Documentation
¶
Overview ¶
Package auth is the identity port: who is making this request, and may they do what they are asking. The engine never sees a credential; it sees a Principal, which the HTTP layer puts on the context after an Authenticator has produced one. Authorization is a second port, so a deployment can plug in a policy without touching authentication.
The shape follows Kubernetes: an authenticator chain turns a request into a subject with groups (here Roles), and an authorizer decides on (subject, verb, resource). Cartograph ships the no-identity adapters an unauthenticated single-operator deployment needs; a deployment that puts Cartograph behind an authenticating proxy, or wires an OIDC provider, adds an Authenticator and keeps everything else.
Index ¶
- Constants
- Variables
- func Authorize(z Authorizer, next http.Handler) http.Handler
- func Middleware(a Authenticator, next http.Handler) http.Handler
- func WithPrincipal(ctx context.Context, p Principal) context.Context
- type Action
- type AllowAll
- type Authenticator
- type Authorizer
- type NoAuthentication
- type Principal
Constants ¶
const ( VerbRead = "read" VerbWrite = "write" )
Verbs an Action carries. Read is any safe method; Write is the rest.
Variables ¶
var Anonymous = Principal{Subject: "", Anonymous: true}
Anonymous is the principal of a request nobody identified.
var ErrForbidden = errors.New("forbidden")
ErrForbidden is returned by an Authorizer that refuses an action.
var ErrUnauthenticated = errors.New("unauthenticated")
ErrUnauthenticated is returned by an Authenticator that requires a credential and found none, or a bad one.
Functions ¶
func Authorize ¶
func Authorize(z Authorizer, next http.Handler) http.Handler
Authorize is the one enforcement point: every request through the API is classified and put to the Authorizer, after the Authenticator has put a principal on the context. A refusal is 403 with the contract's problem shape; the handler never runs.
func Middleware ¶
func Middleware(a Authenticator, next http.Handler) http.Handler
Middleware runs a on every request and puts the principal on the context. A request the authenticator refuses gets 401 and never reaches the handler.
Types ¶
type Action ¶
type Action struct {
// Verb is read or write (the HTTP method's intent).
Verb string
// Kind and ID name the manifest, when the action concerns one.
Kind string
ID string
}
Action is one thing a principal asks to do.
type Authenticator ¶
Authenticator turns a request into a Principal. Return Anonymous for a request that carries no identity when that is allowed; return ErrUnauthenticated to refuse it.
type Authorizer ¶
Authorizer decides whether a principal may perform an action.
type NoAuthentication ¶
type NoAuthentication struct{}
NoAuthentication identifies nobody: every request is Anonymous. The default for a single-operator deployment on a trusted network.
func (NoAuthentication) Authenticate ¶
func (NoAuthentication) Authenticate(*http.Request) (Principal, error)
Authenticate returns Anonymous.
type Principal ¶
type Principal struct {
// Subject is the stable identifier, what a version's Actor records.
Subject string
// Name is for display. Falls back to Subject.
Name string
// Roles are the groups the principal belongs to, for an Authorizer.
Roles []string
// Anonymous is true when no authenticator identified anyone.
Anonymous bool
}
Principal is who a request runs as.
func PrincipalFrom ¶
PrincipalFrom returns the principal on ctx, or Anonymous.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.
|
Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header. |
|
Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused.
|
Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused. |