auth

package
v1.30.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 16, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ClearCookieCache 

func ClearCookieCache(baseURL, clientID string)

ClearCookieCache removes the on-disk cookie cache file for the given URL and client ID. Called alongside ClearTokenCache after credential changes.

func ClearTokenCache 

func ClearTokenCache(baseURL, clientID string)

ClearTokenCache removes the on-disk token cache file for the given URL and client ID. Called by setup commands after credential changes to prevent stale cached tokens from being used. Errors are silently ignored.

func VerifyOAuth2Credentials added in v1.29.0 

func VerifyOAuth2Credentials(ctx context.Context, baseURL, clientID, clientSecret string) error

VerifyOAuth2Credentials performs a one-shot client-credentials exchange against a Jamf Pro instance and reports whether the pair is usable.

It deliberately calls exchangeToken rather than GetToken: GetToken consults the on-disk token cache first, which is keyed on (baseURL, clientID) and not on the secret — so a stale cached token for the same client ID would report a wrong secret as valid. Nothing is cached, so verification cannot leave a token behind for a pair the caller then declines to save.

func VerifyPlatformCredentials added in v1.29.0 

func VerifyPlatformCredentials(ctx context.Context, baseURL, clientID, clientSecret string, scope Scope) error

VerifyPlatformCredentials is the platform gateway twin of VerifyOAuth2Credentials. The scope is not sent during a token exchange — the gateway resolves it per request from a header — so this establishes that the credentials are valid and says nothing about whether the scope level is.

Types

type Expirer 

type Expirer interface {
	ExpiresAt() time.Time
}

Expirer is implemented by auth providers that expose token expiry information.

type OAuth2Provider 

type OAuth2Provider struct {
	// contains filtered or unexported fields
}

OAuth2Provider uses client credentials flow to obtain and cache tokens. It proactively refreshes the token before expiry and persists tokens to a temp file so repeated CLI invocations skip redundant token exchanges.

func NewOAuth2Provider 

func NewOAuth2Provider(baseURL, clientID, clientSecret string) *OAuth2Provider

func (*OAuth2Provider) ExpiresAt 

func (p *OAuth2Provider) ExpiresAt() time.Time

ExpiresAt returns the expiry time of the last fetched token. Returns zero if GetToken has not yet been called successfully.

func (*OAuth2Provider) GetToken 

func (p *OAuth2Provider) GetToken(ctx context.Context) (string, error)

func (*OAuth2Provider) Jar 

func (p *OAuth2Provider) Jar() http.CookieJar

Jar returns the cookie jar used by this provider's HTTP client. Sharing this jar with the API client enables sticky session affinity cookies (e.g. APBALANCEID on Jamf Cloud) to persist across requests.

func (*OAuth2Provider) Name 

func (p *OAuth2Provider) Name() string

func (*OAuth2Provider) Refresh 

func (p *OAuth2Provider) Refresh(ctx context.Context) (string, error)

Refresh clears the in-memory and disk token caches and exchanges credentials for a new token. Implements auth.Refresher.

type PlatformOAuth2Provider 

type PlatformOAuth2Provider struct {
	// contains filtered or unexported fields
}

PlatformOAuth2Provider uses the Jamf Platform Gateway for authentication. Instead of authenticating directly against a Jamf Pro instance, it obtains tokens from a regional platform gateway (e.g., https://us.api.platform.jamf.com) and routes all API requests through that gateway, scoped by the header its Scope names.

func NewPlatformOAuth2Provider 

func NewPlatformOAuth2Provider(baseURL, clientID, clientSecret string, scope Scope) *PlatformOAuth2Provider

func (*PlatformOAuth2Provider) ClientID 

func (p *PlatformOAuth2Provider) ClientID() string

ClientID returns the OAuth2 client ID. Used to construct SDK clients that manage their own token lifecycle (e.g., the Jamf Platform SDK).

func (*PlatformOAuth2Provider) ClientSecret 

func (p *PlatformOAuth2Provider) ClientSecret() string

ClientSecret returns the OAuth2 client secret. Used to construct SDK clients that manage their own token lifecycle (e.g., the Jamf Platform SDK).

func (*PlatformOAuth2Provider) ExpiresAt 

func (p *PlatformOAuth2Provider) ExpiresAt() time.Time

ExpiresAt returns the expiry time of the last fetched token. Returns zero if GetToken has not yet been called successfully.

