Documentation
¶
Overview ¶
Package credentials resolves idsec login credentials from environment variables and an INI ".idsecrc" credentials file.
Credentials are looked up per authenticator (for example "isp" or "pvwa"). Two sources are supported, both layered beneath explicit CLI flags by the caller:
- Environment variables: IDSEC_<AUTH>_USERNAME and IDSEC_<AUTH>_SECRET (the authenticator name is uppercased), e.g. IDSEC_ISP_USERNAME. The secret may instead be read from a file via IDSEC_<AUTH>_SECRET_FILE, which is preferred because the secret can live in a 0600 file rather than the environment. The literal IDSEC_<AUTH>_SECRET wins when both are set; an unreadable IDSEC_<AUTH>_SECRET_FILE is a hard error, never silent.
- An INI file (".idsecrc"), AWS-credentials style, with one section per profile and keys "<auth>_username" / "<auth>_secret". The section matching the active profile is used, falling back to a "default" section.
The file is discovered, in order, from an explicit path (flag or the IDSEC_CREDENTIALS_FILE environment variable), then ./.idsecrc, ./.idsec/.idsecrc, ~/.idsec/.idsecrc, and ~/.idsecrc. The first existing file wins; there is no merging across locations. Auto-discovery can be suppressed (leaving only an explicit path) so callers can require consent before reading a credentials file they did not name.
Index ¶
- Constants
- func EnvSecret(authName string) (string, error)
- func EnvSecretFileVar(authName string) string
- func EnvSecretSourceVar(authName string) string
- func EnvSecretVar(authName string) string
- func EnvUsername(authName string) string
- func EnvUsernameVar(authName string) string
- func ResolveFilePath(flagValue string, noDiscovery bool) (path string, explicit bool, found bool)
- type IdsecRCFile
Constants ¶
const ( // CredentialsFileEnvVar is the environment variable that overrides the // default credentials file discovery with an explicit path. CredentialsFileEnvVar = "IDSEC_CREDENTIALS_FILE" )
Variables ¶
This section is empty.
Functions ¶
func EnvSecret ¶
EnvSecret returns the secret configured via environment variable for the given authenticator. The literal IDSEC_<AUTH>_SECRET takes precedence; when it is unset, IDSEC_<AUTH>_SECRET_FILE is read and its contents (minus a trailing newline) are returned. An empty string is returned when neither is set. A configured-but-unreadable secret file returns an error rather than silently falling back to no secret.
func EnvSecretFileVar ¶
EnvSecretFileVar returns the environment variable name that holds the path to a file containing the secret for the given authenticator (e.g. "isp" -> "IDSEC_ISP_SECRET_FILE").
func EnvSecretSourceVar ¶
EnvSecretSourceVar returns the name of the environment variable that actually supplied the secret for the given authenticator, so prompts and messages can name the right source. It prefers the literal secret var, then the secret file var, defaulting to the literal var name when neither is set.
func EnvSecretVar ¶
EnvSecretVar returns the environment variable name that holds the secret for the given authenticator (e.g. "isp" -> "IDSEC_ISP_SECRET").
func EnvUsername ¶
EnvUsername returns the username configured via environment variable for the given authenticator, or an empty string when unset.
func EnvUsernameVar ¶
EnvUsernameVar returns the environment variable name that holds the username for the given authenticator (e.g. "isp" -> "IDSEC_ISP_USERNAME").
func ResolveFilePath ¶
ResolveFilePath determines which credentials file to use.
It returns the resolved path, whether the path came from an explicit source (the flag value or the IDSEC_CREDENTIALS_FILE environment variable), and whether an existing regular file was found at that path. For explicit sources the returned path is reported even when the file does not exist, so callers can treat a missing explicit file as a fatal error.
When noDiscovery is true, only an explicit path (flag or environment variable) is honored; the ./.idsecrc, ./.idsec/.idsecrc, ~/.idsec/.idsecrc, and ~/.idsecrc auto-discovery search is skipped entirely.
Types ¶
type IdsecRCFile ¶
type IdsecRCFile struct {
// contains filtered or unexported fields
}
IdsecRCFile represents a parsed ".idsecrc" credentials file. A nil *IdsecRCFile is valid to use: its lookup methods return empty strings.
func Load ¶
func Load(flagValue string, noDiscovery bool) (*IdsecRCFile, error)
Load resolves and loads the credentials file for the given flag value.
When the file was requested explicitly (via the flag or the IDSEC_CREDENTIALS_FILE environment variable) it must exist and parse, or an error is returned. An auto-discovered file that is missing or fails to parse is treated as absent: Load returns (nil, nil) after logging a warning for a parse failure. A non-fatal warning is emitted for group/world-readable files on non-Windows platforms. When noDiscovery is true, auto-discovery is suppressed and only an explicit path (flag or IDSEC_CREDENTIALS_FILE) is loaded.
func (*IdsecRCFile) Path ¶
func (f *IdsecRCFile) Path() string
Path returns the file system path this credentials file was loaded from.
func (*IdsecRCFile) Secret ¶
func (f *IdsecRCFile) Secret(profileName, authName string) string
Secret returns the secret for the given profile and authenticator, reading the profile's section and falling back to the "default" section.
func (*IdsecRCFile) Username ¶
func (f *IdsecRCFile) Username(profileName, authName string) string
Username returns the username for the given profile and authenticator, reading the profile's section and falling back to the "default" section.
Source Files