Documentation
¶
Overview ¶
Package jwk constructs and names the keys ConfigHub authenticates with.
A key's name is its RFC 7638 thumbprint, and that name is how the server resolves a credential: an assertion identifies its key in the JWT header and nothing else is consulted. Client and server must therefore derive the same name from the same key, or authentication fails with the same uniform 401 as a forged credential.
Whether a key is acceptable -- algorithms, expiry, who may register it -- is the server's decision and is not here.
Index ¶
Constants ¶
const RSASigningKeyBits = 2048
RSASigningKeyBits is the modulus size for a generated signing key.
const UserExternalIDMember = "confighub_user_external_id"
UserExternalIDMember records, inside a private key file, which identity holds the key, so a holder can sign without being told separately who it is.
A convenience, not a control: the holder can edit it and a caller can override it at signing time. What binds a key to an identity is the server, where the key is registered against exactly one.
Private JWKs only. A registered public JWK is attached to an identity by the row holding it.
Variables ¶
This section is empty.
Functions ¶
func GenerateRSASigningKey ¶
GenerateRSASigningKey mints a signing key and returns it as a private JWK, along with the key id embedded in it.
The key id is informational -- the server reads the key it is given rather than selecting among several -- so a key can be named in logs and told apart from its successor after a rotation.
func RSAPrivateKeyToJWK ¶
func RSAPrivateKeyToJWK(key *rsa.PrivateKey, kid string) (string, error)
RSAPrivateKeyToJWK renders an RSA private key as a JWK JSON string.
Precompute runs first so the CRT values are present; without it, a generated key and a loaded key serialise differently.
func Thumbprint ¶
func Thumbprint(key json.RawMessage) (string, error)
Thumbprint computes the RFC 7638 thumbprint of a JWK.
Either half of a keypair gives the same answer, since private members are not required members, so a client can name its own key without asking the server.
RFC 7638 §3 requires the required members only, lexicographically ordered, without whitespace; marshalling a map[string]string produces exactly that.
Types ¶
type Pair ¶
type Pair struct {
PublicJWK json.RawMessage
PrivateJWK json.RawMessage
Kid string
}
Pair is a generated keypair, with the name the server will know it by. PublicJWK is meant to be visible; PrivateJWK must never leave the holder.
func GenerateEd25519 ¶
GenerateEd25519 mints a keypair and renders both halves as JWKs. Member names and sizes are fixed by RFC 8037 §2 and RFC 8032.
externalID may be empty, producing a key that records no identity; a caller doing that supplies one at signing time instead.
Source Files
Directories