README
¶
github.com/Origens-Dev/gobeyond/oidc
GoBeyond workload-identity access for Go applications and workers.
source := &oidc.TokenSource{}
token, err := source.Token(ctx, oidc.TokenOptions{Audience: oidc.AWSTSAudience})
Resolution order is request header, context, environment token, then the
per-slot Unix-socket broker. Audience exchange is strict and uses the
issuer’s POST /~token endpoint.
Documentation
¶
Overview ¶
Package oidc provides GoBeyond workload identity token access.
In a hosted slot, request-scoped tokens come from the trusted x-origens-oidc-token header. Background work uses the per-slot broker exposed through GOBEYOND_HOST_REPORT_SOCKET. Local and build environments may provide ORIGENS_OIDC_TOKEN or GOBEYOND_OIDC_TOKEN instead.
Index ¶
Constants ¶
const ( EnvTokenOrigens = "ORIGENS_OIDC_TOKEN" EnvTokenGoBeyond = "GOBEYOND_OIDC_TOKEN" EnvIssuerBase = "GOBEYOND_OIDC_ISSUER_BASE_URL" EnvHostReportSocket = "GOBEYOND_HOST_REPORT_SOCKET" HeaderOrigens = "x-origens-oidc-token" HeaderGoBeyond = "x-gobeyond-oidc-token" DefaultSourceAudience = "origens-platform" AWSTSAudience = "sts.amazonaws.com" )
Variables ¶
This section is empty.
Functions ¶
func ContextWithToken ¶
ContextWithToken attaches a token to a request/work item context. It is useful for GoBeyond handlers that have already extracted the trusted request header and then call a background helper in the same operation.
func FromRequest ¶
FromRequest returns the platform-injected token from an HTTP request.
func GetToken ¶
func GetToken() string
GetToken returns the local/build environment token, if configured.
func TokenExpiry ¶
TokenExpiry reads exp for cache/refresh decisions without treating the unsigned payload as an authentication decision.
func TokenFromContext ¶
TokenFromContext returns a token attached with ContextWithToken.
Types ¶
type TokenSource ¶
func (*TokenSource) Token ¶
func (s *TokenSource) Token(ctx context.Context, options TokenOptions) (string, error)
Token resolves a request, environment, or hosted-slot token and optionally exchanges it for a downstream audience.
func (*TokenSource) WebIdentityTokenForAWS ¶
func (s *TokenSource) WebIdentityTokenForAWS(ctx context.Context, request *http.Request) (string, error)
WebIdentityTokenForAWS returns an STS-compatible token for AWS web identity federation. The caller supplies it to AssumeRoleWithWebIdentity.
Source Files