Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidAuthentication = errors.New("invalid user authentication") ErrAccessDenied = errors.New("access denied") ErrAuthorizationPending = errors.New("authorization pending") ErrDependency = errors.New("CA dependency failed") ErrInvalidPublicKey = errors.New("invalid public key") )
Error classes carry CA semantics independently of a private service's HTTP status. Wrapped diagnostics are for server logs, never public response bodies.
Functions ¶
This section is empty.
Types ¶
type AuditMetadata ¶ added in v0.31.0
type AuditMetadata struct {
ID string
PolicyID string
DirectoryRevision string
InventoryRevision string
}
AuditMetadata identifies the identity and source revisions used for issuance.
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA performs CA operations.
func (*CA) FetchDiscovery ¶ added in v0.14.0
FetchDiscovery obtains login configuration from inventory.
func (*CA) Issue ¶ added in v0.31.0
func (c *CA) Issue(ctx context.Context, token string, conn policy.Connection, publicKey sshcert.RawPublicKey) (*IssuedCertificate, error)
Issue obtains policy approval and signs the requested key using inventory facts and policy-provided limits. It returns a result only after signing succeeds; callers never handle intermediate authorization or signing parameters.
func (*CA) PublicKey ¶
func (c *CA) PublicKey() sshcert.RawPublicKey
PublicKey returns the ssh on-disk format public key for the CA.
type IssuedCertificate ¶ added in v0.31.0
type IssuedCertificate struct {
Certificate sshcert.RawCertificate
Audit AuditMetadata
}
IssuedCertificate contains a signed certificate and its private audit metadata. Audit metadata is for server-side logging and is not part of the client response.
type Option ¶
type Option interface {
// contains filtered or unexported methods
}
Option configures the CA.
func WithInventory ¶ added in v0.30.0
WithInventory configures the authentication, discovery, and resolution service.
func WithLogger ¶ added in v0.3.3
WithLogger configures the CA to use the specified logger.
func WithTLSConfig ¶ added in v0.1.4
WithTLSConfig creates an HTTP client with the specified TLS configuration, using tlsconfig's shared default timeout rather than a locally-duplicated literal.
Source Files