access

README

golang.org/x/build/internal/access

Package access provides primitives for implementing authentication and authorization.

Documentation

Overview

Package access provides primitives for implementing authentication and authorization.

Index

• Constants
• func ContextWithIAP(ctx context.Context, iap IAPFields) context.Context
• func FakeContextWithOutgoingIAPAuth(ctx context.Context, iap IAPFields) context.Context
• func FakeIAPAuthFunc() grpcauth.AuthFunc
• func FakeIAPAuthInterceptorOptions() []grpc.ServerOption
• func IAPAudienceAppEngine(projectNumber int64, projectID string) string
• func IAPAudienceGCE(projectNumber int64, serviceID string) string
• func RequireIAPAuthHandler(h http.Handler, audience string) http.Handler
• func RequireIAPAuthStreamInterceptor(audience string) grpc.StreamServerInterceptor
• func RequireIAPAuthUnaryInterceptor(audience string) grpc.UnaryServerInterceptor
• type IAPFields
  • func IAPFromContext(ctx context.Context) (*IAPFields, error)

Constants

const (

	// IAPSkipAudienceValidation is the audience string used when the validation is not
	// necessary. https://pkg.go.dev/google.golang.org/api/idtoken#Validate
	IAPSkipAudienceValidation = ""
)

Functions

func ContextWithIAP

func ContextWithIAP(ctx context.Context, iap IAPFields) context.Context

ContextWithIAP adds the iap fields to the context.

func FakeContextWithOutgoingIAPAuth

func FakeContextWithOutgoingIAPAuth(ctx context.Context, iap IAPFields) context.Context

FakeContextWithOutgoingIAPAuth adds the iap fields to the metadata of an outgoing GRPC request and should only be used for testing.

func FakeIAPAuthFunc

func FakeIAPAuthFunc() grpcauth.AuthFunc

FakeIAPAuthFunc provides a fake IAP authentication validation and should only be used for testing.

func FakeIAPAuthInterceptorOptions

func FakeIAPAuthInterceptorOptions() []grpc.ServerOption

FakeIAPAuthInterceptorOptions provides the GRPC server options for fake IAP authentication and should only be used for testing.

func IAPAudienceAppEngine

func IAPAudienceAppEngine(projectNumber int64, projectID string) string

IAPAudienceAppEngine returns the JWT audience for App Engine services. The project number is the numerical GCP project number the service is deployed in. The project ID is the textual identifier for the GCP project that the App Engine instance is deployed in. https://cloud.google.com/iap/docs/signed-headers-howto

func IAPAudienceGCE

func IAPAudienceGCE(projectNumber int64, serviceID string) string

IAPAudienceGCE returns the jwt audience for GCE and GKE services. The project number is the numerical GCP project number the service is deployed in. The service ID is the identifier for the backend service used to route IAP requests. https://cloud.google.com/iap/docs/signed-headers-howto

func RequireIAPAuthHandler

func RequireIAPAuthHandler(h http.Handler, audience string) http.Handler

func RequireIAPAuthStreamInterceptor

func RequireIAPAuthStreamInterceptor(audience string) grpc.StreamServerInterceptor

RequireIAPAuthStreamInterceptor creates an authentication interceptor for a GRPC streaming server. This requires Identity Aware Proxy authentication. Upon a successful authentication the associated headers will be copied into the request context.

func RequireIAPAuthUnaryInterceptor

func RequireIAPAuthUnaryInterceptor(audience string) grpc.UnaryServerInterceptor

RequireIAPAuthUnaryInterceptor creates an authentication interceptor for a GRPC server. This requires Identity Aware Proxy authentication. Upon a successful authentication the associated headers will be copied into the request context.

Types

type IAPFields

type IAPFields struct {
	// Email contains the user's email address
	// For example, "accounts.google.com:example@gmail.com"
	Email string
	// ID contains a unique identifier for the user
	// For example, "accounts.google.com:userIDvalue"
	ID string
}

IAPFields contains the values for the headers retrieved from Identity Aware Proxy.

func IAPFromContext

func IAPFromContext(ctx context.Context) (*IAPFields, error)

IAPFromContext retrieves the IAPFields stored in the context if it exists.