Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidAuthentication = errors.New("invalid user authentication") ErrAccessDenied = errors.New("access denied") ErrAuthorizationPending = errors.New("authorization pending") ErrDependency = errors.New("CA dependency failed") ErrInvalidPublicKey = errors.New("invalid public key") )
Error classes carry CA semantics independently of a private service's HTTP status. Wrapped diagnostics are for server logs, never public response bodies.
Functions ¶
This section is empty.
Types ¶
type AuditMetadata ¶ added in v0.31.0
type AuditMetadata struct {
ID string
PolicyID string
DirectoryRevision string
InventoryRevision string
}
AuditMetadata identifies the identity and source revisions used for issuance.
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA performs CA operations.
func New ¶
func New(privateKey sshcert.RawPrivateKey, evaluator PolicyEvaluator, options ...Option) (*CA, error)
New creates the issuing authority with its in-process policy evaluator.
func (*CA) FetchDiscovery ¶ added in v0.14.0
FetchDiscovery returns this CA's configured login information.
func (*CA) Issue ¶ added in v0.31.0
func (c *CA) Issue(ctx context.Context, token string, conn wire.Connection, publicKey sshcert.RawPublicKey) (*IssuedCertificate, error)
Issue obtains policy approval and signs the requested key using inventory facts and policy-provided limits. It returns a result only after signing succeeds; callers never handle intermediate authorization or signing parameters.
func (*CA) PublicKey ¶
func (c *CA) PublicKey() sshcert.RawPublicKey
PublicKey returns the ssh on-disk format public key for the CA.
type IssuedCertificate ¶ added in v0.31.0
type IssuedCertificate struct {
Certificate sshcert.RawCertificate
Audit AuditMetadata
}
IssuedCertificate contains a signed certificate and its private audit metadata. Audit metadata is for server-side logging and is not part of the client response.
type Option ¶
type Option interface {
// contains filtered or unexported methods
}
Option configures the CA.
func WithFacts ¶ added in v0.38.0
func WithFacts(directoryURL, inventoryURL string, identity oidc.ValidatorConfig, discovery wire.AuthConfig, cfg tlsconfig.Config) Option
WithFacts configures independent read providers and CA-owned OIDC validation.
func WithLogger ¶ added in v0.3.3
WithLogger configures the CA to use the specified logger.
type PolicyEvaluator ¶ added in v0.41.0
type PolicyEvaluator interface {
Evaluate(context.Context, wire.Connection, *wire.PolicyFacts) (*wire.PolicyResponse, error)
}
PolicyEvaluator decides access using validated CA-owned authentication and current directory/host facts. It has no storage or transport responsibility. It returns a positive TTL, extensions, and an optional tighter deadline. CA always enforces the authentication lifetime as an additional ceiling.
Source Files