authorization

Documentation

Overview

Package authorization is a generated GoMock package.

Package authorization is a generated GoMock package.

Index

• Constants
• func NewAuthorizationInterceptor(claimMapper ClaimMapper, authorizer Authorizer, metrics metrics.Client, ...) grpc.UnaryServerInterceptor
• func NewDefaultTokenKeyProvider(cfg *config.Authorization, logger log.Logger) *defaultTokenKeyProvider
• type AuthInfo
• type Authorizer
  • func GetAuthorizerFromConfig(config *config.Authorization) (Authorizer, error)
  • func NewDefaultAuthorizer() Authorizer
  • func NewNoopAuthorizer() Authorizer
• type CallTarget
• type ClaimMapper
  • func GetClaimMapperFromConfig(config *config.Authorization, logger log.Logger) (ClaimMapper, error)
  • func NewDefaultJWTClaimMapper(provider TokenKeyProvider, cfg *config.Authorization, logger log.Logger) ClaimMapper
  • func NewNoopClaimMapper() ClaimMapper
• type Claims
• type Decision
• type MockAuthorizer
  • func NewMockAuthorizer(ctrl *gomock.Controller) *MockAuthorizer
  • func (m *MockAuthorizer) Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
  • func (m *MockAuthorizer) EXPECT() *MockAuthorizerMockRecorder
• type MockAuthorizerMockRecorder
  • func (mr *MockAuthorizerMockRecorder) Authorize(ctx, caller, target interface{}) *gomock.Call
• type MockClaimMapper
  • func NewMockClaimMapper(ctrl *gomock.Controller) *MockClaimMapper
  • func (m *MockClaimMapper) EXPECT() *MockClaimMapperMockRecorder
  • func (m *MockClaimMapper) GetClaims(authInfo *AuthInfo) (*Claims, error)
• type MockClaimMapperMockRecorder
  • func (mr *MockClaimMapperMockRecorder) GetClaims(authInfo interface{}) *gomock.Call
• type MockrequestWithNamespace
  • func NewMockrequestWithNamespace(ctrl *gomock.Controller) *MockrequestWithNamespace
  • func (m *MockrequestWithNamespace) EXPECT() *MockrequestWithNamespaceMockRecorder
  • func (m *MockrequestWithNamespace) GetNamespace() string
• type MockrequestWithNamespaceMockRecorder
  • func (mr *MockrequestWithNamespaceMockRecorder) GetNamespace() *gomock.Call
• type Result
• type Role
  • func (b Role) IsValid() bool
• type TokenKeyProvider

Constants

const (
	ContextKeyMappedClaims = "auth-mappedClaims"
	ContextAuthHeader      = "auth-header"
)

const (
	RoleWorker = Role(1 << iota)
	RoleReader
	RoleWriter
	RoleAdmin
	RoleUndefined = Role(0)
)

@@@SNIPSTART temporal-common-authorization-role-enum User authz within the context of an entity, such as system, namespace or workflow. User may have any combination of these authz within each context, except for RoleUndefined, as a bitmask.

Functions

func NewAuthorizationInterceptor

func NewAuthorizationInterceptor(
	claimMapper ClaimMapper,
	authorizer Authorizer,
	metrics metrics.Client,
	logger log.Logger,
) grpc.UnaryServerInterceptor

GetAuthorizationInterceptor creates an authorization interceptor and return a func that points to its Interceptor method

func NewDefaultTokenKeyProvider

func NewDefaultTokenKeyProvider(cfg *config.Authorization, logger log.Logger) *defaultTokenKeyProvider

Types

type AuthInfo

type AuthInfo struct {
	AuthToken     string
	TLSSubject    *pkix.Name
	TLSConnection *credentials.TLSInfo
	ExtraData     string
}

@@@SNIPSTART temporal-common-authorization-authinfo Authentication information from subject's JWT token or/and mTLS certificate

type Authorizer

type Authorizer interface {
	Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
}

@@@SNIPSTART temporal-common-authorization-authorizer-interface Authorizer is an interface for implementing authorization logic

func GetAuthorizerFromConfig

func GetAuthorizerFromConfig(config *config.Authorization) (Authorizer, error)

func NewDefaultAuthorizer

func NewDefaultAuthorizer() Authorizer

NewDefaultAuthorizer creates a default authorizer

func NewNoopAuthorizer

func NewNoopAuthorizer() Authorizer

NewNoopAuthorizer creates a no-op authorizer

type CallTarget

type CallTarget struct {
	// APIName must be the full API function name.
	// Example: "/temporal.api.workflowservice.v1.WorkflowService/StartWorkflowExecution".
	APIName string
	// If a Namespace is not being targeted this be set to an empty string.
	Namespace string
}

