Documentation
¶
Overview ¶
Package localjwtauthority implements a simple "CA" for JWTs.
Index ¶
- func GeneratePool(algorithm, id string) ([]byte, string, error)
- func JWKS(keys []*VerificationKey) ([]byte, error)
- func Marshal(pool *ConcretePool) ([]byte, error)
- func Thumbprint(pub crypto.PublicKey) (string, error)
- type Authority
- type ConcretePool
- func (p *ConcretePool) Activate(id string) error
- func (p *ConcretePool) ActiveID() string
- func (p *ConcretePool) AddAuthority(authority *Authority) error
- func (p *ConcretePool) RemoveAuthority(id string) error
- func (p *ConcretePool) SignJWT(claims *actoridjwt.Claims) (string, error)
- func (p *ConcretePool) VerificationKeys() ([]*VerificationKey, error)
- type Pool
- type RefreshingPool
- type VerificationKey
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GeneratePool ¶ added in v0.4.0
GeneratePool generates a pool holding one authority, active for signing, and returns the serialized pool and the authority's ID. algorithm and id are as for GenerateAuthority.
func JWKS ¶ added in v0.5.0
func JWKS(keys []*VerificationKey) ([]byte, error)
JWKS returns the JWK set, as JSON, that publishes keys for signature verification, sorted by key ID. Each key's algorithm must fit its type: ES256 for a P-256 EC key, or RS256, RS384, or RS512 for an RSA key.
Types ¶
type Authority ¶
func GenerateAuthority ¶ added in v0.4.0
GenerateAuthority generates a JWT signing key for algorithm, which must be RS256 or ES256. An empty id defaults to the Thumbprint of the public key.
type ConcretePool ¶ added in v0.1.0
type ConcretePool struct {
Authorities []*Authority
// Which authority is active for signing?
ActiveForSigning string
}
func Unmarshal ¶
func Unmarshal(wireBytes []byte) (*ConcretePool, error)
Unmarshal loads a Pool from JSON.
func (*ConcretePool) Activate ¶ added in v0.5.0
func (p *ConcretePool) Activate(id string) error
Activate makes the authority with id the one that signs.
func (*ConcretePool) ActiveID ¶ added in v0.5.0
func (p *ConcretePool) ActiveID() string
ActiveID returns the ID of the authority that signs: ActiveForSigning, or the first authority's when none is designated.
func (*ConcretePool) AddAuthority ¶ added in v0.5.0
func (p *ConcretePool) AddAuthority(authority *Authority) error
AddAuthority adds authority to the pool without activating it, so relying parties can learn its key before it signs anything.
func (*ConcretePool) RemoveAuthority ¶ added in v0.5.0
func (p *ConcretePool) RemoveAuthority(id string) error
RemoveAuthority removes the authority with id, which must not be the one that signs.
func (*ConcretePool) SignJWT ¶ added in v0.1.0
func (p *ConcretePool) SignJWT(claims *actoridjwt.Claims) (string, error)
func (*ConcretePool) VerificationKeys ¶ added in v0.1.0
func (p *ConcretePool) VerificationKeys() ([]*VerificationKey, error)
type Pool ¶
type Pool interface {
// SignJWT signs a JWT with the given claims.
SignJWT(*actoridjwt.Claims) (string, error)
// VerificationKeys returns the verification key set of this pool, for
// exporting via OpenID Connect Discovery.
VerificationKeys() ([]*VerificationKey, error)
}
Pool is the interface for a JWT signing pool.
Logically, a Pool is a collection of multiple authorities. One or more are designated as active for signing. The rest are inactive, but are still trusted for verifying JWTs.
The active/inactive designation allows a Pool to be seamlessly rotated.
Normally, we let callers define their own compatibility interfaces. But in most cases you'll want to either use a RefreshingPool (for controllers and servers), or a ConcretePool (for CLIs and tests).
type RefreshingPool ¶ added in v0.1.0
type RefreshingPool struct {
// contains filtered or unexported fields
}
RefreshingPool is a wrapper around ConcretePool that periodically reloads the state from disk. This allows JWT signing and verification to continue working seamlessly even as an administrator rotates the pool, without requiring any components to restart.
func NewRefreshingPool ¶ added in v0.1.0
func NewRefreshingPool(stateFile string) (*RefreshingPool, error)
func (*RefreshingPool) SignJWT ¶ added in v0.1.0
func (p *RefreshingPool) SignJWT(claims *actoridjwt.Claims) (string, error)
func (*RefreshingPool) VerificationKeys ¶ added in v0.1.0
func (p *RefreshingPool) VerificationKeys() ([]*VerificationKey, error)
Source Files