Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultExpiration ¶ added in v0.1.8
func DefaultExpiration() string
DefaultExpiration returns the default certificate expiration duration
func DefaultExtensions ¶ added in v0.1.8
DefaultExtensions returns the default SSH certificate extensions
func NewHandler ¶
NewHandler creates an HTTP handler for the policy server. The handler supports:
POST / — evaluates a cert request (normalized facts + connection)
Every request must carry a valid CA-minted request token (pkg/serviceauth); CAPublicKey is therefore required.
Types ¶
type Config ¶
type Config struct {
// CAPublicKey is the CA's SSH public key, used to verify the request-bound
// JWT (pkg/serviceauth) on every request. Required.
CAPublicKey sshcert.RawPublicKey
Evaluator PolicyEvaluator
}
Config configures the policy server HTTP handler.
type PolicyEvaluator ¶
type PolicyEvaluator interface {
// Evaluate makes an authorization decision using validated, CA-supplied
// directory and host facts. It has no inventory access.
// Authentication expiry is verified before evaluation. The evaluator owns
// active-user and account restrictions and any authentication-derived
// certificate deadline, which it must return as NotAfter for CA to apply.
// Returns:
// - *wire.PolicyResponse: Authorization limits and policy audit metadata if authorized
// - error: If authorization denied
//
// Error handling:
// - Return policyserver.Forbidden (403) if access denied by policy
// - Return other errors (500) for internal errors
Evaluate(ctx context.Context, conn wire.Connection, facts *wire.PolicyFacts) (*wire.PolicyResponse, error)
}
PolicyEvaluator makes authorization decisions based on inventory ID and connection details. The handler trusts normalized authentication facts supplied by the CA. Implementations must: - Make authorization decision (allow/deny) based on identity - Return authorization limits (TTL, extensions, optional absolute deadline) - Return appropriate errors for different failure modes
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package writpolicy implements the policy server's PolicyEvaluator over a compiled writ policy, an inventory, and registries of requirement handlers, flag sources, and notify targets.
|
Package writpolicy implements the policy server's PolicyEvaluator over a compiled writ policy, an inventory, and registries of requirement handlers, flag sources, and notify targets. |