@@@SNIPSTART temporal-common-authorization-authorizer-calltarget CallTarget is contains information for Authorizer to make a decision. It can be extended to include resources like WorkflowType and TaskQueue

type ClaimMapper

type ClaimMapper interface {
	GetClaims(authInfo *AuthInfo) (*Claims, error)
}

@@@SNIPSTART temporal-common-authorization-claimmapper-interface ClaimMapper converts authorization info of a subject into Temporal claims (permissions) for authorization

func GetClaimMapperFromConfig

func GetClaimMapperFromConfig(config *config.Authorization, logger log.Logger) (ClaimMapper, error)

func NewDefaultJWTClaimMapper

func NewDefaultJWTClaimMapper(provider TokenKeyProvider, cfg *config.Authorization, logger log.Logger) ClaimMapper

func NewNoopClaimMapper

func NewNoopClaimMapper() ClaimMapper

type Claims

type Claims struct {
	// Identity of the subject
	Subject string
	// Role within the context of the whole Temporal cluster or a multi-cluster setup
	System Role
	// Roles within specific namespaces
	Namespaces map[string]Role
}

@@@SNIPSTART temporal-common-authorization-claims Claims contains the identity of the subject and subject's roles at the system level and for individual namespaces

type Decision

type Decision int

Decision is enum type for auth decision

const (
	// DecisionDeny means auth decision is deny
	DecisionDeny Decision = iota + 1
	// DecisionAllow means auth decision is allow
	DecisionAllow
)

type MockAuthorizer

type MockAuthorizer struct {
	// contains filtered or unexported fields
}

MockAuthorizer is a mock of Authorizer interface.

func NewMockAuthorizer

func NewMockAuthorizer(ctrl *gomock.Controller) *MockAuthorizer

NewMockAuthorizer creates a new mock instance.

func (*MockAuthorizer) Authorize

func (m *MockAuthorizer) Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)

Authorize mocks base method.

func (*MockAuthorizer) EXPECT

func (m *MockAuthorizer) EXPECT() *MockAuthorizerMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

type MockAuthorizerMockRecorder

type MockAuthorizerMockRecorder struct {
	// contains filtered or unexported fields
}

MockAuthorizerMockRecorder is the mock recorder for MockAuthorizer.

func (*MockAuthorizerMockRecorder) Authorize

func (mr *MockAuthorizerMockRecorder) Authorize(ctx, caller, target interface{}) *gomock.Call

Authorize indicates an expected call of Authorize.

type MockClaimMapper

type MockClaimMapper struct {
	// contains filtered or unexported fields
}

MockClaimMapper is a mock of ClaimMapper interface.

func NewMockClaimMapper

func NewMockClaimMapper(ctrl *gomock.Controller) *MockClaimMapper

NewMockClaimMapper creates a new mock instance.

func (*MockClaimMapper) EXPECT

func (m *MockClaimMapper) EXPECT() *MockClaimMapperMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockClaimMapper) GetClaims

func (m *MockClaimMapper) GetClaims(authInfo *AuthInfo) (*Claims, error)

GetClaims mocks base method.

type MockClaimMapperMockRecorder

type MockClaimMapperMockRecorder struct {
	// contains filtered or unexported fields
}

MockClaimMapperMockRecorder is the mock recorder for MockClaimMapper.

func (*MockClaimMapperMockRecorder) GetClaims

func (mr *MockClaimMapperMockRecorder) GetClaims(authInfo interface{}) *gomock.Call

GetClaims indicates an expected call of GetClaims.

type MockrequestWithNamespace

type MockrequestWithNamespace struct {
	// contains filtered or unexported fields
}

MockrequestWithNamespace is a mock of requestWithNamespace interface.

func NewMockrequestWithNamespace

func NewMockrequestWithNamespace(ctrl *gomock.Controller) *MockrequestWithNamespace

NewMockrequestWithNamespace creates a new mock instance.

func (*MockrequestWithNamespace) EXPECT

func (m *MockrequestWithNamespace) EXPECT() *MockrequestWithNamespaceMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockrequestWithNamespace) GetNamespace

func (m *MockrequestWithNamespace) GetNamespace() string

GetNamespace mocks base method.

type MockrequestWithNamespaceMockRecorder

type MockrequestWithNamespaceMockRecorder struct {
	// contains filtered or unexported fields
}

MockrequestWithNamespaceMockRecorder is the mock recorder for MockrequestWithNamespace.

func (*MockrequestWithNamespaceMockRecorder) GetNamespace

func (mr *MockrequestWithNamespaceMockRecorder) GetNamespace() *gomock.Call

GetNamespace indicates an expected call of GetNamespace.

type Result

type Result struct {
	Decision Decision
}

Result is result from authority.

type Role

type Role int16

func (Role) IsValid

func (b Role) IsValid() bool

Checks if the provided role bitmask represents a valid combination of authz

type TokenKeyProvider

type TokenKeyProvider interface {
	EcdsaKey(alg string, kid string) (*ecdsa.PublicKey, error)
	HmacKey(alg string, kid string) ([]byte, error)
	RsaKey(alg string, kid string) (*rsa.PublicKey, error)
	Close()
}

@@@SNIPSTART temporal-common-authorization-tokenkeyprovider-interface Provides keys for validating JWT tokens