security

type AuthMethod string

type Authenticator struct {
	// contains filtered or unexported fields
}

type CEDARTLSConnection struct {
	// contains filtered or unexported fields
}

type ClaimID struct {
	// contains filtered or unexported fields
}

type CryptoMethod string

type InheritedSession struct {
	// Type indicates whether this is a normal or family session
	Type InheritedSessionType

	// SessionID is the unique identifier for this session
	SessionID string

	// SessionInfo contains exported session attributes (ClassAd format)
	SessionInfo string

	// SessionKey is the raw key material for this session
	SessionKey string

	// ParentAddr is the sinful string of the parent daemon (from CONDOR_INHERIT)
	ParentAddr string

	// ParentPID is the process ID of the parent daemon
	ParentPID int
}

type InheritedSessionType int

type JWK struct {
	Kty string `json:"kty"`           // Key type (RSA, EC, etc.)
	Kid string `json:"kid"`           // Key ID
	Use string `json:"use"`           // Key use (sig, enc)
	Alg string `json:"alg"`           // Algorithm
	N   string `json:"n,omitempty"`   // RSA modulus
	E   string `json:"e,omitempty"`   // RSA exponent
	X   string `json:"x,omitempty"`   // EC X coordinate
	Y   string `json:"y,omitempty"`   // EC Y coordinate
	Crv string `json:"crv,omitempty"` // EC curve name
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type KeyInfo struct {
	Data     []byte
	Protocol string // "AESGCM", "BLOWFISH", "3DES", etc.
}

type OIDCConfiguration struct {
	Issuer  string `json:"issuer"`
	JWKSURI string `json:"jwks_uri"`
}

type SSLAuthenticator struct {
	// contains filtered or unexported fields
}

type SciTokenClaims struct {
	Subject   string   `json:"sub"`
	Issuer    string   `json:"iss"`
	Scope     string   `json:"scope,omitempty"`
	Audience  []string `json:"aud,omitempty"`
	ExpiresAt int64    `json:"exp"`
	IssuedAt  int64    `json:"iat"`
	NotBefore int64    `json:"nbf,omitempty"`
	JWTID     string   `json:"jti,omitempty"`
	jwt.RegisteredClaims
}

type SecurityConfig struct {
	// Peer name; used by client to recall the server name
	PeerName string

	// Authentication settings
	AuthMethods    []AuthMethod
	Authentication SecurityLevel

	// Encryption settings
	CryptoMethods []CryptoMethod
	Encryption    SecurityLevel
	Integrity     SecurityLevel

	// Certificate/Key files for SSL
	CertFile string
	KeyFile  string
	CAFile   string
	// Server name for SSL certificate verification (optional, defaults to hostname)
	ServerName string

	// Token content for TOKEN authentication (JWT string)
	Token string
	// Token file for TOKEN authentication
	TokenFile string
	// Token directory for discovering multiple tokens (default: ~/.condor/tokens.d)
	TokenDir string

	// Token signing key configuration (server-side)
	// Path to pool signing key file (SEC_TOKEN_POOL_SIGNING_KEY_FILE)
	TokenPoolSigningKeyFile string
	// Directory containing named signing keys (SEC_PASSWORD_DIRECTORY)
	TokenSigningKeyDir string
	// Maximum token age in seconds (SEC_TOKEN_MAX_AGE)
	TokenMaxAge int
	// List of issuer key names accepted by server (from IssuerKeys ClassAd attribute)
	IssuerKeys []string

	// Other settings
	RemoteVersion   string
	TrustDomain     string
	Subsystem       string
	ServerPid       int
	SessionDuration int
	SessionLease    int

	// Command for this session (what the client intends to do)
	Command int

	// AuthCommand specifies a sub-command for the security handshake (optional)
	// For example, when Command is DC_SEC_QUERY (60040), AuthCommand might be
	// DC_NOP_WRITE (60021) to specify the actual operation being authorized.
	// If not set (0), only Command will be sent in the handshake.
	AuthCommand int

	// ECDH key exchange
	ECDHPublicKey string

	// Security tag; used to select specific credentials from the
	// session cache
	SecurityTag string

	// Session cache (optional, if provided will be used instead of global cache)
	SessionCache *SessionCache
}

type SecurityLevel string

type SecurityManager struct {
	// contains filtered or unexported fields
}

type SecurityNegotiation struct {
	Command          int
	ClientConfig     *SecurityConfig
	ServerConfig     *SecurityConfig
	NegotiatedAuth   AuthMethod
	NegotiatedCrypto CryptoMethod

	Enact          bool
	Authentication bool
	Encryption     bool
	IsClient       bool
	SessionResumed bool // Indicates if this session was resumed from cache
	// Session information from post-auth ClassAd
	SessionId     string
	User          string
	ValidCommands string
	// contains filtered or unexported fields
}

type SessionCache struct {
	// contains filtered or unexported fields
}

type SessionEntry struct {
	// contains filtered or unexported fields
}

type SessionResumptionError struct {
	SessionID string
	Reason    string
}

type TokenAuthData struct {
	ClientID    string // Client identity (username@domain or token subject)
	ServerID    string // Server identity
	RA          []byte // Client random nonce
	RB          []byte // Server random nonce
	Token       string // JWT token (header.payload)
	Signature   []byte // JWT signature (used as shared key)
	SharedKey   []byte // Derived shared key K
	SharedKeyK  []byte // HMAC key K
	SharedKeyKP []byte // Key derivation key K'
	SessionKey  []byte // Final session key W = h'K'(RB)
	State       TokenAuthState
	// Error handling for graceful handshake completion
	AuthError   error // Stored authentication error
	ErrorStatus int   // AUTH_PW status to send (AUTH_PW_A_OK or AUTH_PW_ERROR)
}

type TokenAuthState int