Documentation
¶
Overview ¶
Package authz answers who is calling the HTTP API and whether they may do what they are asking.
Authentication and authorisation are one seam because they are replaced together: per D1 the Business Edition swaps authentication for SSO and authorisation for projects and RBAC. Splitting them would mean two companion packages that have to agree about the same subject.
Index ¶
Constants ¶
const ( EnvToken = "SWARMCLI_CD_ADMIN_TOKEN" EnvTokenFile = "SWARMCLI_CD_ADMIN_TOKEN_FILE" )
Environment variables the default authorizer reads. The file form exists because a Docker secret arrives as a file: in Swarm it is encrypted at rest in the raft log and delivered in memory, which the string form gives up.
Variables ¶
var ErrNoToken = fmt.Errorf("no admin token configured: set %s to a file (a Docker secret) or %s to the token itself", EnvTokenFile, EnvToken)
ErrNoToken is what Ready returns when neither variable is set. The controller turns it into a refusal to start rather than serving an open API: it holds root-equivalent access to the swarm, so an unauthenticated endpoint is a root shell, and defaulting to open would make the safe configuration the one an operator has to remember.
Functions ¶
func Register ¶
func Register(name string, a Authorizer)
Register installs a as the authorizer, replacing whatever was there. Call it from an init().
func TokenFromEnv ¶
func TokenFromEnv(getenv func(string) string, readFile func(string) ([]byte, error)) (string, error)
TokenFromEnv resolves the admin token, preferring the file form. It is exported because the command-line client has to present the same token this authorizer expects, and two copies of the precedence would eventually disagree about which variable wins.
It takes its environment and file reader as arguments so the tests can drive it without touching the process environment.
Types ¶
type Action ¶
type Action string
Action is what a request is trying to do. Phase 1 has two: read anything, or trigger a sync.
type Authorizer ¶
type Authorizer interface {
// Ready reports whether this authorizer is configured well enough to be
// used. The controller refuses to start when it is not.
//
// This exists because the alternative failure mode is silent: an
// unconfigured authorizer that merely rejects everything looks, to an
// operator, exactly like a wrong token. A startup error names the problem.
Ready() error
// Authenticate resolves a request to a subject. An error is a 401.
Authenticate(r *http.Request) (Subject, error)
// Authorize reports whether s may perform act on the named application. An
// empty application means the request is not scoped to one. An error is a
// 403.
Authorize(ctx context.Context, s Subject, act Action, application string) error
}
Authorizer gates every API request.
Source Files