auth_provider

package module
v1.0.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 13, 2026 License: MIT Imports: 29 Imported by: 0

README

auth_provider

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func FederationURL added in v1.0.4 

func FederationURL(hubBase, audience, returnTo string) string

FederationURL builds a SAMLn federation entry on the hub IdP.

func ProductClientName added in v1.0.4 

func ProductClientName(slug string) string

ProductClientName maps a product slug to its configured OIDC client_name.

Types

type ActiveSession 

type ActiveSession struct {
	Username   string `json:"username"`
	DBSCPubKey string `json:"dbsc_pub_key,omitempty"`
}

type AdminPinConfig added in v1.0.4 

type AdminPinConfig struct {
	PinnedCredentialIDs []string
	BreakglassLocalhost bool
}

AdminPinConfig pins admin WebAuthn credentials (YubiKey) without importing secure_bootstrap (avoids import cycles).

type AuthRequest 

type AuthRequest struct {
	ClientID            string `json:"client_id"`
	RedirectURI         string `json:"redirect_uri"`
	State               string `json:"state"`
	Nonce               string `json:"nonce"`
	Scope               string `json:"scope"`
	CodeChallenge       string `json:"code_challenge"`
	CodeChallengeMethod string `json:"code_challenge_method"`
}

type OIDCClient 

type OIDCClient struct {
	ClientID     string   `json:"client_id"`
	ClientSecret string   `json:"client_secret"`
	ClientName   string   `json:"client_name"`
	RedirectURIs []string `json:"redirect_uris"`
}

type PasskeyUser 

type PasskeyUser struct {
	ID          []byte                `json:"id"`
	Name        string                `json:"name"`
	DisplayName string                `json:"displayName"`
	Credentials []webauthn.Credential `json:"credentials"`
}

func (*PasskeyUser) WebAuthnCredentials 

func (u *PasskeyUser) WebAuthnCredentials() []webauthn.Credential

func (*PasskeyUser) WebAuthnDisplayName 

func (u *PasskeyUser) WebAuthnDisplayName() string

func (*PasskeyUser) WebAuthnID 

func (u *PasskeyUser) WebAuthnID() []byte

func (*PasskeyUser) WebAuthnIcon 

func (u *PasskeyUser) WebAuthnIcon() string

func (*PasskeyUser) WebAuthnName 

func (u *PasskeyUser) WebAuthnName() string

type ProductAuthRoute added in v1.0.4 

type ProductAuthRoute struct {
	Slug         string
	PublicDomain string
	IdentityHost string
	ClientName   string
}

ProductAuthRoute maps a product identity plane host to its public app and OIDC client.

type Provider 

type Provider struct {
	SessionManager *secure_policy.SessionManager
	SdfEngine      *secure_data_format.SecureDataEngine
	Logger         *logger.LogDispatcher

	OnLoginSuccess       func(username string, w http.ResponseWriter, r *http.Request)
	OnEnrollmentComplete func(username string) error
	// contains filtered or unexported fields
}

func New 

func New(gk *guikit.GUIKit, sm *secure_policy.SessionManager, sdf *secure_data_format.SecureDataEngine, rpDisplayName, rpID, rpOrigin, tunnelRPID string) (*Provider, error)

func (*Provider) AdminPin added in v1.0.4 

func (p *Provider) AdminPin() AdminPinConfig

func (*Provider) AllowBootstrapRegistration added in v1.0.4 

func (p *Provider) AllowBootstrapRegistration(subject string)

func (*Provider) AuthGuard 

func (p *Provider) AuthGuard(next http.HandlerFunc) http.HandlerFunc

func (*Provider) Authorize 

func (p *Provider) Authorize(w http.ResponseWriter, r *http.Request)

func (*Provider) BeginLogin 

func (p *Provider) BeginLogin(w http.ResponseWriter, r *http.Request)

func (*Provider) BeginRegistration 

func (p *Provider) BeginRegistration(w http.ResponseWriter, r *http.Request)

func (*Provider) CompleteHardwareEnrollment 

func (p *Provider) CompleteHardwareEnrollment(username string, tpmPublicBytes []byte, r *http.Request) error

func (*Provider) DBSCRefresh 

func (p *Provider) DBSCRefresh(w http.ResponseWriter, r *http.Request)

func (*Provider) DBSCRegister 

func (p *Provider) DBSCRegister(w http.ResponseWriter, r *http.Request)

func (*Provider) FinishLogin 

func (p *Provider) FinishLogin(w http.ResponseWriter, r *http.Request)

func (*Provider) FinishRegistration 

func (p *Provider) FinishRegistration(w http.ResponseWriter, r *http.Request)

func (*Provider) HandleAuthEntry added in v1.0.4 

func (p *Provider) HandleAuthEntry(w http.ResponseWriter, r *http.Request) bool

HandleAuthEntry completes SSO when the hub already has a valid session. Also redirects platform-face hosts (0trust.name) to the canonical WebAuthn host. Returns true when the request was handled (redirect or JSON).

