Documentation
¶
Index ¶
- Constants
- func GetJWKSKeysURL(etsEndpoint string) string
- func NewJWKFromRSAPub(pub *rsa.PublicKey) (*jose.JSONWebKey, error)
- func NewJWKSFromRSAPubKeys(pubKeys []*rsa.PublicKey) (*jose.JSONWebKeySet, error)
- func NewJWKSHandler(pubKeys []*rsa.PublicKey) http.HandlerFunc
- func PublicKeyToPEM(pubKey crypto.PublicKey) (string, error)
- type JWKSCache
- type JWKSVerifier
- type JWKSVerifierOption
- type JWT
- type JWTCache
- func (c *JWTCache) Copy() *JWTCache
- func (c *JWTCache) FetchToken(ctx context.Context) (string, error)
- func (c *JWTCache) ForceNewToken(ctx context.Context) (string, error)
- func (c *JWTCache) RefreshClient()
- func (c *JWTCache) WithBackOffBase(backOffBase time.Duration) *JWTCache
- func (c *JWTCache) WithBackOffMax(backOffMax time.Duration) *JWTCache
- func (c *JWTCache) WithExpiryMargin(margin time.Duration) *JWTCache
- func (c *JWTCache) WithFetcher(fetcher tokenFetcher) *JWTCache
- func (c *JWTCache) WithNowFunc(f func() time.Time) *JWTCache
- func (c *JWTCache) WithVerifier(jwtVerifier tokenVerifier) *JWTCache
Constants ¶
const (
DefaultJWKSKeySetTTL = 60 * time.Minute
)
Variables ¶
This section is empty.
Functions ¶
func GetJWKSKeysURL ¶
func NewJWKFromRSAPub ¶
func NewJWKFromRSAPub(pub *rsa.PublicKey) (*jose.JSONWebKey, error)
NewJWKFromRSAPub creates jose.JSONWebKey object from a rsa.PublicKey, with its KeyID set to the hash computed by jwkKeyID.
func NewJWKSFromRSAPubKeys ¶
func NewJWKSFromRSAPubKeys(pubKeys []*rsa.PublicKey) (*jose.JSONWebKeySet, error)
NewJWKSFromRSAPubKeys returns jose.JSONWebKeySet from a list of RSA public keys.
func NewJWKSHandler ¶
func NewJWKSHandler(pubKeys []*rsa.PublicKey) http.HandlerFunc
NewJWKSHandler returns a http handler the implements .well-known/jwks.json API, given a list of known public keys.
Types ¶
type JWKSCache ¶
type JWKSCache struct {
// URL is the .well-known/jwks.json url, e.g.,
// https://eps.egx.nvidia.com/.well-known/jwks.json
URL string
// dependencies
RoundTrip func(*http.Request) (*http.Response, error)
// contains filtered or unexported fields
}
JWKSCache is a helper client cache struct that fetch public keys from EPS .well-known/jwks.json endpoint. Example usage in EMS:
jc := NewJWKSCache("https://eps.egx.nvidia.com/.well-known/jwks.json")
err := jc.Refresh() if err != nil { ... }
epsPub, err := jc.Get(deviceEnrollmentRequest.KeyVersion) if err != nil { ... }
err := VerifyEnrollmentRequest(deviceEnrollmentRequest, epsPub)
func NewJWKSCache ¶
func (*JWKSCache) GetJSONWebKeySet ¶
func (jc *JWKSCache) GetJSONWebKeySet() jose.JSONWebKeySet
func (*JWKSCache) GetOrRefresh ¶
type JWKSVerifier ¶
JWKSVerifier acts as a token verifier for to be consumed by the
func NewJWKSVerifier ¶
func NewJWKSVerifier(jwksURL string, options ...JWKSVerifierOption) *JWKSVerifier
func (*JWKSVerifier) ExtractVerifiedToken ¶
func (*JWKSVerifier) JWKSURL ¶
func (v *JWKSVerifier) JWKSURL() string
func (*JWKSVerifier) VerifyToken ¶
VerifyToken verifies that the current token is valid. Returns true if valid, false otherwise. An error is returned only when the validity of the token could not be determined.
type JWKSVerifierOption ¶
type JWKSVerifierOption func(*JWKSVerifier)
func WithJWKSVerifierCacheTTL ¶
func WithJWKSVerifierCacheTTL(cacheTTL time.Duration) JWKSVerifierOption
type JWT ¶
type JWT struct {
Issuer string `json:"iss"`
TokenType string `json:"token_type"`
Subject string `json:"sub"`
AuthorizedParties string `json:"azp"`
Service struct {
ID string `json:"id"`
Name string `json:"name"`
} `json:"service"`
JWTID string `json:"jti"`
Audience []string `json:"aud"`
Scopes []string `json:"scopes"`
Expiration int64 `json:"exp"`
IssuedAt int64 `json:"iat"`
}
func (JWT) ExpirationTime ¶
func (JWT) IssuedAtTime ¶
type JWTCache ¶
type JWTCache struct {
// sync.Mutex protects followings mutable states
sync.Mutex
// contains filtered or unexported fields
}
func NewJWTCache ¶
func NewJWTCache() *JWTCache
func (*JWTCache) FetchToken ¶
FetchToken returns the token in the cache if it think the token is valid, otherwise, it tries to fetch a new token and update cache first.
func (*JWTCache) ForceNewToken ¶
ForceNewToken forces to retrieve a new device token. Caller is not expect to use ForceNewToken() directly but use FetchToken() most of time.
func (*JWTCache) RefreshClient ¶
func (c *JWTCache) RefreshClient()
Source Files