lighthouse

package module
v0.22.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2026 License: MIT Imports: 49 Imported by: 0

README

LightHouse - A Go-Based Trust Anchor / Intermediate Authority / Trust Mark Issuer

LightHouse helps you to navigate the wild and complex sea of OpenID Federation.

LightHouse is a flexible and configurable OpenID Federation Entity. It can be configured and deployed as a Trust Anchor / Intermediate Authority / Resolver / Trust Mark Issuer or everything at the same time. LightHouse uses the go-oidfed/lib oidfed library.

LightHouse also can be used to build your own federation entity on top of the existing implementation.

Documentation

For more information please refer to the Documentation at https://go-oidfed.github.io/lighthouse/

Configuration

The configuration of LightHouse is explained in details at https://go-oidfed.github.io/lighthouse/config/.

Docker Images

Docker images are available at docker hub under oidfed/lighthouse.

  • The go oidfed library at https://github.com/go-oidfed/lib contains:
    • The basic go-oidfed library with the core oidfed functionalities.
    • It can be used to build all kind of oidfed capable entities.
    • LightHouse uses this library
  • The whoami-rp repository at https://github.com/go-oidfed/whoami-rp contains:
    • A simple - but not very useful - example RP.
  • The OFFA repository at https://github.com/go-oidfed/offa:
    • OFFA stands for Openid Federation Forward Auth
    • OFFA can be deployed next to existing services to add oidfed authentication to services that do not natively support it.
    • OFFA can be used with Apache, Caddy, NGINX, and Traefik.

Documentation

Index

Constants

View Source 
const (
	KMSFilesystem = "filesystem"
	KMSPKCS11     = "pkcs11"
	KMSDatabase   = "db"
)
View Source 
const (
	PKBackendFilesystem = "filesystem"
	PKBackendDatabase   = "db"
)
View Source 
const MaximumEntityConfigurationCachePeriod = 8 * time.Hour
View Source 
const MaximumSubordinateStatementCachePeriod = 8 * time.Hour

MaximumSubordinateStatementCachePeriod is the upper bound on how long a signed subordinate statement JWT is cached at the fetch endpoint. The actual cache TTL is further capped by the statement's own expiration and by the earliest published key expiration (see subordinateStatementCacheTTL).

Variables

View Source 
var FiberServerConfig = fiber.Config{
	ReadTimeout:    3 * time.Second,
	WriteTimeout:   20 * time.Second,
	IdleTimeout:    150 * time.Second,
	ReadBufferSize: 8192,

	ErrorHandler: handleError,
	Network:      "tcp",
}

FiberServerConfig is the fiber.Config that is used to init the http fiber.App

Functions

func NewSubordinateJWKSRefreshStorage added in v0.22.0 

func NewSubordinateJWKSRefreshStorage(
	store model.SubordinateStorageBackend, eventStore model.SubordinateEventStore,
) oidfed.SubordinateJWKSRefreshStorage

NewSubordinateJWKSRefreshStorage creates an adapter over the subordinate storage backend that also records JWKSRefreshed events when the JWKS change.

func RegisterEntityChecker 

func RegisterEntityChecker(configTypeName string, constructor func() EntityChecker)

RegisterEntityChecker registers a custom EntityChecker so EntityCheckerFromYAMLConfig knows about it and can return it from a yaml config

func SetupSubordinateJWKSRefresher added in v0.22.0 

func SetupSubordinateJWKSRefresher(
	store model.SubordinateStorageBackend, eventStore model.SubordinateEventStore,
) (*oidfed.SubordinateJWKSRefresher, error)

SetupSubordinateJWKSRefresher builds and starts the subordinate JWKS refresher from storage. The returned refresher must be stopped on shutdown.

func SetupTAJWKSRefresher added in v0.22.0 

func SetupTAJWKSRefresher(repo *TrustAnchorRepo, jwkStorage oidfed.JWKStorage) (
	*oidfed.TAJWKSRefresher, error,
)

SetupTAJWKSRefresher builds and starts the TA JWKS refresher from the repository. It creates a DBJWKStorage, collects all TAs with EnableJWKSUpdate=true from the repo, constructs a TAJWKSRefresher, and starts it. The returned refresher must be stopped on shutdown.

