Documentation
¶
Overview ¶
Package serviceauth mints and verifies short-lived, request-bound JWTs that authenticate CA -> policy-server requests. It replaces RFC 9421 HTTP message signatures (pkg/httpsig): the CA signs a JWT per request instead of the request's HTTP fields, and the policy server verifies it against the CA's SSH public key.
Index ¶
Constants ¶
const Audience = "epithet-policy"
Audience is the aud claim on every service token.
const TokenTTL = 60 * time.Second
TokenTTL bounds how long a minted request token is accepted.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer mints request-bound JWTs signed with a CA SSH private key.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks request-bound JWTs against the CA's SSH public key.
func NewVerifier ¶
func NewVerifier(publicKey sshcert.RawPublicKey) (*Verifier, error)
NewVerifier creates a Verifier from an SSH public key.
func (*Verifier) Verify ¶
Verify checks the request's Authorization header JWT: signature, aud, exp/iat freshness, that htm/htu match the request actually received, and that bh matches sha256(body). It takes the request (rather than just the header) because method/target binding needs req.Method, req.Host, and req.URL.Path.
Source Files