Documentation
¶
Overview ¶
Package apiauthn authenticates clients of the ateapi gRPC server, and provides a matching client dial helper. The server interceptor takes identity from the transport-layer mTLS credentials when the client presented a certificate, and otherwise requires an authorization header `Bearer <JWT Token>`. Requests with no credentials are rejected.
Index ¶
- func StreamServerInterceptor(cfg ServerConfig) grpc.StreamServerInterceptor
- func UnaryServerInterceptor(cfg ServerConfig) grpc.UnaryServerInterceptor
- func ValidateAuthenticationConfig(cfg *AuthenticationConfig) error
- func ValidateServerConfig(cfg ServerConfig) error
- type AuthenticationConfig
- type JWTProvider
- type JWTProviderConfig
- type ServerConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func StreamServerInterceptor ¶
func StreamServerInterceptor(cfg ServerConfig) grpc.StreamServerInterceptor
StreamServerInterceptor returns a gRPC stream interceptor enforcing cfg.
func UnaryServerInterceptor ¶
func UnaryServerInterceptor(cfg ServerConfig) grpc.UnaryServerInterceptor
UnaryServerInterceptor returns a gRPC unary interceptor enforcing cfg.
func ValidateAuthenticationConfig ¶
func ValidateAuthenticationConfig(cfg *AuthenticationConfig) error
ValidateAuthenticationConfig validates fields that do not require I/O.
func ValidateServerConfig ¶
func ValidateServerConfig(cfg ServerConfig) error
Types ¶
type AuthenticationConfig ¶
type AuthenticationConfig struct {
ActorIdentityJWTProvider string `json:"actorIdentityJWTProvider"`
JWTProviders []JWTProviderConfig `json:"jwtProviders"`
}
AuthenticationConfig configures JWT authentication for ateapi.
func LoadAuthenticationConfig ¶
func LoadAuthenticationConfig(path string) (*AuthenticationConfig, error)
LoadAuthenticationConfig strictly parses and validates a YAML or JSON file.
type JWTProvider ¶
type JWTProvider struct {
Name string
Issuer string
Verify func(context.Context, string) (string, error)
}
JWTProvider verifies bearer tokens from one trusted issuer.
type JWTProviderConfig ¶
type JWTProviderConfig struct {
Name string `json:"name"`
Issuer string `json:"issuer"`
Audiences []string `json:"audiences"`
CertificateAuthorityFile string `json:"certificateAuthorityFile,omitempty"`
DiscoveryTokenFile string `json:"discoveryTokenFile,omitempty"`
}
JWTProviderConfig configures one trusted OIDC issuer.
type ServerConfig ¶
type ServerConfig struct {
// JWTProviders authenticate clients that did not present a certificate
// identity (e.g. kubectl-ate).
JWTProviders []JWTProvider
}
ServerConfig configures the server-side auth interceptor.
Source Files