Documentation
¶
Overview ¶
Package identity verifies who a gateway request is from. Cohort assignment must only ever use a Subject produced here: never a header a client could have set itself.
Index ¶
Constants ¶
const ( ModeJWT = "jwt" ModeTrustedHeader = "trusted_header" ModeNone = "none" // no verification: every caller is anonymous (default routing) )
Modes.
Variables ¶
var AllowedAlgs = []string{"RS256", "ES256", "EdDSA"}
AllowedAlgs is the JWT signature allowlist. "none" and HS* are never accepted: a shared-secret alg would let anyone holding the (public) JWKS key forge tokens (key confusion).
var ClientCredentialHeaders = []string{"Authorization", "X-Api-Key", "Api-Key", "X-Goog-Api-Key", "Proxy-Authorization"}
ClientCredentialHeaders are the headers a caller can use to present a credential to the gateway. None is ever a gateway-to-provider credential.
var ErrAmbiguous = errors.New("identity: identity header sent more than once")
ErrAmbiguous is returned when a trusted identity/groups header appears more than once; adapters answer 400 rather than guess which value is real.
var ErrNoCredentials = errors.New("identity: no credentials")
ErrNoCredentials is returned when the request carries nothing to verify.
Functions ¶
func BearerToken ¶
BearerToken returns the caller's token from "Authorization: Bearer" or, for Anthropic SDKs, "x-api-key".
func SubjectFromClaims ¶
SubjectFromClaims derives the caller from verified token claims using cfg.UserClaim / cfg.GroupsClaim (defaults "email" / "groups"). When the user claim is "email" the token must also carry email_verified=true (bool or "true"): many IdPs let users set an unverified email, which would let them pick someone else's identity. cfg.TrustUnverifiedEmail opts out.
Types ¶
type OIDCJWT ¶
type OIDCJWT struct {
Issuer, Audience string
UserClaim, GroupsClaim string
// TrustUnverifiedEmail accepts an "email" user claim without
// email_verified=true. Off by default: see SubjectFromClaims.
TrustUnverifiedEmail bool
// contains filtered or unexported fields
}
OIDCJWT verifies a bearer JWT issued by the org's IdP: discovery + JWKS (cached, refetched on unknown kid so key rotation works), then iss / aud / exp / nbf and the alg allowlist.
type Options ¶
type Options struct {
Mode string
Issuer, Audience string
UserClaim, GroupsClaim string
IdentityHeader string
GroupsHeader string
TrustedProxyCIDRs []string
// TrustUnverifiedEmail: accept userClaim "email" without email_verified=true.
// Default false; only for IdPs that never issue unverified emails.
TrustUnverifiedEmail bool
}
Options is per-binary identity config. Empty fields fall back to the org's policy (Org.Identity / Org.Gateway.Auth), so most deployments set nothing.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver caches the Verifier across policy hot-reloads: it is rebuilt only when the effective options change (so the JWKS cache survives reloads).
type TrustedHeader ¶
type TrustedHeader struct {
IdentityHeader string
GroupsHeader string
// contains filtered or unexported fields
}
TrustedHeader reads identity from headers set by an auth gateway. That is only safe when the request provably came from that gateway, so it refuses to exist without a CIDR allowlist for the peer address.
func NewTrustedHeader ¶
func NewTrustedHeader(identityHeader, groupsHeader string, trustedProxyCIDRs []string) (*TrustedHeader, error)
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package identitytest is a tiny OIDC issuer (discovery + JWKS + token minting + an auto-approving authorization-code/PKCE flow) for tests and the compose demo.
|
Package identitytest is a tiny OIDC issuer (discovery + JWKS + token minting + an auto-approving authorization-code/PKCE flow) for tests and the compose demo. |