Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnauthorized = &PolicyError{StatusCode: http.StatusUnauthorized, Message: "Unauthorized"} // ErrForbidden indicates token valid but access denied by policy (403) ErrForbidden = &PolicyError{StatusCode: http.StatusForbidden, Message: "Forbidden"} )
Standard errors for policy evaluation
Functions ¶
func InternalError ¶
InternalError returns a 500 error with the given message
func NewHandler ¶
func NewHandler(config Config) http.HandlerFunc
NewHandler creates an HTTP handler for the policy server. The handler: 1. Parses the request body (token, signature, connection) 2. Verifies the CA signature (if CAPublicKey provided) 3. Calls the evaluator to make authorization decision 4. Returns appropriate HTTP response (200 with policy, or error)
func Unauthorized ¶
Unauthorized returns a 401 error with the given message
Types ¶
type Config ¶
type Config struct {
// CAPublicKey is the CA's SSH public key for verifying request signatures.
// If empty, signature verification is skipped (not recommended for production).
CAPublicKey sshcert.RawPublicKey
// Evaluator makes authorization decisions
Evaluator PolicyEvaluator
// MaxRequestSize limits the request body size (default: 8192 bytes)
MaxRequestSize int64
}
Config configures the policy server HTTP handler
type PolicyError ¶
PolicyError represents a policy evaluation error with HTTP status code
func (*PolicyError) Error ¶
func (e *PolicyError) Error() string
type PolicyEvaluator ¶
type PolicyEvaluator interface {
// Evaluate makes an authorization decision for the given token and connection.
// Returns:
// - *Response: Certificate parameters and policy if authorized
// - error: If authorization denied or validation failed
//
// Error handling:
// - Return ErrUnauthorized (401) if token is invalid/expired
// - Return ErrForbidden (403) if token valid but access denied by policy
// - Return other errors (500) for internal errors
Evaluate(token string, conn policy.Connection) (*Response, error)
}
PolicyEvaluator makes authorization decisions based on token and connection details. Implementations must: - Validate the authentication token (e.g., verify OIDC JWT signature) - Make authorization decision (allow/deny) - Return certificate parameters (principals, expiration, extensions) and policy (hostPattern) - Return appropriate errors for different failure modes
Source Files
Directories