Documentation
¶
Overview ¶
Package issuer verifies tokens from a trusted external issuer, so a platform that already authenticates its users can open a Dexaflow UI session for them without holding Dexaflow's own signing secret (#1284).
The issuer signs with its own key and publishes it as a JWKS; Dexaflow only ever reads public keys. A verified token names an existing user (by the issuer's subject) in an allowed tenant. It never creates users and never grants roles: roles stay whatever the user row holds.
Index ¶
Constants ¶
const DefaultMaxLifetime = 2 * time.Minute
DefaultMaxLifetime bounds exp - iat when Config.MaxLifetime is zero. A handoff is posted the moment it is minted, so two minutes is generous.
Variables ¶
var ( // ErrInvalidToken covers a bad signature, issuer, audience, expiry or a // missing subject or jti: the token is not one the trusted issuer made for // us. ErrInvalidToken = errors.New("issuer: invalid token") // ErrLifetime is a token without iat, one valid for longer than // MaxLifetime, or one issued in the future. A handoff token is meant to be // used once, right away; a long or post-dated one is a long replay window. ErrLifetime = errors.New("issuer: token lifetime missing or too long") // ErrTenantNotAllowed is a tenant claim that is absent, not a string, or // not in AllowedTenants. ErrTenantNotAllowed = errors.New("issuer: tenant not allowed") // ErrReplayed is a token whose jti this server already accepted. A handoff // token opens one session; a second post of the same token is a replay. ErrReplayed = errors.New("issuer: token already used") )
Verification failures. Each is fail-closed; callers log the class and show the browser nothing more specific than "not signed in".
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Name identifies the issuer inside Dexaflow. Its users are linked by
// (Provider(), subject), so it must stay stable once users exist.
Name string
// Issuer is the exact `iss` the tokens carry.
Issuer string
// JWKSURL is where the issuer publishes its public signing keys.
JWKSURL string
// Audience is the `aud` the tokens must carry for this Dexaflow.
Audience string
// TenantClaim names the string claim carrying the Dexaflow tenant name.
TenantClaim string
// AllowedTenants lists the tenants this issuer may sign in to; "*" allows
// every tenant.
AllowedTenants []string
// MaxLifetime caps exp - iat; zero means DefaultMaxLifetime.
MaxLifetime time.Duration
}
Config is one trusted issuer.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks tokens against one trusted issuer.
func New ¶
New builds a Verifier. It makes no network call: the JWKS is fetched on the first Verify and cached, refreshed when a token names an unknown key id, so key rotation needs no restart and an issuer outage cannot block boot.
Source Files