Documentation
¶
Overview ¶
Package id_token_request_parser admits a caller that presents a Google-issued ID token minted for this service by a service account it names.
It is what gates an endpoint a Google product calls: Cloud Scheduler, Pub/Sub push, Cloud Tasks, Eventarc. All of them authenticate the same way -- an OIDC token in the Authorization header -- so all of them are admitted by the same check, and a service that had written its own would have written this.
Three things are checked, and each is load-bearing. That Google signed it, which is what the published keys establish. That it was minted for this service, because a token minted for another would otherwise be accepted here. And that the caller is one this service admits, because any Google account can mint a token for a public endpoint -- the audience says a token was meant for this service, not that whoever sent it is entitled to call it.
It lives beside the rest of the Google client rather than beside the other request parsers because what it encodes is Google's: the two spellings of the issuer, where the keys are published, and which claims carry the caller. It is a package of its own so that importing the Google client does not drag in the HTTP machinery.
Index ¶
Constants ¶
const JwkUrlString = "https://www.googleapis.com/oauth2/v3/certs"
JwkUrlString is where the keys Google signs its ID tokens with are published.
Variables ¶
This section is empty.
Functions ¶
func MakeClaimsValidator ¶
func MakeClaimsValidator(audience string, serviceAccountEmails []string) validator.Validator[map[string]any]
MakeClaimsValidator validates the claims of a Google ID token: not expired, Google as the issuer, this service as the audience, and one of the named service accounts as the verified caller.
func New ¶
func New(options ...id_token_request_parser_config.Option) (request_parser.RequestParser[any], error)
New makes the request parser.
An audience and at least one service account are required rather than defaulted: a parser missing either would admit far more than the caller meant, and there is no safe guess for either.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package id_token_request_parser_config holds the settings of a Google ID token request parser.
|
Package id_token_request_parser_config holds the settings of a Google ID token request parser. |