ociauth

package

v1.9.0 Latest Latest Go to latest Published: Oct 27, 2026 License: MIT Imports: 16 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/blackbirdworks/gopherstack

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ociauth parses and verifies OCI API request signatures (the draft-cavage HTTP Signatures scheme used by every OCI SDK).

Like the other cloud auth packages it is permissive by default: a request is only cryptographically checked when its keyId names an API key registered in the Registry. Unknown keys and unsigned requests pass unless the caller asks for enforcement.

Index ¶

Constants
Variables
func Fingerprint(pub *rsa.PublicKey) (string, error)
func ParsePublicKeyPEM(data string) (*rsa.PublicKey, error)
type KeyID
- func ParseKeyID(s string) (KeyID, bool)
- func (k KeyID) String() string
type KeyRecord
type Options
type Principal
- func Verify(r *http.Request, body []byte, opt Options) (Principal, error)
type Registry
- func NewRegistry() *Registry
type Signature
- func ParseAuthorization(h string) (Signature, error)

Constants ¶

View Source

const MaxClockSkew = 5 * time.Minute

MaxClockSkew is the largest date drift OCI accepts on a signed request.

Variables ¶

View Source

var (
	// ErrNotAuthenticated is returned for missing, malformed or invalid credentials.
	ErrNotAuthenticated = errors.New("ociauth: not authenticated")
	// ErrBadKey is returned when a public key cannot be parsed.
	ErrBadKey = errors.New("ociauth: invalid RSA public key")
)

Functions ¶

func Fingerprint ¶

func Fingerprint(pub *rsa.PublicKey) (string, error)

Fingerprint returns the colon-separated MD5 of the DER-encoded public key, the identifier OCI shows for an uploaded API key.

func ParsePublicKeyPEM ¶

func ParsePublicKeyPEM(data string) (*rsa.PublicKey, error)

ParsePublicKeyPEM accepts a PKIX "PUBLIC KEY" or PKCS#1 "RSA PUBLIC KEY" block.

Types ¶

type KeyID ¶

type KeyID struct {
	Tenancy     string
	User        string
	Fingerprint string
}

KeyID is the decomposed "<tenancy>/<user>/<fingerprint>" signature keyId.

func ParseKeyID ¶

func ParseKeyID(s string) (KeyID, bool)

ParseKeyID splits a keyId; instance/resource principals use other shapes and report false.

func (KeyID) String ¶

func (k KeyID) String() string

String renders the keyId form used on the wire.

type KeyRecord ¶

type KeyRecord struct {
	Tenancy   string `json:"tenancy"`
	User      string `json:"user"`
	PublicPEM string `json:"publicPem"`
}

KeyRecord is the persisted form of a registered API key.

type Options ¶

type Options struct {
	Registry *Registry
	Now      func() time.Time
	// Enforce rejects unsigned requests and signatures from keys not in the Registry.
	Enforce bool
}

Options tunes Verify.

type Principal ¶

type Principal struct {
	KeyID     KeyID
	Verified  bool
	Anonymous bool
}

Principal identifies the caller of a request.

func Verify ¶

func Verify(r *http.Request, body []byte, opt Options) (Principal, error)

Verify authenticates r. body must be the full request body (used to check a signed x-content-sha256).

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry holds the API keys the emulator verifies signatures against.

func NewRegistry ¶

func NewRegistry() *Registry

NewRegistry creates an empty registry.

func (*Registry) Link ¶

func (r *Registry) Link(other *Registry)

Link makes keys registered in other verifiable through r as well, so a registry owned by OCI Identity can serve every OCI service. Links must not form a cycle.

func (*Registry) Load ¶

func (r *Registry) Load(recs []KeyRecord)

Load replaces the registry contents with recs, skipping unparsable keys.

func (*Registry) Records ¶

func (r *Registry) Records() []KeyRecord

Records lists registered keys in a stable order.

func (*Registry) Register ¶

func (r *Registry) Register(tenancy, user, publicPEM string) (string, error)

Register adds an API key and returns its fingerprint.

func (*Registry) Remove ¶

func (r *Registry) Remove(keyID string) bool

Remove deletes the key registered under keyID and reports whether it existed.

func (*Registry) Reset ¶

func (r *Registry) Reset()

Reset drops every key.

type Signature ¶

type Signature struct {
	KeyID     string
	Algorithm string
	Version   string
	Headers   []string
	Signature []byte
}

Signature is a parsed Authorization header.

func ParseAuthorization ¶

func ParseAuthorization(h string) (Signature, error)

ParseAuthorization parses `Signature version="1",headers="...",keyId="...",algorithm="rsa-sha256",signature="..."`.

Source Files ¶

View all Source files

ociauth.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL