockClaimMapperMockRecorder) GetClaims(authInfo interface{}) *gomock.Call

GetClaims indicates an expected call of GetClaims.

type MockrequestWithName

type MockrequestWithName struct {
	// contains filtered or unexported fields
}

MockrequestWithName is a mock of requestWithName interface.

func NewMockrequestWithName

func NewMockrequestWithName(ctrl *gomock.Controller) *MockrequestWithName

NewMockrequestWithName creates a new mock instance.

func (*MockrequestWithName) EXPECT

func (m *MockrequestWithName) EXPECT() *MockrequestWithNameMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockrequestWithName) GetName

func (m *MockrequestWithName) GetName() string

GetName mocks base method.

type MockrequestWithNameMockRecorder

type MockrequestWithNameMockRecorder struct {
	// contains filtered or unexported fields
}

MockrequestWithNameMockRecorder is the mock recorder for MockrequestWithName.

func (*MockrequestWithNameMockRecorder) GetName

func (mr *MockrequestWithNameMockRecorder) GetName() *gomock.Call

GetName indicates an expected call of GetName.

type MockrequestWithNamespace

type MockrequestWithNamespace struct {
	// contains filtered or unexported fields
}

MockrequestWithNamespace is a mock of requestWithNamespace interface.

func NewMockrequestWithNamespace

func NewMockrequestWithNamespace(ctrl *gomock.Controller) *MockrequestWithNamespace

NewMockrequestWithNamespace creates a new mock instance.

func (*MockrequestWithNamespace) EXPECT

func (m *MockrequestWithNamespace) EXPECT() *MockrequestWithNamespaceMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockrequestWithNamespace) GetNamespace

func (m *MockrequestWithNamespace) GetNamespace() string

GetNamespace mocks base method.

type MockrequestWithNamespaceMockRecorder

type MockrequestWithNamespaceMockRecorder struct {
	// contains filtered or unexported fields
}

MockrequestWithNamespaceMockRecorder is the mock recorder for MockrequestWithNamespace.

func (*MockrequestWithNamespaceMockRecorder) GetNamespace

func (mr *MockrequestWithNamespaceMockRecorder) GetNamespace() *gomock.Call

GetNamespace indicates an expected call of GetNamespace.

type Result

type Result struct {
	Decision Decision
}

Result is result from authority.

type Role

type Role int16

func (Role) IsValid

func (b Role) IsValid() bool

Checks if the provided role bitmask represents a valid combination of authz

type TokenKeyProvider

type TokenKeyProvider interface {
	EcdsaKey(alg string, kid string) (*ecdsa.PublicKey, error)
	HmacKey(alg string, kid string) ([]byte, error)
	RsaKey(alg string, kid string) (*rsa.PublicKey, error)
	Close()
}

Provides keys for validating JWT tokens