Types

type AdminAPIOptions added in v0.20.0 

type AdminAPIOptions struct {
	Enabled      bool
	UsersEnabled bool
	// Port: 0 mounts on main server under /api/v1/admin; >0 starts a separate server on this port
	Port int
	// ActorHeader is the HTTP header name to extract the actor from for event history.
	// Default: "X-Actor"
	ActorHeader string
	// ActorSource is the preferred source for actor extraction ("basic_auth" or "header").
	// Default: "basic_auth" (tries basic auth username first, then falls back to header)
	ActorSource string
	// CORS holds CORS middleware configuration for the admin API.
	CORS CORSConf
	// TLS holds TLS configuration for the admin API.
	TLS TLSConf
}

AdminAPIOptions controls initialization of the admin API.

type AuthorityHintEntityChecker 

type AuthorityHintEntityChecker struct {
	EntityID string `yaml:"entity_id"`
}

AuthorityHintEntityChecker checks that the entity has a certain entry in its authority_hints

func (AuthorityHintEntityChecker) Check 

func (c AuthorityHintEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	_ []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*AuthorityHintEntityChecker) UnmarshalYAML 

func (c *AuthorityHintEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interface

type CORSConf added in v0.20.0 

type CORSConf struct {
	// Enabled enables CORS middleware.
	Enabled bool `yaml:"enabled" envconfig:"ENABLED"`
	// AllowOrigins is a comma-separated list of allowed origins, or "*" for all.
	AllowOrigins string `yaml:"allow_origins" envconfig:"ALLOW_ORIGINS"`
	// AllowMethods is a comma-separated list of allowed HTTP methods.
	AllowMethods string `yaml:"allow_methods" envconfig:"ALLOW_METHODS"`
	// AllowHeaders is a comma-separated list of allowed request headers.
	AllowHeaders string `yaml:"allow_headers" envconfig:"ALLOW_HEADERS"`
	// AllowCredentials indicates whether credentials (cookies, authorization headers) are allowed.
	AllowCredentials bool `yaml:"allow_credentials" envconfig:"ALLOW_CREDENTIALS"`
	// ExposeHeaders is a comma-separated list of headers to expose to the browser.
	ExposeHeaders string `yaml:"expose_headers" envconfig:"EXPOSE_HEADERS"`
	// MaxAge is the preflight request cache duration in seconds.
	MaxAge int `yaml:"max_age" envconfig:"MAX_AGE"`
}

CORSConf holds CORS middleware configuration.

Environment variables (with prefix based on parent, e.g., LH_SERVER_CORS_ or LH_API_ADMIN_CORS_):

  • *_ENABLED: Enable CORS middleware
  • *_ALLOW_ORIGINS: Comma-separated allowed origins or "*" for all
  • *_ALLOW_METHODS: Comma-separated allowed HTTP methods
  • *_ALLOW_HEADERS: Comma-separated allowed request headers
  • *_ALLOW_CREDENTIALS: Allow credentials (cookies, authorization headers)
  • *_EXPOSE_HEADERS: Comma-separated headers to expose to the browser
  • *_MAX_AGE: Preflight request cache duration in seconds

type CheckerContext added in v0.20.0 

type CheckerContext struct {
	Store         model.TrustMarkedEntitiesStorageBackend
	TrustMarkType string
}

CheckerContext provides runtime context for contextual entity checkers

type CmdEntityChecker added in v0.22.1 

type CmdEntityChecker struct {
	Path    string   `yaml:"path" json:"path"`
	Args    []string `yaml:"args" json:"args"`
	Env     []string `yaml:"env" json:"env"`
	Timeout int      `yaml:"timeout" json:"timeout"`
}

CmdEntityChecker runs an external command to decide whether an entity satisfies the requirements. The entity's Entity Configuration payload is written to the command's stdin as JSON, and the entity ID and types are exposed through the ENTITY_ID and ENTITY_TYPES environment variables.

The command's exit code determines the result: exit 0 allows the entity, any non-zero exit denies it. stderr (truncated) is used as the error description on denial.

func (*CmdEntityChecker) Check added in v0.22.1 

func (c *CmdEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	entityTypes []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*CmdEntityChecker) UnmarshalYAML added in v0.22.1 

func (c *CmdEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler interface

type ContextualEntityChecker added in v0.20.0 

type ContextualEntityChecker interface {
	EntityChecker
	// SetContext sets the runtime context for this checker
	SetContext(ctx CheckerContext)
}

ContextualEntityChecker is an EntityChecker that requires runtime context to be set before checking. This is used for checkers that need access to storage backends or other runtime dependencies.

type DBListEntityChecker added in v0.20.0 

type DBListEntityChecker struct {
	// contains filtered or unexported fields
}

DBListEntityChecker checks if subject is in TrustMarkSubject table with active status. This checker requires SetContext to be called before Check.

func (*DBListEntityChecker) Check added in v0.20.0 

func (c *DBListEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	_ []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*DBListEntityChecker) SetContext added in v0.20.0 

func (c *DBListEntityChecker) SetContext(ctx CheckerContext)

SetContext sets the runtime context for this checker

func (*DBListEntityChecker) UnmarshalYAML added in v0.20.0 

func (*DBListEntityChecker) UnmarshalYAML(_ *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler interface

type DBTrustMarkSpecProvider added in v0.20.0 

type DBTrustMarkSpecProvider struct {
	// contains filtered or unexported fields
}

DBTrustMarkSpecProvider implements oidfed.TrustMarkSpecProvider by fetching TrustMarkSpecs from the database. It is safe for concurrent use as it delegates to the thread-safe storage layer.