func (*Provider) HandleBlacklistDevice added in v1.0.4 

func (p *Provider) HandleBlacklistDevice(w http.ResponseWriter, r *http.Request)

HandleBlacklistDevice permanently bans a bootstrap subject/device (localhost-only). Use after compromise: attacker identity stays out until ClearDeviceBlacklist.

func (*Provider) HandleBootstrapResetPasskey added in v1.0.4 

func (p *Provider) HandleBootstrapResetPasskey(w http.ResponseWriter, r *http.Request)

func (*Provider) HandleClearAllDeviceBlacklists added in v1.0.4 

func (p *Provider) HandleClearAllDeviceBlacklists(w http.ResponseWriter, r *http.Request)

HandleClearAllDeviceBlacklists lifts every device blacklist entry (localhost-only emergency restore).

func (*Provider) HandleClearAllDeviceRevokes added in v1.0.4 

func (p *Provider) HandleClearAllDeviceRevokes(w http.ResponseWriter, r *http.Request)

HandleClearAllDeviceRevokes is a deprecated alias for HandleClearAllDeviceBlacklists.

func (*Provider) HandleClearDeviceBlacklist added in v1.0.4 

func (p *Provider) HandleClearDeviceBlacklist(w http.ResponseWriter, r *http.Request)

HandleClearDeviceBlacklist lifts a permanent device blacklist for a bootstrap user. Localhost-only recovery when sessions fail with "device identity is permanently blacklisted".

func (*Provider) HandleClearDeviceRevoke added in v1.0.4 

func (p *Provider) HandleClearDeviceRevoke(w http.ResponseWriter, r *http.Request)

HandleClearDeviceRevoke is a deprecated alias for HandleClearDeviceBlacklist.

func (*Provider) HandleProvisionStatus added in v1.0.4 

func (p *Provider) HandleProvisionStatus(w http.ResponseWriter, r *http.Request)

func (*Provider) HandleProvisionVerify 

func (p *Provider) HandleProvisionVerify(w http.ResponseWriter, r *http.Request)

func (*Provider) HandleSAMLnExchange added in v1.0.4 

func (p *Provider) HandleSAMLnExchange(w http.ResponseWriter, r *http.Request)

HandleSAMLnExchange validates a SAMLn assertion and returns an OIDC redirect for the target app.

func (*Provider) HandleSAMLnFederate added in v1.0.4 

func (p *Provider) HandleSAMLnFederate(w http.ResponseWriter, r *http.Request)

HandleSAMLnFederate issues a SAMLn assertion and redirects to the target product.

func (*Provider) HandleSAMLnJWKS added in v1.0.4 

func (p *Provider) HandleSAMLnJWKS(w http.ResponseWriter, r *http.Request)

HandleSAMLnJWKS publishes the SAMLn federation signing keys.

func (*Provider) HandleSessionConsume added in v1.0.4 

func (p *Provider) HandleSessionConsume(w http.ResponseWriter, r *http.Request)

HandleSessionConsume completes a cross-host SSO handoff onto a platform face (0trust.name). Query: code=<one-time> & dest=/path

func (*Provider) HandleSessionStatus added in v1.0.4 

func (p *Provider) HandleSessionStatus(w http.ResponseWriter, r *http.Request)

HandleSessionStatus reports whether the caller's session_id is valid and DBSC-bound.

func (*Provider) HasPendingEnrollment added in v1.0.4 

func (p *Provider) HasPendingEnrollment(username string) bool

func (*Provider) InheritPreLaunchConfig added in v1.0.4 

func (p *Provider) InheritPreLaunchConfig(from *Provider)

InheritPreLaunchConfig copies startup settings from a placeholder provider into the live instance.

