Documentation
¶
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Evaluator ¶
type Evaluator struct {
// contains filtered or unexported fields
}
Evaluator implements policyserver.PolicyEvaluator using tag-based authorization. Policy is read once at startup from config; reload is a process restart (dynamic loading via URL was removed, see task 8b).
Example ¶
Example showing how the evaluator would be used
package main
import (
"context"
"time"
"github.com/epithet-ssh/epithet/pkg/policy"
"github.com/epithet-ssh/epithet/pkg/policyserver"
"github.com/epithet-ssh/epithet/pkg/policyserver/evaluator"
"github.com/epithet-ssh/epithet/pkg/tlsconfig"
)
func main() {
cfg := &policyserver.PolicyRulesConfig{
CAPublicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAbCdE...",
OIDC: policyserver.OIDCConfig{
Issuer: "https://accounts.google.com",
ClientID: "test-client-id",
},
Users: map[string][]string{
"alice@example.com": {"admin"},
},
Defaults: &policyserver.Rules{
Allow: map[string][]string{
"alice": {"admin"},
},
},
// Host patterns are required - defaults.Allow is merged into these
Hosts: map[string]*policyserver.Rules{
"*.example.com": {},
},
}
ctx := context.Background()
eval, _, _ := evaluator.New(ctx, cfg.ExtractServerConfig(), cfg.ExtractPolicyConfig(), tlsconfig.Config{})
// Evaluate would be called with a real OIDC token
conn := policy.Connection{
RemoteHost: "server.example.com",
RemoteUser: "alice",
Port: 22,
}
_, _ = eval.Evaluate(ctx, "oidc-token-from-auth-command", time.Time{}, conn)
}
Output:
func New ¶
func New(ctx context.Context, serverCfg *policyserver.ServerConfig, policyCfg *policyserver.PolicyConfig, tlsCfg tlsconfig.Config) (*Evaluator, *oidc.Validator, error)
New creates the evaluator and its OIDC validator.
func NewForTesting ¶ added in v0.3.3
func NewForTesting(policyCfg *policyserver.PolicyConfig) *Evaluator
NewForTesting creates an evaluator without a validator. The Evaluate method doesn't use the validator (validation happens in the handler), so this is safe for testing policy logic.
func (*Evaluator) Evaluate ¶
func (e *Evaluator) Evaluate(ctx context.Context, identity string, tokenExpiry time.Time, conn policy.Connection) (*wire.PolicyResponse, error)
Evaluate implements policyserver.PolicyEvaluator. The identity has already been extracted from a validated token by the handler. tokenExpiry is carried into CertParams.NotAfter so the CA can clamp the issued certificate's validity to the auth session's remaining lifetime.
Source Files