func NewDBTrustMarkSpecProvider added in v0.20.0 

func NewDBTrustMarkSpecProvider(store model.TrustMarkSpecStore) *DBTrustMarkSpecProvider

NewDBTrustMarkSpecProvider creates a new DBTrustMarkSpecProvider.

func (*DBTrustMarkSpecProvider) GetTrustMarkSpec added in v0.20.0 

func (p *DBTrustMarkSpecProvider) GetTrustMarkSpec(trustMarkType string) *oidfed.TrustMarkSpec

GetTrustMarkSpec returns the TrustMarkSpec for the given trust mark type. Returns nil if the trust mark type is not found.

func (*DBTrustMarkSpecProvider) TrustMarkTypes added in v0.20.0 

func (p *DBTrustMarkSpecProvider) TrustMarkTypes() []string

TrustMarkTypes returns all available trust mark types from the database.

type EligibilityCache added in v0.20.0 

type EligibilityCache struct {
	// contains filtered or unexported fields
}

EligibilityCache caches eligibility check results for trust mark issuance. This reduces the load on external checkers (http_list, http_list_jwt) and database queries for repeated requests.

func NewEligibilityCache added in v0.20.0 

func NewEligibilityCache() *EligibilityCache

NewEligibilityCache creates a new eligibility cache

func (*EligibilityCache) CleanExpired added in v0.20.0 

func (c *EligibilityCache) CleanExpired() int

CleanExpired removes all expired entries from the cache This can be called periodically to prevent memory growth

func (*EligibilityCache) Clear added in v0.20.0 

func (c *EligibilityCache) Clear()

Clear removes all entries from the cache

func (*EligibilityCache) Get added in v0.20.0 

func (c *EligibilityCache) Get(trustMarkType, subject string) (eligible bool, httpCode int, reason string, found bool)

Get retrieves a cached eligibility result Returns eligible status, HTTP code, reason, and whether a valid entry was found

func (*EligibilityCache) Invalidate added in v0.20.0 

func (c *EligibilityCache) Invalidate(trustMarkType, subject string)

Invalidate removes a specific entry from the cache This should be called when a subject's status changes (e.g., via admin API)

func (*EligibilityCache) InvalidateAll added in v0.20.0 

func (c *EligibilityCache) InvalidateAll(trustMarkType string)

InvalidateAll removes all entries for a specific trust mark type This should be called when the eligibility config for a trust mark type changes

func (*EligibilityCache) InvalidateType added in v0.20.0 

func (c *EligibilityCache) InvalidateType(trustMarkType string)

InvalidateType is an alias for InvalidateAll for clearer semantics

func (*EligibilityCache) Set added in v0.20.0 

func (c *EligibilityCache) Set(trustMarkType, subject string, eligible bool, httpCode int, reason string, ttl time.Duration)

Set stores an eligibility result in the cache

func (*EligibilityCache) Size added in v0.20.0 

func (c *EligibilityCache) Size() int

Size returns the current number of entries in the cache

func (*EligibilityCache) StartCleanupRoutine added in v0.20.0 

func (c *EligibilityCache) StartCleanupRoutine(interval time.Duration) (stop func())

StartCleanupRoutine starts a background goroutine that periodically cleans expired entries from the cache. Returns a stop function that should be called to stop the cleanup routine.

type EndpointConf 

type EndpointConf struct {
	// Path is the internal path for the endpoint.
	// Env: LH_ENDPOINTS_<ENDPOINT>_PATH
	//
	// NOTE: We intentionally omit the envconfig tag here. Using envconfig:"PATH"
	// would cause the library to also check the bare "PATH" env var as a fallback,
	// which collides with the system PATH and corrupts endpoint URLs.
	// By omitting the tag, envconfig uses the field name "Path" directly,
	// resulting in the correct LH_ENDPOINTS_<ENDPOINT>_PATH without fallback issues.
	Path string `yaml:"path"`
	// URL is the external URL for the endpoint.
	// Env: LH_ENDPOINTS_<ENDPOINT>_URL
	URL string `yaml:"url"`
	// AuthEnabled requires authentication for this endpoint (default: false).
	// When global endpoints.auth.all_require_auth is true, this is forced on.
	// Env: LH_ENDPOINTS_<ENDPOINT>_AUTH_ENABLED
	AuthEnabled bool `yaml:"auth_enabled" envconfig:"AUTH_ENABLED"`
	// AuthTrustAnchors is the list of trust anchor entity IDs for endpoint authentication.
	// These are resolved live from the TrustAnchorRepo at request time.
	// If empty when auth is enabled, falls back to global endpoints.auth.trust_anchors.
	// Env: LH_ENDPOINTS_<ENDPOINT>_AUTH_TRUST_ANCHORS (comma-separated)
	AuthTrustAnchors []string `yaml:"auth_trust_anchors" envconfig:"AUTH_TRUST_ANCHORS"`
}

EndpointConf is a type for configuring an endpoint with an internal and external path.

Environment variables use the parent endpoint's prefix, e.g.:

  • LH_ENDPOINTS_FETCH_PATH: Internal path for the fetch endpoint
  • LH_ENDPOINTS_FETCH_URL: External URL for the fetch endpoint

func (EndpointConf) IsSet 

func (c EndpointConf) IsSet() bool

IsSet returns a bool indicating if this endpoint was configured or not

func (*EndpointConf) ValidateURL 

func (c *EndpointConf) ValidateURL(rootURL string) string

ValidateURL validates that an external URL is set, and if not prefixes the internal path with the passed rootURL and sets it at the external url

type EndpointRegistry added in v0.22.0 

type EndpointRegistry struct {
	// contains filtered or unexported fields
}

EndpointRegistry holds in-memory handler registrations for all federation endpoints, keyed by path. It is rebuilt from the database on changes.

The legacy map keeps old endpoint paths served for one entity configuration lifetime after a path change or deletion, so clients holding a cached entity configuration that still references the old path can continue to use it.

func NewEndpointRegistry added in v0.22.0 

func NewEndpointRegistry() *EndpointRegistry

NewEndpointRegistry creates a new empty EndpointRegistry.

type EntityChecker 

type EntityChecker interface {
	// Check checks if the entity with the passed oidfed.EntityStatement
	// satisfies the requirements of this EntityChecker or not
	// It returns a bool indicating this status,
	// and if not a http status code as well as a oidfed.Error as api response
	Check(
		entityConfiguration *oidfed.EntityStatement,
		entityTypes []string,
	) (bool, int, *oidfed.Error)
	// Unmarshaler is used to load the configuration
	yaml.Unmarshaler
}

EntityChecker is an interface used to check if an entity satisfies some requirements, e.g. to check if an entity should be enrolled in the federation or should be issued a trust mark

func EntityCheckerFromEntityCheckerConfig 

func EntityCheckerFromEntityCheckerConfig(c EntityCheckerConfig) (
	EntityChecker,
	error,
)

EntityCheckerFromEntityCheckerConfig parses the passed EntityCheckerConfig and returns the configured EntityChecker

func EntityCheckerFromJSONConfig added in v0.20.0 

func EntityCheckerFromJSONConfig(checkerType string, config any) (EntityChecker, error)

EntityCheckerFromJSONConfig creates an EntityChecker from a JSON-style config (using any instead of yaml.Node). This is used when loading config from the database. The config can be a map[string]any (for simple checkers like trust_mark) or a []any (for composite checkers like multiple_or/multiple_and).

func EntityCheckerFromYAMLConfig 

func EntityCheckerFromYAMLConfig(config []byte) (EntityChecker, error)

EntityCheckerFromYAMLConfig passes the passed yaml config and returns the configured EntityChecker

type EntityCheckerConfig 

type EntityCheckerConfig struct {
	Type   string    `yaml:"type"`
	Config yaml.Node `yaml:"config,omitempty" ignored:"true"`
}

EntityCheckerConfig is a type for configuring an EntityChecker through yaml

type EntityCheckerNone 

type EntityCheckerNone struct{}

EntityCheckerNone is a type implementing EntityChecker but that checks nothing

func (EntityCheckerNone) Check 

func (EntityCheckerNone) Check(_ *oidfed.EntityStatement, _ []string) (
	bool, int, *oidfed.Error,
)

Check implements the EntityChecker interface

func (EntityCheckerNone) UnmarshalYAML 

func (EntityCheckerNone) UnmarshalYAML(_ *yaml.Node) error

UnmarshalYAML implements the EntityChecker interface

type EntityIDEntityChecker 

type EntityIDEntityChecker struct {
	AllowedIDs []string `yaml:"entity_ids"`
}

EntityIDEntityChecker checks that the entity has a certain entity id

func (EntityIDEntityChecker) Check 

func (c EntityIDEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	_ []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*EntityIDEntityChecker) UnmarshalYAML 

func (c *EntityIDEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interface

type HTTPEntityChecker added in v0.22.1 

type HTTPEntityChecker struct {
	URL      string            `yaml:"url" json:"url"`
	Method   string            `yaml:"method" json:"method"`
	Headers  map[string]string `yaml:"headers" json:"headers"`
	Timeout  int               `yaml:"timeout" json:"timeout"`
	BodyMode string            `yaml:"body_mode" json:"body_mode"`
}

HTTPEntityChecker makes a per-entity HTTP request to an external decision service and uses the response status code to decide whether the entity satisfies the requirements: 2xx allows the entity, 4xx denies it (the remote status code is passed through), and 5xx or a network error is treated as a server error.

Unlike HTTPListEntityChecker (which fetches a static list and checks membership), this checker delegates the decision to the remote service on every request and performs no caching.

func (*HTTPEntityChecker) Check added in v0.22.1 

func (c *HTTPEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	entityTypes []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*HTTPEntityChecker) UnmarshalYAML added in v0.22.1 

func (c *HTTPEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler interface

type HTTPListEntityChecker added in v0.20.0 

type HTTPListEntityChecker struct {
	URL      string            `yaml:"url" json:"url"`
	Method   string            `yaml:"method" json:"method"`       // GET or POST, default GET
	Headers  map[string]string `yaml:"headers" json:"headers"`     // Additional headers
	Timeout  int               `yaml:"timeout" json:"timeout"`     // seconds, default 30
	CacheTTL int               `yaml:"cache_ttl" json:"cache_ttl"` // seconds, default 60
	// contains filtered or unexported fields
}

HTTPListEntityChecker fetches a list of entity IDs from an HTTP endpoint and checks if the requesting entity is in the list. The endpoint should return a JSON array of entity ID strings.

func (*HTTPListEntityChecker) Check added in v0.20.0 

func (c *HTTPListEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	_ []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*HTTPListEntityChecker) UnmarshalYAML added in v0.20.0 

func (c *HTTPListEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler interface

type HTTPListJWTEntityChecker added in v0.20.0 

type HTTPListJWTEntityChecker struct {
	URL          string            `yaml:"url" json:"url"`
	Method       string            `yaml:"method" json:"method"`
	Headers      map[string]string `yaml:"headers" json:"headers"`
	Timeout      int               `yaml:"timeout" json:"timeout"`
	CacheTTL     int               `yaml:"cache_ttl" json:"cache_ttl"`
	ListClaim    string            `yaml:"list_claim" json:"list_claim"` // default "entities"
	Verification JWTVerification   `yaml:"verification" json:"verification"`
	// contains filtered or unexported fields
}

HTTPListJWTEntityChecker fetches a signed JWT containing entity IDs from an HTTP endpoint. The JWT signature is verified either using a configured JWKS or by building a trust chain to federation trust anchors.

func (*HTTPListJWTEntityChecker) Check added in v0.20.0 

func (c *HTTPListJWTEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	_ []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*HTTPListJWTEntityChecker) UnmarshalYAML added in v0.20.0 

func (c *HTTPListJWTEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler interface

type IssuedTrustMarkCache added in v0.20.0 

type IssuedTrustMarkCache struct {
	// contains filtered or unexported fields
}

IssuedTrustMarkCache caches issued trust mark JWTs to avoid repeated signing and database writes for the same (trust_mark_type, subject) combination.

func NewIssuedTrustMarkCache added in v0.20.0 

func NewIssuedTrustMarkCache() *IssuedTrustMarkCache

NewIssuedTrustMarkCache creates a new issued trust mark cache

func (*IssuedTrustMarkCache) CleanExpired added in v0.20.0 

func (c *IssuedTrustMarkCache) CleanExpired() int

CleanExpired removes all expired entries from the cache. This can be called periodically to prevent memory growth.

func (*IssuedTrustMarkCache) Clear added in v0.20.0 

func (c *IssuedTrustMarkCache) Clear()

Clear removes all entries from the cache.

func (*IssuedTrustMarkCache) Get added in v0.20.0 

func (c *IssuedTrustMarkCache) Get(trustMarkType, subject string) (string, bool)

Get retrieves a cached trust mark JWT. Returns the JWT and true if found and not expired, empty string and false otherwise.

func (*IssuedTrustMarkCache) Invalidate added in v0.20.0 

func (c *IssuedTrustMarkCache) Invalidate(trustMarkType, subject string)

Invalidate removes a specific entry from the cache. This should be called when a subject's status changes (e.g., blocked/revoked).

func (*IssuedTrustMarkCache) InvalidateAll added in v0.20.0 

func (c *IssuedTrustMarkCache) InvalidateAll(trustMarkType string)

InvalidateAll removes all entries for a specific trust mark type.

func (*IssuedTrustMarkCache) Set added in v0.20.0 

func (c *IssuedTrustMarkCache) Set(trustMarkType, subject, trustMarkJWT string, ttl time.Duration)

Set stores a trust mark JWT in the cache with the given TTL. If ttl <= 0, the entry is not cached.

func (*IssuedTrustMarkCache) Size added in v0.20.0 

func (c *IssuedTrustMarkCache) Size() int

Size returns the current number of entries in the cache.

func (*IssuedTrustMarkCache) StartCleanupRoutine added in v0.20.0 

func (c *IssuedTrustMarkCache) StartCleanupRoutine(interval time.Duration) (stop func())

StartCleanupRoutine starts a background goroutine that periodically cleans expired entries from the cache. Returns a stop function that should be called to stop the cleanup routine.

type JWTVerification added in v0.20.0 

type JWTVerification struct {
	Mode           JWTVerificationMode `yaml:"mode" json:"mode"`
	JWKS           *jwx.JWKS           `yaml:"jwks" json:"jwks,omitempty"`
	TrustAnchorIDs []string            `yaml:"trust_anchors" json:"trust_anchors,omitempty"`
}

