Documentation
¶
Overview ¶
Package authn verifies the kernel's user access tokens in one place: the HTTP middleware, the admin monitor WebSocket and the gRPC interceptor all call it. It pins the token algorithm and enforces revocations.
Index ¶
Constants ¶
const ( IdentityIssuer = "anixops-identity" IdentityAudience = "anix-control" )
The kernel accepts identity tokens with this issuer and audience only.
Variables ¶
var ( // ErrInvalidToken covers malformed, forged, expired and wrong-algorithm tokens. ErrInvalidToken = errors.New("invalid or expired token") // ErrRevokedToken is a valid token whose user or session was revoked. ErrRevokedToken = errors.New("token has been revoked") )
var ErrInvalidRevocation = errors.New("invalid revocation")
ErrInvalidRevocation wraps every reason a revocation is refused.
Functions ¶
func LegacyTokensRefused ¶
func LegacyTokensRefused() bool
LegacyTokensRefused reports whether RefuseLegacyTokens was called.
func RefuseLegacyTokens ¶
func RefuseLegacyTokens()
RefuseLegacyTokens makes the default verifier refuse the kernel's own HS256 tokens from now on. The server calls it once identity is finalized: only identity then issues tokens.
func Remember ¶
func Remember(r Revocation)
Remember applies a committed revocation to the default store, if any.
func SetDefaultIdentityKeys ¶
func SetDefaultIdentityKeys(keys IdentityKeys)
SetDefaultIdentityKeys installs the identity keys the default verifier uses; the server sets them at start.
func SetDefaultStore ¶
func SetDefaultStore(store *Store)
SetDefaultStore installs the revocation store the default verifier and Remember use; the server sets it at start.
Types ¶
type IdentityKeys ¶
type IdentityKeys interface {
KeySet() identitytoken.KeySet
// Kick asks for a refresh: a token named a key the kernel does not know.
Kick()
}
IdentityKeys supplies the identity module's token keys.
func DefaultIdentityKeys ¶
func DefaultIdentityKeys() IdentityKeys
DefaultIdentityKeys returns the installed identity keys, or nil.
type Revocation ¶
type Revocation struct {
UserID uint
TokenVersion uint64
NotBefore time.Time
SessionID string
SessionExpiresAt time.Time
Reason string
}
Revocation makes tokens stop working. It mirrors KernelIdentity.PublishRevocation:
- UserID with NotBefore revokes that user's kernel tokens (no tv claim) issued up to NotBefore;
- with TokenVersion as well, the user's identity tokens (tv claim) stop working when their tv is below TokenVersion, so a token identity issues afterwards works even within the same second; without it, identity tokens issued up to NotBefore stop working too;
- SessionID revokes one session until SessionExpiresAt.
func UserRevocation ¶
func UserRevocation(userID uint, reason string) Revocation
UserRevocation revokes every token of a user issued before now.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store answers revocation checks from memory. It loads the tables at start, applies revocations this process makes at once (Remember), and reloads periodically to pick up revocations written elsewhere.
func DefaultStore ¶
func DefaultStore() *Store
DefaultStore returns the installed revocation store, or nil.
func NewStore ¶
NewStore returns a store over db. maxTokenLifetime is the longest token lifetime the kernel accepts (jwt.expire plus leeway).
func (*Store) Publish ¶
func (s *Store) Publish(ctx context.Context, r Revocation) error
Publish writes a revocation and applies it at once.
func (*Store) Reload ¶
Reload replaces the cache with the tables, after deleting rows that no longer revoke any unexpired token.
func (*Store) Remember ¶
func (s *Store) Remember(r Revocation)
Remember applies a revocation that was written and committed.
type Verifier ¶
type Verifier struct {
// Secret returns the current HS256 secret.
Secret func() string
// Revocations may be nil, which disables revocation checks (tools and
// tests without a database).
Revocations *Store
// IdentityKeys may be nil: identity tokens are then refused.
IdentityKeys IdentityKeys
}
Verifier checks the kernel's own HS256 tokens (signed with the configured secret) and the identity module's EdDSA tokens (signed with a published identity key), then the revocation store.
Source Files