Documentation
¶
Index ¶
- Variables
- type Authorization
- type CA
- func (c *CA) FetchDiscovery(ctx context.Context) (*wire.Discovery, error)
- func (c *CA) PolicyURL() string
- func (c *CA) PublicKey() sshcert.RawPublicKey
- func (c *CA) RequestPolicy(ctx context.Context, token string, conn policy.Connection) (*Authorization, error)
- func (c *CA) SignPublicKey(rawPubKey sshcert.RawPublicKey, params *CertParams) (sshcert.RawCertificate, error)
- type CertParams
- type Option
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidAuthentication = errors.New("invalid user authentication") ErrAccessDenied = errors.New("access denied") ErrAuthorizationPending = errors.New("authorization pending") ErrDependency = errors.New("CA dependency failed") ErrInvalidPublicKey = errors.New("invalid public key") )
Error classes carry CA semantics independently of a private service's HTTP status. Wrapped diagnostics are for server logs, never public response bodies.
Functions ¶
This section is empty.
Types ¶
type Authorization ¶ added in v0.30.0
type Authorization struct {
ID string
PolicyID string
DirectoryRevision string
InventoryRevision string
CertParams CertParams
}
Authorization holds CA's signing inputs and private issuance audit metadata.
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA performs CA operations.
func (*CA) FetchDiscovery ¶ added in v0.14.0
FetchDiscovery obtains login configuration from inventory.
func (*CA) PublicKey ¶
func (c *CA) PublicKey() sshcert.RawPublicKey
PublicKey returns the ssh on-disk format public key for the CA.
func (*CA) RequestPolicy ¶
func (c *CA) RequestPolicy(ctx context.Context, token string, conn policy.Connection) (*Authorization, error)
RequestPolicy requests policy from the policy server for a cert request. The request carries a CA-minted, request-bound JWT (pkg/serviceauth).
func (*CA) SignPublicKey ¶
func (c *CA) SignPublicKey(rawPubKey sshcert.RawPublicKey, params *CertParams) (sshcert.RawCertificate, error)
SignPublicKey signs a key to generate a certificate.
type CertParams ¶
type CertParams struct {
Identity string
Names []string
Expiration time.Duration
Extensions map[string]string
// NotAfter is the earlier of authentication expiry and any policy deadline.
NotAfter time.Time
}
CertParams are assembled by CA from trusted inventory and policy limits. They are local signing inputs, not the policy service's wire contract.
type Option ¶
type Option interface {
// contains filtered or unexported methods
}
Option configures the CA.
func WithInventory ¶ added in v0.30.0
WithInventory configures the authentication, discovery, and resolution service.
func WithLogger ¶ added in v0.3.3
WithLogger configures the CA to use the specified logger.
func WithTLSConfig ¶ added in v0.1.4
WithTLSConfig creates an HTTP client with the specified TLS configuration, using tlsconfig's shared default timeout rather than a locally-duplicated literal.
Source Files