JWTVerification configures how JWT signatures are verified

type JWTVerificationMode added in v0.20.0 

type JWTVerificationMode string

JWTVerificationMode defines how JWT signatures are verified 

const (
	// JWTVerificationModeJWKS verifies using a configured JWKS
	JWTVerificationModeJWKS JWTVerificationMode = "jwks"
	// JWTVerificationModeTrustAnchor verifies by building a trust chain to trust anchors
	JWTVerificationModeTrustAnchor JWTVerificationMode = "trust_anchor"
)

type LightHouse 

type LightHouse struct {
	oidfed.FederationEntity
	*oidfed.TrustMarkIssuer
	*jwx.GeneralJWTSigner

	LogoBanner    bool
	VersionBanner bool
	// contains filtered or unexported fields
}

LightHouse is a type a that represents a federation entity that can have multiple purposes (TA/IA + TMI, etc.)

func NewLightHouse 

func NewLightHouse(
	serverConf ServerConf,
	entityID string,
	signingConf SigningConf,
	storages model.Backends,
	admin AdminAPIOptions,
	statsConfig apistats.Config,
) (
	*LightHouse,
	error,
)

NewLightHouse creates a new LightHouse

func (*LightHouse) AddEnrollEndpoint 

func (fed *LightHouse) AddEnrollEndpoint(
	endpoint EndpointConf,
	store model.SubordinateStorageBackend,
	checker EntityChecker,
) error

AddEnrollEndpoint adds an endpoint to enroll to this IA/TA

func (*LightHouse) AddEnrollRequestEndpoint 

func (fed *LightHouse) AddEnrollRequestEndpoint(
	endpoint EndpointConf,
	store model.SubordinateStorageBackend,
) error

AddEnrollRequestEndpoint adds an endpoint to request enrollment to this IA /TA (this does only add a request to the storage, no automatic enrollment)

func (*LightHouse) AddEntityCollectionEndpoint 

func (fed *LightHouse) AddEntityCollectionEndpoint(
	endpoint EndpointConf, collector oidfed.EntityCollector,
	allowedTrustAnchors []string, paginationSupported bool,
) error

AddEntityCollectionEndpoint adds an entity collection endpoint

func (*LightHouse) AddFetchEndpoint 

func (fed *LightHouse) AddFetchEndpoint(endpoint EndpointConf, store model.SubordinateStorageBackend) error

AddFetchEndpoint adds a fetch endpoint

func (*LightHouse) AddHistoricalKeysEndpoint added in v0.6.0 

func (fed *LightHouse) AddHistoricalKeysEndpoint(endpoint EndpointConf) error

AddHistoricalKeysEndpoint adds the federation historical keys endpoint

func (*LightHouse) AddJWKSUpdateEndpoint added in v0.22.0 

func (fed *LightHouse) AddJWKSUpdateEndpoint(
	endpoint EndpointConf, store model.SubordinateStorageBackend,
) error

AddJWKSUpdateEndpoint adds the federation_jwks_update_endpoint. A subordinate POSTs a signed JWK Set (media type application/jwk-set+jwt, typ jwk-set+jwt) containing its new federation keys. Lighthouse validates that the JWT is signed with one of the subordinate's currently known federation keys and, if so, replaces the stored JWKS.

The endpoint is published in the federation_entity metadata under "federation_jwks_update_endpoint". No private_key_jwt client auth is used; authenticity is established by the signed JWK Set signature.

func (*LightHouse) AddJWKSUpdateTriggerEndpoint added in v0.22.0 

func (fed *LightHouse) AddJWKSUpdateTriggerEndpoint(
	endpoint EndpointConf, store model.SubordinateStorageBackend,
) error

AddJWKSUpdateTriggerEndpoint adds the federation_jwks_update_trigger_endpoint. A POST to this endpoint tells Lighthouse to re-fetch the subordinate's JWKS from its Entity Configuration and update the stored keys if they changed.

When AuthEnabled is true, private_key_jwt client authentication is required and the authenticated client entity is used as the target subordinate (any body "sub" is ignored). When AuthEnabled is false, the subordinate must be identified via the "sub" parameter in the request body.

