Documentation
¶
Overview ¶
Package authn provides opt-in gRPC caller authentication, not authorization. The reference daemon does not install these interceptors.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Caller ¶
func Caller(ctx context.Context) (api.CallerIdentity, bool)
Caller returns the exact verified issuer/subject pair installed by an interceptor. Request identity fields and forwarded headers do not populate it.
func NewInterceptors ¶
func NewInterceptors(mode Mode, verifier CallerVerifier) (grpc.UnaryServerInterceptor, grpc.StreamServerInterceptor, error)
NewInterceptors constructs authentication for every RPC on a gRPC server, without method exemptions. Install them before interceptors that disclose data or perform effects; a panic-recovery interceptor may wrap them, since grpc-go does not recover verifier panics. Required needs a verifier; invalid modes fail here. Authentication alone is not isolation: handlers still need authorization and operators must assemble a trusted transport. Unary authentication is admission-only: credential expiry does not end an admitted call or remove its caller identity. Only stream contexts are bounded by credential expiry. Stream expiry is cooperative; it cannot undo effects or interrupt transport I/O already in progress.
Types ¶
type CallerVerifier ¶
type CallerVerifier interface {
Verify(context.Context) (VerifiedCaller, error)
}
CallerVerifier verifies incoming credentials from metadata or a verified TLS peer. Implementations must reject missing, malformed, duplicate and expired credentials, validate issuer/audience and signatures, and honor cancellation. Never discover trust configuration from untrusted issuer URLs. Adapters own failure logging and metrics, without credential material; interceptors return generic authentication errors and do not log or count verifier failures.
type VerifiedCaller ¶
type VerifiedCaller struct {
Identity api.CallerIdentity
ValidUntil time.Time
}
VerifiedCaller contains a verified identity and its credential expiry, never a bearer token, assertion or refresh credential.
Source Files