localjwtauthority

type Authority ¶

type Authority struct {
	ID         string
	Algorithm  string
	SigningKey crypto.Signer
}

func GenerateECDSAP256Authority(id string) (*Authority, error)

type ConcretePool ¶ added in v0.1.0

type ConcretePool struct {
	Authorities []*Authority
	// Which authority is active for signing?
	ActiveForSigning string
}

func Unmarshal(wireBytes []byte) (*ConcretePool, error)

func (p *ConcretePool) SignJWT(claims *actoridjwt.Claims) (string, error)

func (p *ConcretePool) VerificationKeys() ([]*VerificationKey, error)

type Pool ¶

type Pool interface {
	// SignJWT signs a JWT with the given claims.
	SignJWT(*actoridjwt.Claims) (string, error)

	// VerificationKeys returns the verification key set of this pool, for
	// exporting via OpenID Connect Discovery.
	VerificationKeys() ([]*VerificationKey, error)
}

Pool is the interface for a JWT signing pool.

Logically, a Pool is a collection of multiple authorities. One or more are designated as active for signing. The rest are inactive, but are still trusted for verifying JWTs.

The active/inactive designation allows a Pool to be seamlessly rotated.

Normally, we let callers define their own compatibility interfaces. But in most cases you'll want to either use a RefreshingPool (for controllers and servers), or a ConcretePool (for CLIs and tests).

type RefreshingPool ¶ added in v0.1.0

type RefreshingPool struct {
	// contains filtered or unexported fields
}

RefreshingPool is a wrapper around ConcretePool that periodically reloads the state from disk. This allows JWT signing and verification to continue working seamlessly even as an administrator rotates the pool, without requiring any components to restart.

func NewRefreshingPool(stateFile string) (*RefreshingPool, error)

func (p *RefreshingPool) SignJWT(claims *actoridjwt.Claims) (string, error)

func (p *RefreshingPool) VerificationKeys() ([]*VerificationKey, error)

type VerificationKey ¶ added in v0.1.0

type VerificationKey struct {
	KeyID     string
	PublicKey crypto.PublicKey
}