Documentation
¶
Overview ¶
Package oauthclientadapter provides hardened OAuth client authentication adapters without coupling Credbound to an HTTP server: JWTAssertionVerifier validates private_key_jwt client assertions (RFC 7523) against a client's registered JWKS with single-use JWT ID enforcement, and MemoryReplayStore supplies the replay protection for single-process hosts.
Wire the verifier into credbound.Config.OAuth.ClientAssertions:
verifier, err := oauthclientadapter.NewJWTAssertionVerifier(
oauthclientadapter.VerifierConfig{
ReplayStore: oauthclientadapter.NewMemoryReplayStore(nil),
})
Multi-process hosts must replace MemoryReplayStore with a shared AssertionReplayStore, or a captured assertion could be replayed against a sibling process.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AssertionReplayStore ¶
type AssertionReplayStore interface {
Use(context.Context, string, string, time.Time) (bool, error)
}
AssertionReplayStore atomically consumes a JWT ID until its expiration. Use a shared implementation when the host runs more than one process.
type JWTAssertionVerifier ¶
type JWTAssertionVerifier struct {
// contains filtered or unexported fields
}
JWTAssertionVerifier validates private_key_jwt client assertions against the client's registered JWKS or SSRF-guarded HTTPS jwks_uri, enforcing issuer/subject, audience, expiry and single-use JWT IDs. It is safe for concurrent use and implements credbound.OAuthClientAssertionVerifier for credbound.OAuthConfig.ClientAssertions.
func NewJWTAssertionVerifier ¶
func NewJWTAssertionVerifier(config VerifierConfig) (*JWTAssertionVerifier, error)
NewJWTAssertionVerifier validates config and returns a verifier. A missing replay store or an out-of-bounds fetch/cache policy is rejected.
func (*JWTAssertionVerifier) Verify ¶
func (v *JWTAssertionVerifier) Verify(ctx context.Context, client credbound.OAuthClient, audience, assertion string, now time.Time) error
Verify checks assertion for client against the expected audience at the given time (zero means the verifier's clock), then consumes its JWT ID in the replay store. Any validation failure — malformed token, wrong signature, expired, replayed — reports credbound.ErrInvalidCredentials without detail, so callers cannot oracle the cause.
type MemoryReplayStore ¶
type MemoryReplayStore struct {
// contains filtered or unexported fields
}
MemoryReplayStore is suitable for a single-process host. Multi-process hosts must use a shared store with an atomic insert-if-absent operation.
func NewMemoryReplayStore ¶
func NewMemoryReplayStore(clock func() time.Time) *MemoryReplayStore
NewMemoryReplayStore returns an empty replay store. A nil clock defaults to time.Now; override it only in tests.
func (*MemoryReplayStore) Use ¶
func (s *MemoryReplayStore) Use(ctx context.Context, clientID, jwtID string, expiresAt time.Time) (bool, error)
Use atomically records the (clientID, jwtID) pair until expiresAt, pruning expired entries as a side effect. It reports false when the pair was already recorded, i.e. the assertion is a replay.
type Resolver ¶
Resolver resolves host names for the SSRF guard on JWKS fetches; net.DefaultResolver satisfies it.
type VerifierConfig ¶
type VerifierConfig struct {
// ReplayStore enforces single use of each assertion's JWT ID.
// Required; it must be shared across processes in multi-process hosts.
ReplayStore AssertionReplayStore
// Resolver is used to vet JWKS hosts before dialing. Defaults to
// net.DefaultResolver.
Resolver Resolver
// Clock supplies the verification time and defaults to time.Now.
// Override it only in tests.
Clock func() time.Time
// FetchTimeout bounds one JWKS fetch. Zero defaults to 5s; values
// above 30s are rejected.
FetchTimeout time.Duration
// CacheTTL is how long a fetched JWKS is reused. Zero defaults to 5
// minutes; values above an hour are rejected because a stale cache
// delays key revocation.
CacheTTL time.Duration
}
VerifierConfig configures a JWTAssertionVerifier. Only ReplayStore is required; every other field has a safe default.
Source Files