func (*Provider) InitSAMLn added in v1.0.4 

func (p *Provider) InitSAMLn(db *ultimate_db.DB, issuer string, authPageID ultimate_db.PageID) error

InitSAMLn boots the SAMLn assertion engine using the provider signing key.

func (*Provider) IsEnrollmentReady added in v1.0.4 

func (p *Provider) IsEnrollmentReady(username string) bool

func (*Provider) ProvisionUserEntry 

func (p *Provider) ProvisionUserEntry(username string) (string, error)

func (*Provider) ProvisionUserEntryWithMeta added in v1.0.4 

func (p *Provider) ProvisionUserEntryWithMeta(username, subdomain string) (string, error)

func (*Provider) PutOIDCClient added in v1.0.4 

func (p *Provider) PutOIDCClient(client OIDCClient) error

PutOIDCClient mirrors a registry client into the runtime SDF store (data:client:*).

func (*Provider) RedirectPlatformFaceAuth added in v1.0.4 

func (p *Provider) RedirectPlatformFaceAuth(w http.ResponseWriter, r *http.Request) bool

RedirectPlatformFaceAuth sends browsers on 0trust.name (etc.) to the canonical IdP so WebAuthn rpId=0trust.cloud is valid. Returns true if a redirect was written. Skips redirect when the face host already has a valid session cookie.

func (*Provider) RegisterClient 

func (p *Provider) RegisterClient(w http.ResponseWriter, r *http.Request)

func (*Provider) ResetPasskey added in v1.0.4 

func (p *Provider) ResetPasskey(username string) error

ResetPasskey removes stored WebAuthn credentials so a bootstrap user can register again. It also revokes all device sessions for that subject (global logout).

func (*Provider) RevokeToken 

func (p *Provider) RevokeToken(w http.ResponseWriter, r *http.Request)

func (*Provider) ServeDiscovery 

func (p *Provider) ServeDiscovery(w http.ResponseWriter, r *http.Request)

func (*Provider) ServeJS 

func (p *Provider) ServeJS(w http.ResponseWriter, r *http.Request)

func (*Provider) ServeJWKS 

func (p *Provider) ServeJWKS(w http.ResponseWriter, r *http.Request)

func (*Provider) SessionDBSCBound added in v1.0.4 

func (p *Provider) SessionDBSCBound(cookieValue string) bool

SessionDBSCBound reports whether the session cookie has a registered DBSC device key.

func (*Provider) SetAdminPin added in v1.0.4 

func (p *Provider) SetAdminPin(cfg AdminPinConfig)

SetAdminPin configures YubiKey credential pins for bootstrap admin login.

func (*Provider) SetGUIKit added in v1.0.1 

func (p *Provider) SetGUIKit(gk *guikit.GUIKit)

SetGUIKit allows the test suite to inject the GUIKit dependency into the provider instance without exporting the internal field.

func (*Provider) SetOpenEnrollmentHosts added in v1.0.4 

func (p *Provider) SetOpenEnrollmentHosts(hosts []string)

SetOpenEnrollmentHosts allows passkey self-registration without invite/TOTP on these hosts.

func (*Provider) SetPlatformFaceHosts added in v1.0.4 

func (p *Provider) SetPlatformFaceHosts(hosts []string)

SetPlatformFaceHosts configures ICANN/public faces of the platform IdP (e.g. 0trust.name). Auth UI and WebAuthn ceremonies are forced onto the canonical issuer host.

func (*Provider) SetProductAuthRoutes added in v1.0.4 

func (p *Provider) SetProductAuthRoutes(routes []ProductAuthRoute)

func (*Provider) SetSAMLnEngine added in v1.0.4 

func (p *Provider) SetSAMLnEngine(engine *samln.SAMLnEngine)

SetSAMLnEngine wires the SAMLn compiler used for federated SSO assertions.

func (*Provider) TokenExchange 

func (p *Provider) TokenExchange(w http.ResponseWriter, r *http.Request)

func (*Provider) VerifyProvisioningTOTP 

func (p *Provider) VerifyProvisioningTOTP(username, passcode string) (bool, error)

type ProvisioningState 

type ProvisioningState struct {
	Username   string    `json:"username"`
	TOTPSecret string    `json:"totp_secret"`
	IsVerified bool      `json:"is_verified"`
	ExpiresAt  time.Time `json:"expires_at"`
	Subdomain  string    `json:"subdomain,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.