Documentation
¶
Overview ¶
Package oidcjwt verifies JWTs using OIDC discovery.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Claims ¶
type Claims struct {
// Claims from RFC7519
Issuer string
Subject string
Audiences []string
Expiration time.Time
NotBefore time.Time
IssuedAt time.Time
JTI string
KubernetesClaims
}
Claims contains standard JWT claims and, when present, Kubernetes ServiceAccount claims.
type KubernetesClaims ¶
type KubernetesClaims struct {
Namespace string
ServiceAccountName string
ServiceAccountUID string
PodName string
PodUID string
SecretName string
SecretUID string
NodeName string
NodeUID string
WarnAfter time.Time
}
KubernetesClaims contains claims added to Kubernetes ServiceAccount tokens.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier verifies JWTs from one trusted OIDC issuer and caches its signing keys. Keys are refreshed periodically and, at a bounded rate, when a token names an unknown key ID.
func NewVerifier ¶
NewVerifier returns a verifier for issuer. A token is accepted when at least one of its audiences matches audiences.
Click to show internal directories.
Click to hide internal directories.