Documentation
¶
Overview ¶
Package entra obtains Microsoft Entra ID (Azure AD) access tokens for app-only calls to Microsoft APIs such as Microsoft Graph.
A failed token request carries its form, client assertion included, in the error's HTTP context; services logging errors should mask the request bodies of TokenUrl's endpoints.
Index ¶
- Constants
- type Client
- func (c *Client) NewClientAssertionTokenSource(ctx context.Context, tenantId string, clientId string, scopes []string, ...) (token_source.TokenSource, error)
- func (c *Client) NewGoogleFederatedTokenSource(ctx context.Context, gcpClient *gcp.Client, tenantId string, clientId string, ...) (token_source.TokenSource, error)
- func (c *Client) TokenUrl(tenantId string) string
Constants ¶
const ( DefaultAuthorityHost = "login.microsoftonline.com" // FederatedAudience is the audience Entra requires of an external token // presented through a federated identity credential. FederatedAudience = "api://AzureADTokenExchange" // ScopeMicrosoftGraph requests the application permissions granted to the // app on Microsoft Graph; app-only tokens take only ".default" scopes. ScopeMicrosoftGraph = "https://graph.microsoft.com/.default" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func NewClient ¶
func NewClient(options ...entra_config.Option) *Client
func (*Client) NewClientAssertionTokenSource ¶
func (c *Client) NewClientAssertionTokenSource( ctx context.Context, tenantId string, clientId string, scopes []string, assertion client_assertion_token_source.AssertionFunc, ) (token_source.TokenSource, error)
NewClientAssertionTokenSource returns a caching token source for the app clientId in the tenant tenantId, authenticating with assertions from assertion.
func (*Client) NewGoogleFederatedTokenSource ¶
func (c *Client) NewGoogleFederatedTokenSource( ctx context.Context, gcpClient *gcp.Client, tenantId string, clientId string, scopes []string, ) (token_source.TokenSource, error)
NewGoogleFederatedTokenSource returns a caching token source that authenticates without a secret, presenting the ID token of the GCP runtime's service account. The app registration needs a federated identity credential with issuer https://accounts.google.com, the service account's numeric unique id as subject, and FederatedAudience as audience. A multi-tenant app uses the same credential in every tenant that has consented to it.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
types
|
|
|
token_source/client_assertion_token_source
Package client_assertion_token_source mints Microsoft Entra ID access tokens with the OAuth 2.0 client credentials grant, proving the application's identity with a JWT client assertion rather than a client secret.
|
Package client_assertion_token_source mints Microsoft Entra ID access tokens with the OAuth 2.0 client credentials grant, proving the application's identity with a JWT client assertion rather than a client secret. |