Documentation
¶
Overview ¶
Package serviceauth mints and verifies short-lived, request-bound JWTs that authenticate CA requests to private services. Each service has a distinct audience and verifies the token against the CA SSH public key.
Index ¶
Constants ¶
const Audience = "epithet-policy"
Audience is the aud claim on every service token.
const DirectoryAudience = "epithet-directory"
const InventoryAudience = "epithet-inventory"
const TokenTTL = 60 * time.Second
TokenTTL bounds how long a minted request token is accepted.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶ added in v0.38.0
type Client struct {
// contains filtered or unexported fields
}
Client owns a private service transport and signs each complete request. Endpoints are service roots; redirects never receive service credentials.
func (*Client) Do ¶ added in v0.38.0
func (c *Client) Do(ctx context.Context, method, path string, query url.Values, body []byte, actor string) (*http.Response, error)
Do binds actor only for human administration; pass an empty string for reads and machine operations. The caller owns the returned response body.
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer mints request-bound JWTs signed with a service SSH private key.
func NewSigner ¶
func NewSigner(privateKey sshcert.RawPrivateKey) (*Signer, error)
NewSigner creates a Signer from an SSH private key.
func NewSignerFor ¶ added in v0.30.0
func NewSignerFor(privateKey sshcert.RawPrivateKey, audience string) (*Signer, error)
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks request-bound JWTs against the CA's SSH public key.
func NewVerifier ¶
func NewVerifier(publicKey sshcert.RawPublicKey) (*Verifier, error)
NewVerifier creates a Verifier from an SSH public key.
func NewVerifierFor ¶ added in v0.30.0
func NewVerifierFor(publicKey sshcert.RawPublicKey, audience string) (*Verifier, error)
func (*Verifier) Verify ¶
Verify checks the request's Authorization header JWT: signature, aud, exp/iat freshness, that htm/htu match the request actually received, and that bh matches sha256(body). It takes the request (rather than just the header) because method/target binding needs req.Method, req.Host, and req.URL.RequestURI().
Source Files