samples/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

Links

Open Source Insights

README ¶

safeguard-go samples

Small, standalone programs that each demonstrate one Safeguard flow with the safeguard-go SDK. They mirror the per-flow examples shipped by PySafeguard and SafeguardDotNet. Every sample is its own package main, so run one with:

go run ./samples/pkce -appliance safeguard.example.com -username Admin -password "..." -insecure

Configuration

Every sample takes its inputs as flags. The common ones are:

Flag	Meaning
`-appliance`	Appliance host name or IP (required)
`-ca`	Path to the appliance's trusted CA bundle (PEM). Omit to use the system trust store.
`-insecure`	Skip TLS verification. Dev/test only — never use against production.

Flow-specific flags (run any sample with -h for its full set) include -username/-password, -provider, -cert/-key/-cert-password, -token, -apikey, and -broker-apikey.

Against a self-signed lab appliance you can trust its CA with -ca, or bypass verification entirely with -insecure while you get set up.

Secrets: these samples take credentials as flags to stay simple and runnable. That is fine for a demo, but flags are visible in your shell history and process list — a real application should source secrets from wherever suits its deployment (environment, a secrets manager, a config file) rather than the command line.

Samples

Directory	Flow
`password`	Resource Owner Grant (username/password) login
`pkce`	PKCE headless login (recommended for automation)
`certificate`	Client-certificate login over mutual TLS
`token`	Reuse an existing Safeguard user token
`anonymous`	Anonymous session against the Notification service
`browser`	Interactive external-browser login (`browser` add-on)
`devicecode`	Device authorization grant (`devicecode` add-on)
`invoke`	Generic request with any method against any service
`invoke-typed`	Typed request that decodes JSON into a Go struct
`download`	Stream a response body straight to a file
`a2a-password`	A2A password retrieval
`a2a-privatekey`	A2A SSH private-key retrieval
`a2a-apikey`	A2A API-key retrieval
`a2a-discover`	List the accounts a certificate can retrieve
`a2a-set-password`	A2A password write-back
`a2a-broker`	Broker an access request on behalf of another user
`events`	One-shot SignalR event listener
`events-persistent`	Reconnecting SignalR event listener
`a2a-events`	A2A credential-change event listener

A note on retrieved credentials

The A2A samples print retrieved credentials to stdout so you can see the flow work. Do not do that in real applications: keep values in safeguard.Secret, which redacts itself from logs, strings, and errors, and expose the bytes only where you must.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
a2a-apikey Command a2a-apikey demonstrates Application-to-Application (A2A) API-key retrieval.	Command a2a-apikey demonstrates Application-to-Application (A2A) API-key retrieval.
a2a-broker Command a2a-broker demonstrates brokering an access request on behalf of another user.	Command a2a-broker demonstrates brokering an access request on behalf of another user.
a2a-discover Command a2a-discover demonstrates GetRetrievableAccounts, which lists every account the context's client certificate is registered to retrieve, across all of its A2A registrations.	Command a2a-discover demonstrates GetRetrievableAccounts, which lists every account the context's client certificate is registered to retrieve, across all of its A2A registrations.
a2a-events Command a2a-events demonstrates an A2A credential-change event listener.	Command a2a-events demonstrates an A2A credential-change event listener.
a2a-password Command a2a-password demonstrates Application-to-Application (A2A) password retrieval.	Command a2a-password demonstrates Application-to-Application (A2A) password retrieval.
a2a-privatekey Command a2a-privatekey demonstrates Application-to-Application (A2A) SSH private-key retrieval.	Command a2a-privatekey demonstrates Application-to-Application (A2A) SSH private-key retrieval.
a2a-set-password Command a2a-set-password demonstrates SetPassword, the A2A write-back that stores a new password for an account.	Command a2a-set-password demonstrates SetPassword, the A2A write-back that stores a new password for an account.
anonymous Command anonymous demonstrates an anonymous session, which carries no user token and is sufficient for the Notification service and other unauthenticated endpoints such as the appliance status.	Command anonymous demonstrates an anonymous session, which carries no user token and is sufficient for the Notification service and other unauthenticated endpoints such as the appliance status.
browser Command browser demonstrates an interactive external-browser (PKCE) login.	Command browser demonstrates an interactive external-browser (PKCE) login.
certificate Command certificate demonstrates a client-certificate login over mutual TLS.	Command certificate demonstrates a client-certificate login over mutual TLS.
devicecode Command devicecode demonstrates a device authorization grant login.	Command devicecode demonstrates a device authorization grant login.
download Command download demonstrates Download, which streams a response body straight to an io.Writer without buffering it in memory — suited to large payloads such as backups or reports.	Command download demonstrates Download, which streams a response body straight to an io.Writer without buffering it in memory — suited to large payloads such as backups or reports.
events Command events demonstrates a one-shot SignalR event listener.	Command events demonstrates a one-shot SignalR event listener.
events-persistent Command events-persistent demonstrates a reconnecting SignalR event listener.	Command events-persistent demonstrates a reconnecting SignalR event listener.
invoke Command invoke is a small general-purpose client that issues one request with any HTTP method against any Safeguard service, demonstrating the generic Invoke surface (Get/Post/Put/Delete).	Command invoke is a small general-purpose client that issues one request with any HTTP method against any Safeguard service, demonstrating the generic Invoke surface (Get/Post/Put/Delete).
invoke-typed Command invoke-typed demonstrates InvokeTyped, which decodes a successful JSON response directly into a Go value instead of returning the raw body.	Command invoke-typed demonstrates InvokeTyped, which decodes a successful JSON response directly into a Go value instead of returning the raw body.
password Command password demonstrates a Resource Owner Grant (username/password) login and a single Core API call.	Command password demonstrates a Resource Owner Grant (username/password) login and a single Core API call.
pkce Command pkce demonstrates a PKCE non-interactive ("headless") login.	Command pkce demonstrates a PKCE non-interactive ("headless") login.
token Command token demonstrates reusing an existing Safeguard user token instead of performing a login exchange.	Command token demonstrates reusing an existing Safeguard user token instead of performing a login exchange.