Documentation
¶
Index ¶
Constants ¶
const (
// JWKSURI is the URI for the JWKS endpoint.
JWKSURI = "/.well-known/jwks.json"
)
Variables ¶
ErrUnauthorized is returned by TokenValidator implementations when the presented credential is missing, malformed, or does not authenticate for the requested network.
Functions ¶
func NewJWKSHandler ¶
func NewJWKSHandler(publicKeyPEM []byte) (http.HandlerFunc, error)
NewJWKSHandler creates a new HTTP handler that serves the JWK Set for the given public key.
Types ¶
type AuthzResult ¶
type AuthzResult struct {
// Network is the network (tunnel name) the credential is bound to.
Network string
// Scope is an opaque tenant scope the credential resolved to (e.g. a
// project ID on a relay serving many tenants whose network names may
// collide). Empty for single-tenant validators. The relay carries it
// onto the connection so multi-tenant callbacks can route by it; it
// never appears on the wire.
Scope string
// AllowedLabelSets bounds the labels an agent may declare. Empty means
// unbounded. A declared label map is permitted iff it is a subset of at
// least one set.
AllowedLabelSets []map[string]string
// AllowedRoutes bounds the CIDRs an agent may advertise. Empty means
// unbounded. A route is permitted iff it is contained within at least one
// allowed prefix.
AllowedRoutes []netip.Prefix
}
AuthzResult is what a validated credential authorizes.
func (*AuthzResult) PermitsLabels ¶
func (a *AuthzResult) PermitsLabels(labels map[string]string) bool
PermitsLabels reports whether the credential permits declaring the given labels: the declared map must be a subset of at least one allowed set. An empty AllowedLabelSets list permits everything.
func (*AuthzResult) PermitsRoute ¶
func (a *AuthzResult) PermitsRoute(route netip.Prefix) bool
PermitsRoute reports whether the credential permits advertising the given route. An empty AllowedRoutes list permits everything.
type Claims ¶
type Claims struct {
jwt.RegisteredClaims
// Net is the network (tunnel name) the credential is bound to.
Net string `json:"net"`
// AllowedLabelSets bounds the labels an agent may declare. Empty means
// unbounded.
AllowedLabelSets []map[string]string `json:"allowedLabelSets,omitempty"`
// AllowedRoutes bounds the CIDRs an agent may advertise. Empty means
// unbounded.
AllowedRoutes []string `json:"allowedRoutes,omitempty"`
}
Claims is the tunnel credential claim shape: the issuer identifies the project (and thus the JWKS endpoint), the audience identifies the relay deployment, and the net claim binds the credential to a single network. The optional allowed-label-sets and allowed-routes claims bound what the credential may declare at connect time.
type InMemoryValidator ¶
type InMemoryValidator struct {
// contains filtered or unexported fields
}
InMemoryValidator validates JWT tokens signed with an ECDSA public key. It implements the Validator interface.
func NewInMemoryValidator ¶
func NewInMemoryValidator(publicKeyPEM []byte) (*InMemoryValidator, error)
NewInMemoryValidator creates a new Validator with the public key.
func (*InMemoryValidator) PublicKeyPEM ¶
func (v *InMemoryValidator) PublicKeyPEM() []byte
PublicKeyPEM returns the PEM-encoded public key used for validation.
type Issuer ¶
type Issuer struct {
// contains filtered or unexported fields
}
Issuer implements TokenIssuer for issuing JWT tokens.
type JWTValidator ¶
type JWTValidator interface {
// Validate validates the token and returns its claims.
Validate(tokenStr string) (jwt.Claims, error)
}
JWTValidator validates JWT tokens.
type MultiTenantValidator ¶
type MultiTenantValidator struct {
// contains filtered or unexported fields
}
MultiTenantValidator validates per-network JWTs by extracting the issuer (iss) claim and fetching JWKS from the appropriate per-project endpoint. It implements the TokenValidator interface.
func NewMultiTenantValidator ¶
func NewMultiTenantValidator(jwksURLFormat, audience string) *MultiTenantValidator
NewMultiTenantValidator creates a new multi-tenant JWT validator. The jwksURLFormat should contain a %s placeholder for the issuer; audience is the relay audience presented credentials must carry.
func (*MultiTenantValidator) Close ¶
func (v *MultiTenantValidator) Close()
Close stops the background JWKS refresh for all cached issuers.
func (*MultiTenantValidator) RemoveIssuer ¶
func (v *MultiTenantValidator) RemoveIssuer(issuer string)
RemoveIssuer removes a cached keyfunc for an issuer, forcing a refresh on next validation.
func (*MultiTenantValidator) Validate ¶
func (v *MultiTenantValidator) Validate(_ context.Context, network, tokenStr string) (*AuthzResult, error)
Validate validates the JWT for the given network and returns the resulting authorization. The credential must be an ES256 JWT with a required expiration, carry the validator's audience, and its net claim must match the requested network.
type RemoteValidator ¶
type RemoteValidator struct {
// contains filtered or unexported fields
}
func NewRemoteValidator ¶
func NewRemoteValidator(ctx context.Context, urls []string) (*RemoteValidator, error)
NewRemoteValidator creates a new Validator with the public key.
type StaticTokenValidator ¶
type StaticTokenValidator struct {
// contains filtered or unexported fields
}
StaticTokenValidator authorizes agents by comparing the presented token against a per-network static bearer token. Matching credentials are unbounded: any labels and routes may be declared.
func NewStaticTokenValidator ¶
func NewStaticTokenValidator() *StaticTokenValidator
NewStaticTokenValidator creates an empty static per-network token validator.
func (*StaticTokenValidator) RemoveToken ¶
func (v *StaticTokenValidator) RemoveToken(network string)
RemoveToken removes the bearer token for a network.
func (*StaticTokenValidator) SetToken ¶
func (v *StaticTokenValidator) SetToken(network, token string)
SetToken sets the bearer token for a network.
func (*StaticTokenValidator) Validate ¶
func (v *StaticTokenValidator) Validate(_ context.Context, network, tokenStr string) (*AuthzResult, error)
Validate compares the presented token against the network's stored token.
type TokenIssuer ¶
type TokenIssuer interface {
IssueToken(subject string, ttl time.Duration) (string, jwt.Claims, error)
}
TokenIssuer is an interface for issuing JWT tokens.
type TokenValidator ¶
type TokenValidator interface {
// Validate authenticates tokenStr for the given network (tunnel name) and
// returns the resulting authorization, or an error if the credential does
// not authenticate.
Validate(ctx context.Context, network, tokenStr string) (*AuthzResult, error)
}
TokenValidator authenticates a tunnel credential presented for a network and returns what it authorizes.
type Validator ¶
type Validator interface {
JWTValidator
// PublicKeyPEM returns the PEM-encoded public key used for validation.
PublicKeyPEM() []byte
}
Validator extends JWTValidator with the ability to retrieve the public key. Use this interface when you need to serve JWKS endpoints locally. For remote validation (e.g., RemoteValidator), use JWTValidator instead.
Source Files