func (*PlatformOAuth2Provider) GetToken 

func (p *PlatformOAuth2Provider) GetToken(ctx context.Context) (string, error)

func (*PlatformOAuth2Provider) Jar 

func (p *PlatformOAuth2Provider) Jar() http.CookieJar

Jar returns the cookie jar used by this provider's HTTP client. Sharing this jar with the API client enables sticky session affinity cookies (e.g. APBALANCEID on Jamf Cloud) to persist across requests.

func (*PlatformOAuth2Provider) Name 

func (p *PlatformOAuth2Provider) Name() string

func (*PlatformOAuth2Provider) Refresh 

func (p *PlatformOAuth2Provider) Refresh(ctx context.Context) (string, error)

Refresh clears the in-memory and disk token caches and exchanges credentials for a new token. Implements auth.Refresher.

func (*PlatformOAuth2Provider) Scope added in v1.28.0 

func (p *PlatformOAuth2Provider) Scope() Scope

Scope returns the level this integration is scoped to, and the identifier that names it. Callers use it to stamp the right request header — or none, for an organization-scoped credential.

type Provider 

type Provider interface {
	// GetToken returns a valid authentication token
	GetToken(ctx context.Context) (string, error)
	// Name returns the provider name for logging
	Name() string
}

Provider defines the interface for authentication providers

type Refresher 

type Refresher interface {
	Refresh(ctx context.Context) (string, error)
}

Refresher is implemented by auth providers that support forced token refresh. Calling Refresh clears any cached state (in-memory and on-disk) and exchanges credentials for a brand-new token.

type Scope added in v1.28.0 

type Scope struct {
	Kind ScopeKind
	ID   string
}

Scope pairs a level with the identifier that names it. The zero value is organization scope, which needs no identifier.

func EnvironmentScope added in v1.28.0 

func EnvironmentScope(id string) Scope

EnvironmentScope returns an environment-scoped Scope, or organization scope for an empty id.

func TenantScope added in v1.28.0 

func TenantScope(id string) Scope

TenantScope returns a tenant-scoped Scope, or organization scope for an empty id — so a caller can pass a possibly-unset config value without branching.

func (Scope) Header added in v1.28.0 

func (s Scope) Header() (name, value string)

Header returns the request header carrying this scope, or ("", "") when there is none to send. Organization scope has no header by design, so an empty name is a normal answer rather than a missing value.

type ScopeKind added in v1.28.0 

type ScopeKind int

ScopeKind is the level a Jamf Platform API integration is created at.

The three levels are mutually exclusive: an integration is minted against one of them in Jamf Account, and the credential carries that choice. Crossing over is refused — an environment-scoped credential sending X-Tenant-Id, or a tenant-scoped one sending X-Environment-Id, gets 403 OWNERSHIP_FORBIDDEN even when both IDs belong to the same customer. So this is a choice between integrations, not between two ways of naming the same access. 

const (
	// ScopeOrganization covers resources belonging to the organization itself
	// (SSO, AI Governance). It sends no header at all: the gateway resolves an
	// organization from the access token, so an org-scoped integration needs a
	// credential and nothing else.
	ScopeOrganization ScopeKind = iota
	// ScopeEnvironment covers a platform environment — a group of tenants across
	// product types. Sent as X-Environment-Id. This is the level to prefer for
	// new integrations.
	ScopeEnvironment
	// ScopeTenant covers a single tenant of Jamf Pro, Jamf School, Jamf Protect
	// or Jamf Security Cloud. Sent as X-Tenant-Id. Jamf Account describes it as
	// the legacy method for targeting integrations without a platform
	// environment; it stays supported, and a tenant-scoped credential must keep
	// using it.
	ScopeTenant
)

func (ScopeKind) String added in v1.28.0 

func (k ScopeKind) String() string

String names the level, for messages that have to say which scope is in play.

type TokenProvider 

type TokenProvider struct {
	// contains filtered or unexported fields
}

TokenProvider uses a pre-existing bearer token

func NewTokenProvider 

func NewTokenProvider(token string) *TokenProvider

func (*TokenProvider) GetToken 

func (p *TokenProvider) GetToken(ctx context.Context) (string, error)

func (*TokenProvider) Name 

func (p *TokenProvider) Name() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.