Documentation
¶
Overview ¶
Package authz decides who may do what (security.md "Authorization", PHASE1 step 10).
Users get roles per tenant, optionally limited to one CA. Instance admins manage users and unseal the server; that alone gives no rights in a tenant. The services check permissions themselves (the CA engine, the keyring), so the API, the UI, ACME and the agent can't bypass them.
Index ¶
Constants ¶
const StepUpWindow = 5 * time.Minute
StepUpWindow is how long a fresh second factor counts.
Variables ¶
var ( ErrDenied = errors.New("permission denied") ErrStepUpRequired = errors.New("confirm this action with your second factor first") )
Errors. Both are refusals the caller can fix; the API maps ErrStepUpRequired to a prompt for the second factor.
var Roles = []Role{Viewer, Operator, Admin}
Roles lists the valid roles.
Functions ¶
func NeedsStepUp ¶
func NeedsStepUp(p Permission) bool
NeedsStepUp reports whether p needs a fresh second factor.
Types ¶
type Kind ¶
type Kind string
Kind says where a principal comes from.
const ( // KindUser: signed in through the web UI or the API. KindUser Kind = "user" // KindConsole: a command on the server itself (myownpki ...). Whoever runs // it can read the data directory anyway; it may do everything. KindConsole Kind = "console" // KindSystem: the server's own jobs (CRL renewal, checkpoints). KindSystem Kind = "system" )
Kinds.
type Permission ¶
type Permission string
Permission is one thing a principal may do.
const ( ReadPKI Permission = "pki.read" // CAs, certificates, CRL status ReadAudit Permission = "audit.read" // the tenant audit log: user names and IPs are personal data IssueCert Permission = "certificate.issue" // also renew RevokeCert Permission = "certificate.revoke" // step-up DownloadKey Permission = "key.download" // a server-generated private key; step-up ManageCA Permission = "ca.manage" // create, import, renew, retire, update, revoke, install; step-up UploadCRL Permission = "crl.upload" // the offline root's CRL; step-up ManageTenant Permission = "tenant.manage" // tenant settings )
Tenant permissions.
const ( Unseal Permission = "system.unseal" // and seal; the passphrase is the stronger proof, no step-up ManageUsers Permission = "user.manage" // users, roles, 2FA reset, unlock; step-up )
Instance permissions: instance admins only.
type Principal ¶
type Principal struct {
Kind Kind
UserID string
Username string
InstanceAdmin bool
Bindings []Binding
// StepUpAt is the last fresh second factor of this session; zero = none.
StepUpAt time.Time
// ViaToken: the request carries an API token. A token never satisfies
// step-up (step 18): those actions need a person with a fresh code.
ViaToken bool
}
Principal is the authenticated caller.
func Console ¶
func Console() *Principal
Console returns the principal of a command run on the server.
func (*Principal) CanIssueSomewhere ¶
CanIssueSomewhere tells whether p may issue at one CA at least (or is the console) – for previews that belong to no CA yet.
type Resource ¶
Resource is what an action touches. CA "" is an action on the whole tenant (for example creating a CA): only a tenant-wide role allows it.
type TokenStepUpError ¶
type TokenStepUpError struct {
Action string
}
TokenStepUpError refuses an action that needs step-up to an API token. It is a denial (ErrDenied), not a prompt: no POST /auth/step-up can ever make a token fresh, so step-up-required would send a script in circles.
func (*TokenStepUpError) Error ¶
func (e *TokenStepUpError) Error() string
func (*TokenStepUpError) Unwrap ¶
func (e *TokenStepUpError) Unwrap() error
Unwrap makes errors.Is(err, ErrDenied) true.
Source Files