The endpoint is published in the federation_entity metadata under "federation_jwks_update_trigger_endpoint".

func (*LightHouse) AddResolveEndpoint 

func (fed *LightHouse) AddResolveEndpoint(
	endpoint EndpointConf, allowedTrustAnchors []string, proactiveResolver *oidfed.ProactiveResolver,
) error

AddResolveEndpoint adds a resolve endpoint

func (*LightHouse) AddSubordinateListingEndpoint 

func (fed *LightHouse) AddSubordinateListingEndpoint(
	endpoint EndpointConf, store model.SubordinateStorageBackend,
	trustMarkStore model.TrustMarkedEntitiesStorageBackend,
) error

AddSubordinateListingEndpoint adds a subordinate listing endpoint

func (*LightHouse) AddTrustMarkEndpoint 

func (fed *LightHouse) AddTrustMarkEndpoint(
	endpoint EndpointConf,
	store model.TrustMarkedEntitiesStorageBackend,
	checkers map[string]EntityChecker,
)

AddTrustMarkEndpoint adds a trust mark endpoint

func (*LightHouse) AddTrustMarkEndpointWithConfig added in v0.20.0 

func (fed *LightHouse) AddTrustMarkEndpointWithConfig(
	endpoint EndpointConf,
	config TrustMarkEndpointConfig,
) error

AddTrustMarkEndpointWithConfig adds a trust mark endpoint with full configuration

func (*LightHouse) AddTrustMarkRequestEndpoint 

func (fed *LightHouse) AddTrustMarkRequestEndpoint(
	endpoint EndpointConf,
	store model.TrustMarkedEntitiesStorageBackend,
) error

AddTrustMarkRequestEndpoint adds an endpoint where entities can request to be entitled for a trust mark

func (*LightHouse) AddTrustMarkStatusEndpoint 

func (fed *LightHouse) AddTrustMarkStatusEndpoint(
	endpoint EndpointConf,
	config TrustMarkStatusConfig,
) error

AddTrustMarkStatusEndpoint adds a trust mark status endpoint compliant with OIDC Federation spec. The endpoint accepts POST requests with a trust_mark parameter containing the JWT to validate. It returns a signed JWT response with the status of the trust mark.

func (*LightHouse) AddTrustMarkedEntitiesListingEndpoint 

func (fed *LightHouse) AddTrustMarkedEntitiesListingEndpoint(
	endpoint EndpointConf,
	instanceStore model.IssuedTrustMarkInstanceStore,
) error

AddTrustMarkedEntitiesListingEndpoint adds a trust marked entities listing endpoint. Per OIDC Federation spec, this endpoint lists all entities for which trust marks have been issued and are still valid (non-revoked, non-expired).

func (*LightHouse) CreateSubordinateStatement 

func (fed *LightHouse) CreateSubordinateStatement(subordinate *model.ExtendedSubordinateInfo) oidfed.EntityStatementPayload

CreateSubordinateStatement returns an oidfed.EntityStatementPayload for the passed storage.ExtendedSubordinateInfo

func (*LightHouse) EndpointRegistry added in v0.22.0 

func (fed *LightHouse) EndpointRegistry() *EndpointRegistry

EndpointRegistry returns the endpoint registry (for testing/inspection).

func (*LightHouse) HasEndpoint added in v0.22.0 

func (fed *LightHouse) HasEndpoint(t model.FederationEndpointType) bool

HasEndpoint reports whether an endpoint of the given type is registered.

func (*LightHouse) HttpHandlerFunc 

func (fed *LightHouse) HttpHandlerFunc() http.HandlerFunc

HttpHandlerFunc returns an http.HandlerFunc for serving all the necessary endpoints

func (*LightHouse) Listen 

func (fed *LightHouse) Listen(addr string) error

Listen starts an http server at the specific address for serving all the necessary endpoints

func (*LightHouse) LoadEndpointsFromDB added in v0.22.0 

func (fed *LightHouse) LoadEndpointsFromDB() error

LoadEndpointsFromDB loads all federation endpoints from the database and registers them via the Add*Endpoint methods. This replaces the config-file based registerEndpoints when endpoints are DB-managed.

func (*LightHouse) RefreshSubordinateJWKSFromEC added in v0.22.0 

func (fed *LightHouse) RefreshSubordinateJWKSFromEC(entityID string) (changed bool, err error)

RefreshSubordinateJWKSFromEC fetches the subordinate's Entity Configuration and updates the stored JWKS if it changed. It returns whether the JWKS changed.

The subordinate must exist and have a status of Active or Pending (not Blocked or Inactive). The EC signature is verified against the currently stored JWKS.

func (*LightHouse) ReloadEndpointsFromDB added in v0.22.0 

func (fed *LightHouse) ReloadEndpointsFromDB() error

ReloadEndpointsFromDB clears the endpoint registry and reloads all federation endpoints from the database. It also stops/restarts background services and invalidates the entity configuration cache so published metadata reflects the new paths.

