Documentation
¶
Index ¶
- Constants
- Variables
- type API
- type AuthMiddleware
- type AuthorizerInterface
- type ClientInterface
- type ConsentRequestSessionData
- type DatabaseInterface
- type DefaultSession
- type HookContext
- type IDTokenClaims
- type Request
- type Service
- func (s *Service) AuthorizeRequest(ctx context.Context, user User, req TokenHookRequest, groups []*types.Group) (bool, error)
- func (s *Service) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)
- func (s *Service) ProcessRequest(ctx context.Context, user User, req TokenHookRequest) (*HookContext, error)
- type ServiceInterface
- type Session
- type StorageHookGroupsClient
- type TenantValidatorInterface
- type TokenHookRequest
- type TokenHookResponse
- type User
Constants ¶
const ( GrantTypeClientCredentials string = "client_credentials" GrantTypeJWTBearer string = "urn:ietf:params:oauth:grant-type:jwt-bearer" )
Variables ¶
var ErrTooBusy = errors.New("worker pool is full")
ErrTooBusy is returned by ProcessRequest when the worker pool queue is full.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API struct {
// contains filtered or unexported fields
}
func NewAPI ¶
func NewAPI( service ServiceInterface, middleware *AuthMiddleware, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface, ) *API
NewAPI creates a new API handler for the Hydra token hook endpoint.
func (*API) RegisterEndpoints ¶
RegisterEndpoints registers the Hydra token hook endpoint on the given router.
type AuthMiddleware ¶
type AuthMiddleware struct {
// contains filtered or unexported fields
}
func NewAuthMiddleware ¶
func NewAuthMiddleware(token string, tracer tracing.TracingInterface, logger logging.LoggerInterface) *AuthMiddleware
func (*AuthMiddleware) AuthMiddleware ¶
func (m *AuthMiddleware) AuthMiddleware(next http.Handler) http.Handler
type AuthorizerInterface ¶ added in v1.0.2
type ClientInterface ¶
type ConsentRequestSessionData ¶ added in v1.4.1
type ConsentRequestSessionData struct {
AccessToken map[string]interface{} `json:"access_token"`
IDToken map[string]interface{} `json:"id_token"`
}
ConsentRequestSessionData contains the enriched session claims for access and ID tokens.
type DatabaseInterface ¶ added in v1.0.2
type DefaultSession ¶ added in v1.4.1
type DefaultSession struct {
Subject string `json:"subject"`
Claims *IDTokenClaims `json:"id_token_claims"`
}
DefaultSession represents OpenID Connect session data.
func (*DefaultSession) IDTokenClaims ¶ added in v1.4.1
func (d *DefaultSession) IDTokenClaims() *IDTokenClaims
IDTokenClaims returns the claims pointer, initializing it if nil.
type HookContext ¶ added in v1.3.0
type HookContext struct {
// Groups is the list of groups the user belongs to.
Groups []*types.Group
// TenantID is the tenant the request is scoped to, or empty if none.
TenantID string
}
HookContext contains the enriched result of processing an OAuth token hook request. It is returned by ProcessRequest on success.
type IDTokenClaims ¶ added in v1.4.1
type IDTokenClaims struct {
Subject string `json:"sub,omitempty"`
Issuer string `json:"iss,omitempty"`
Audience []string `json:"aud,omitempty"`
JTI string `json:"jti,omitempty"`
Extra map[string]interface{} `json:"ext,omitempty"`
}
IDTokenClaims represents the claims inside an ID token.
func (*IDTokenClaims) ToMap ¶ added in v1.4.1
func (c *IDTokenClaims) ToMap() map[string]interface{}
ToMap returns a map representation of the ID token claims for inclusion in token session.
func (*IDTokenClaims) UnmarshalJSON ¶ added in v1.4.1
func (c *IDTokenClaims) UnmarshalJSON(data []byte) error
UnmarshalJSON implements json.Unmarshaler to handle both "ext" and "extra" keys.
type Request ¶ added in v1.4.1
type Request struct {
ClientID string `json:"client_id"`
RequestedScopes []string `json:"requested_scopes"`
GrantedScopes []string `json:"granted_scopes"`
GrantedAudience []string `json:"granted_audience"`
GrantTypes []string `json:"grant_types"`
Payload map[string][]string `json:"payload"`
}
Request is the OAuth 2.0 request context within a TokenHookRequest.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService( clients []ClientInterface, authz AuthorizerInterface, tenantValidator TenantValidatorInterface, wpool pool.WorkerPoolInterface, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface, ) *Service
func (*Service) AuthorizeRequest ¶ added in v1.0.2
func (s *Service) AuthorizeRequest( ctx context.Context, user User, req TokenHookRequest, groups []*types.Group, ) (bool, error)
This implements deny by default TODO: we should make this configurable
func (*Service) FetchUserGroups ¶
func (*Service) ProcessRequest ¶ added in v1.3.0
func (s *Service) ProcessRequest(ctx context.Context, user User, req TokenHookRequest) (*HookContext, error)
ProcessRequest orchestrates an OAuth token hook request. FetchUserGroups and (when a tenant is present) ValidateMembership are dispatched to the worker pool concurrently. AuthorizeRequest is gated only on FetchUserGroups, so tenant validation proceeds in parallel with authorization. Returns ErrTooBusy when the pool queue is full; all other errors indicate an authorization failure.
type ServiceInterface ¶
type ServiceInterface interface {
ProcessRequest(context.Context, User, TokenHookRequest) (*HookContext, error)
}
type Session ¶ added in v1.4.1
type Session struct {
Extra map[string]interface{} `json:"extra"`
ClientID string `json:"client_id"`
DefaultSession *DefaultSession `json:"id_token"`
}
Session represents the session data sent in the token hook request.
func (*Session) IDTokenClaims ¶ added in v1.4.1
func (s *Session) IDTokenClaims() *IDTokenClaims
IDTokenClaims returns the claims container from DefaultSession, if present.
func (*Session) UnmarshalJSON ¶ added in v1.4.1
UnmarshalJSON implements json.Unmarshaler to handle both id_token and camelCase idToken.
type StorageHookGroupsClient ¶ added in v1.0.2
type StorageHookGroupsClient struct {
// contains filtered or unexported fields
}
func NewLocalStorageClient ¶ added in v1.0.2
func NewLocalStorageClient(db DatabaseInterface, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface) *StorageHookGroupsClient
NewLocalStorageClient creates a new StorageHookGroupsClient.
func (*StorageHookGroupsClient) FetchUserGroups ¶ added in v1.0.2
func (c *StorageHookGroupsClient) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)
FetchUserGroups retrieves user groups from the local storage database.
type TenantValidatorInterface ¶ added in v1.3.0
type TenantValidatorInterface interface {
ValidateMembership(ctx context.Context, identityID, tenantID string) error
}
TenantValidatorInterface validates that a user is an active member of a tenant. See internal/tenants for the real and noop implementations.
type TokenHookRequest ¶ added in v1.4.1
TokenHookRequest is the request body sent to the Ory Hydra token hook.
type TokenHookResponse ¶ added in v1.4.1
type TokenHookResponse struct {
Session ConsentRequestSessionData `json:"session"`
}
TokenHookResponse is the response body returned to the Ory Hydra token hook.
type User ¶
func NewUserFromHookRequest ¶
func NewUserFromHookRequest(r *TokenHookRequest, logger logging.LoggerInterface) *User