Documentation
¶
Overview ¶
Package aadauth provides a shared, dependency-light emulation of Azure AD (Microsoft Entra ID)'s client-credentials OAuth2 flow: an RSA-signed JWT issuer, JWKS publication, and the two AAD instance/authority discovery documents (openid-configuration and /common/discovery/instance).
It is modeled on services/cognitoidp/tokens.go -- the existing precedent in this repo for "issue structurally-valid OAuth2/JWT tokens without real cryptographic trust" -- but deliberately NOT imported from there: Cognito's tokenIssuer is unexported and coupled to Cognito's own UserPoolClient/clientTokenSettings types, so it can't be reused as-is, and this package's shape (AAD claims: iss/aud/appid/tid/oid/sub/ver, not Cognito's cognito:username/token_use) is different enough that sharing code would mean threading AAD-specific special cases through Cognito's file instead of owning a small, purpose-built package. See AZURE.md section 10.5.
services/azurearm is the first consumer (M7); services/keyvault (M11) is expected to reuse it for its own dev-mode bearer-token auth.
Index ¶
- Constants
- Variables
- type ClientCredentialsClaims
- type InstanceDiscoveryMetadata
- type InstanceDiscoveryResponse
- type Issuer
- func (iss *Issuer) IssueClientCredentialsToken(claims ClientCredentialsClaims, expirySeconds int) (string, error)
- func (iss *Issuer) JWKS() JWKSResponse
- func (iss *Issuer) KeyID() string
- func (iss *Issuer) Parse(tokenString string) (jwt.MapClaims, error)
- func (iss *Issuer) PublicKeyForKID(kid string) (*rsa.PublicKey, bool)
- func (iss *Issuer) Validate(tokenString, wantAudience, wantTenant string) (jwt.MapClaims, error)
- type JWK
- type JWKSResponse
- type OpenIDConfiguration
Constants ¶
const DefaultTokenExpirySeconds = 3599
DefaultTokenExpirySeconds is the lifetime, in seconds, of an issued access token -- matching the real AAD v2.0 client-credentials response's typical expires_in of 3599/3600 closely enough for SDK token-cache logic that only checks "is this expired soon.".
Variables ¶
var ErrInvalidToken = errors.New("aadauth: invalid token")
ErrInvalidToken is returned by Parse/Validate when a token is malformed, expired, or fails signature verification.
Functions ¶
This section is empty.
Types ¶
type ClientCredentialsClaims ¶
type ClientCredentialsClaims struct {
Issuer string // https://<host>/<tenant>/v2.0
Audience string // requested scope's resource, e.g. https://management.azure.com
TenantID string
ClientID string // becomes both "appid" and "oid"/"sub" (a service principal has no separate user)
}
ClientCredentialsClaims are the AAD v2.0-shaped claims this package stamps into every issued token (AZURE.md section 10.5's claim list).
type InstanceDiscoveryMetadata ¶
type InstanceDiscoveryMetadata struct {
PreferredNetwork string `json:"preferred_network"`
PreferredCache string `json:"preferred_cache"`
Aliases []string `json:"aliases"`
}
InstanceDiscoveryMetadata is one entry of InstanceDiscoveryResponse's "metadata" array, describing the aliases for a single AAD cloud instance.
type InstanceDiscoveryResponse ¶
type InstanceDiscoveryResponse struct {
TenantDiscoveryEndpoint string `json:"tenant_discovery_endpoint"`
Metadata []InstanceDiscoveryMetadata `json:"metadata"`
}
InstanceDiscoveryResponse is the document served from /common/discovery/instance?api-version=1.1.
func BuildInstanceDiscoveryResponse ¶
func BuildInstanceDiscoveryResponse(baseURL, tenant string) InstanceDiscoveryResponse
BuildInstanceDiscoveryResponse builds the InstanceDiscoveryResponse document for host (e.g. "host:10006", no scheme) and tenant.
type Issuer ¶
type Issuer struct {
// contains filtered or unexported fields
}
Issuer generates and signs AAD-shaped client-credentials JWTs for a single tenant, and publishes the corresponding JWKS. One Issuer is created per running service instance (see services/azurearm/token.go); its RSA keypair is generated once at startup and is not persisted across restarts -- tokens issued before a restart no longer validate against the new key, which is acceptable because validation itself is opt-in and off by default (AZURE.md section 10.5).
func (*Issuer) IssueClientCredentialsToken ¶
func (iss *Issuer) IssueClientCredentialsToken(claims ClientCredentialsClaims, expirySeconds int) (string, error)
IssueClientCredentialsToken signs and returns an AAD-shaped access token for the client-credentials grant. expirySeconds <= 0 uses DefaultTokenExpirySeconds.
func (*Issuer) JWKS ¶
func (iss *Issuer) JWKS() JWKSResponse
JWKS returns the JSON Web Key Set for this issuer.
func (*Issuer) Parse ¶
Parse parses and cryptographically validates tokenString against iss's public key, returning its claims. Used only when a caller opts into signature verification (e.g. services/azurearm's --azure-arm-validate-tokens); by default ARM accepts any bearer token (or none) without calling this.
func (*Issuer) PublicKeyForKID ¶
PublicKeyForKID returns the RSA public key if kid matches this issuer's key ID.
type JWK ¶
type JWK struct {
Kty string `json:"kty,omitempty"`
N string `json:"n,omitempty"`
E string `json:"e,omitempty"`
Kid string `json:"kid,omitempty"`
Use string `json:"use,omitempty"`
Alg string `json:"alg,omitempty"`
}
JWK represents a single JSON Web Key.
type JWKSResponse ¶
type JWKSResponse struct {
Keys []JWK `json:"keys,omitempty"`
}
JWKSResponse is the JSON Web Key Set document shape served from /{tenant}/discovery/v2.0/keys.
type OpenIDConfiguration ¶
type OpenIDConfiguration struct {
Issuer string `json:"issuer"`
AuthorizationEndpoint string `json:"authorization_endpoint"`
TokenEndpoint string `json:"token_endpoint"`
JWKSURI string `json:"jwks_uri"`
ResponseTypesSupp []string `json:"response_types_supported"`
SubjectTypesSupp []string `json:"subject_types_supported"`
IDTokenSigningAlgs []string `json:"id_token_signing_alg_values_supported"`
TokenEndpointAuthMeth []string `json:"token_endpoint_auth_methods_supported"`
}
OpenIDConfiguration is the document served from /{tenant}/v2.0/.well-known/openid-configuration -- azidentity/go-azure-sdk fetch this during AAD instance/authority discovery before requesting a token (AZURE.md section 10.1).
func BuildOpenIDConfiguration ¶
func BuildOpenIDConfiguration(baseURL, tenant string) OpenIDConfiguration
BuildOpenIDConfiguration builds the OpenIDConfiguration document for tenant, rooted at baseURL (e.g. "https://host:10006").
Source Files