Documentation
¶
Overview ¶
Package mfa implements TOTP and WebAuthn multi-factor authentication.
Index ¶
- func ConfirmTOTP(ctx context.Context, st store.MFAStore, kp bcrypto.KeyProvider, ...) error
- func VerifyTOTP(ctx context.Context, st store.MFAStore, kp bcrypto.KeyProvider, ...) error
- type TOTPEnrollResponse
- type WAHandler
- func (h *WAHandler) BeginLogin(ctx context.Context, user *model.User) (optionsJSON []byte, sessionID uuid.UUID, err error)
- func (h *WAHandler) BeginRegistration(ctx context.Context, user *model.User) (optionsJSON []byte, sessionID uuid.UUID, err error)
- func (h *WAHandler) FinishLogin(ctx context.Context, user *model.User, sessionID uuid.UUID, r *http.Request) (amr string, err error)
- func (h *WAHandler) FinishRegistration(ctx context.Context, user *model.User, sessionID uuid.UUID, r *http.Request, ...) (*model.WebAuthnCredential, error)
- type WAUser
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type TOTPEnrollResponse ¶
type TOTPEnrollResponse struct {
CredentialID uuid.UUID `json:"credential_id"`
Secret string `json:"secret"` // base32, shown once for manual entry
OTPURI string `json:"otp_uri"` // otpauth:// URI for QR codes
}
TOTPEnrollResponse is returned when a user begins TOTP enrollment.
func EnrollTOTP ¶
func EnrollTOTP(ctx context.Context, st store.MFAStore, kp bcrypto.KeyProvider, user *model.User) (*TOTPEnrollResponse, error)
EnrollTOTP generates a new TOTP secret for the user and stores it (disabled until confirmed).
type WAHandler ¶
type WAHandler struct {
// contains filtered or unexported fields
}
WAHandler wraps the go-webauthn library and the store.
func NewWAHandler ¶
func NewWAHandler(rpID, rpDisplayName string, origins []string, st store.MFAStore) (*WAHandler, error)
NewWAHandler creates a WebAuthn handler.
func (*WAHandler) BeginLogin ¶
func (h *WAHandler) BeginLogin(ctx context.Context, user *model.User) (optionsJSON []byte, sessionID uuid.UUID, err error)
BeginLogin starts an assertion flow.
func (*WAHandler) BeginRegistration ¶
func (h *WAHandler) BeginRegistration(ctx context.Context, user *model.User) (optionsJSON []byte, sessionID uuid.UUID, err error)
BeginRegistration starts credential enrollment and returns challenge options + session ID.
func (*WAHandler) FinishLogin ¶
func (h *WAHandler) FinishLogin(ctx context.Context, user *model.User, sessionID uuid.UUID, r *http.Request) (amr string, err error)
FinishLogin verifies the assertion from the HTTP request body and updates sign count. Returns "hwk" as the AMR value (hardware key / platform authenticator).
type WAUser ¶
type WAUser struct {
// contains filtered or unexported fields
}
WAUser adapts model.User to the webauthn.User interface.
func (*WAUser) WebAuthnCredentials ¶
func (w *WAUser) WebAuthnCredentials() []webauthn.Credential
func (*WAUser) WebAuthnDisplayName ¶
func (*WAUser) WebAuthnID ¶
func (*WAUser) WebAuthnName ¶
Source Files
Click to show internal directories.
Click to hide internal directories.