Documentation
¶
Overview ¶
Package serviceauth mints and verifies short-lived, request-bound JWTs that authenticate CA requests to private services. Each service has a distinct audience and verifies the token against the CA SSH public key.
Index ¶
Constants ¶
const Audience = "epithet-policy"
Audience is the aud claim on every service token.
const InventoryAudience = "epithet-inventory"
const TokenTTL = 60 * time.Second
TokenTTL bounds how long a minted request token is accepted.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer mints request-bound JWTs signed with a CA SSH private key.
func NewSigner ¶
func NewSigner(privateKey sshcert.RawPrivateKey) (*Signer, error)
NewSigner creates a Signer from an SSH private key.
func NewSignerFor ¶ added in v0.30.0
func NewSignerFor(privateKey sshcert.RawPrivateKey, audience string) (*Signer, error)
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks request-bound JWTs against the CA's SSH public key.
func NewVerifier ¶
func NewVerifier(publicKey sshcert.RawPublicKey) (*Verifier, error)
NewVerifier creates a Verifier from an SSH public key.
func NewVerifierFor ¶ added in v0.30.0
func NewVerifierFor(publicKey sshcert.RawPublicKey, audience string) (*Verifier, error)
func (*Verifier) Verify ¶
Verify checks the request's Authorization header JWT: signature, aud, exp/iat freshness, that htm/htu match the request actually received, and that bh matches sha256(body). It takes the request (rather than just the header) because method/target binding needs req.Method, req.Host, and req.URL.Path.
Source Files