Old endpoint paths that were renamed, deleted, or disabled are kept alive in the legacy map for one entity configuration lifetime so clients holding a cached entity configuration can still reach them.

func (*LightHouse) RemoveTrustAnchor added in v0.22.0 

func (fed *LightHouse) RemoveTrustAnchor(entityID string)

RemoveTrustAnchor removes a TA from the in-memory repository. Called by the admin API after a trust anchor is deleted.

func (*LightHouse) SetJTICleanupStop added in v0.21.0 

func (fed *LightHouse) SetJTICleanupStop(stop func())

SetJTICleanupStop sets the cleanup stop function

func (*LightHouse) SetSubordinateJWKSRefresher added in v0.22.0 

func (fed *LightHouse) SetSubordinateJWKSRefresher(r *oidfed.SubordinateJWKSRefresher)

SetSubordinateJWKSRefresher sets the subordinate JWKS refresher.

func (*LightHouse) SetTAJWKSRefresher added in v0.22.0 

func (fed *LightHouse) SetTAJWKSRefresher(r *oidfed.TAJWKSRefresher)

SetTAJWKSRefresher sets the TA JWKS refresher.

func (*LightHouse) SetTrustAnchorRepo added in v0.22.0 

func (fed *LightHouse) SetTrustAnchorRepo(repo *TrustAnchorRepo)

SetTrustAnchorRepo sets the trust anchor repository.

func (*LightHouse) Start 

func (fed *LightHouse) Start()

func (*LightHouse) Stop added in v0.20.0 

func (fed *LightHouse) Stop() error

Stop gracefully shuts down the LightHouse server and its components.

func (*LightHouse) SubordinateJWKSRefresher added in v0.22.0 

func (fed *LightHouse) SubordinateJWKSRefresher() *oidfed.SubordinateJWKSRefresher

SubordinateJWKSRefresher returns the subordinate JWKS refresher, or nil if not initialized.

func (*LightHouse) SyncTrustAnchor added in v0.22.0 

func (fed *LightHouse) SyncTrustAnchor(entityID string)

SyncTrustAnchor reloads a TA from the database and updates the in-memory repository. Called by the admin API after a DB mutation on a trust anchor.

func (*LightHouse) TAJWKSRefresher added in v0.22.0 

func (fed *LightHouse) TAJWKSRefresher() *oidfed.TAJWKSRefresher

TAJWKSRefresher returns the TA JWKS refresher, or nil if not initialized.

func (*LightHouse) TAResolver added in v0.22.0 

func (fed *LightHouse) TAResolver() middleware.TAResolver

TAResolver returns a middleware.TAResolver that resolves trust anchor entity IDs to oidfed.TrustAnchors via the in-memory repo. If the repo is nil, falls back to creating TrustAnchors from entity IDs without JWKS (suitable for trust-chain resolution that fetches JWKS itself).

func (*LightHouse) TrustAnchorRepo added in v0.22.0 

func (fed *LightHouse) TrustAnchorRepo() *TrustAnchorRepo

TrustAnchorRepo returns the trust anchor repository, or nil if not initialized.

type MultipleEntityCheckerAnd 

type MultipleEntityCheckerAnd struct {
	Checkers []EntityChecker
}

MultipleEntityCheckerAnd is an EntityChecker that combines multiple EntityChecker by requiring all checks to pass

func NewMultipleEntityCheckerAnd 

func NewMultipleEntityCheckerAnd(
	checkers ...EntityChecker,
) *MultipleEntityCheckerAnd

NewMultipleEntityCheckerAnd returns a new MultipleEntityCheckerAnd using all the passed EntityChecker

func (MultipleEntityCheckerAnd) Check 

func (c MultipleEntityCheckerAnd) Check(entityStatement *oidfed.EntityStatement, entityTypes []string) (
	bool, int, *oidfed.Error,
)

Check implements the EntityChecker interface

func (*MultipleEntityCheckerAnd) UnmarshalYAML 

func (c *MultipleEntityCheckerAnd) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interfaces

type MultipleEntityCheckerOr 

type MultipleEntityCheckerOr struct {
	Checkers []EntityChecker
}

MultipleEntityCheckerOr is an EntityChecker that combines multiple EntityChecker by requiring only one check to pass

func NewMultipleEntityCheckerOr 

func NewMultipleEntityCheckerOr(checkers ...EntityChecker) *MultipleEntityCheckerOr

NewMultipleEntityCheckerOr returns a new MultipleEntityCheckerOr using all the passed EntityChecker

func (MultipleEntityCheckerOr) Check 

func (c MultipleEntityCheckerOr) Check(
	entityStatement *oidfed.EntityStatement, entityTypes []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*MultipleEntityCheckerOr) UnmarshalYAML 

func (c *MultipleEntityCheckerOr) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interfaces

type ServerConf 

type ServerConf struct {
	// IPListen is the IP address to listen on.
	// Env: LH_SERVER_IP_LISTEN
	IPListen string `yaml:"ip_listen" envconfig:"IP_LISTEN"`
	// Port is the HTTP server port.
	// Env: LH_SERVER_PORT
	Port int `yaml:"port" envconfig:"PORT"`
	// AdminAPIPort is set internally and not configurable via env.
	AdminAPIPort int `yaml:"-" envconfig:"-"`
	// AdminTLS holds TLS configuration for the admin API.
	// Env prefix: LH_API_ADMIN_TLS_
	AdminTLS TLSConf `yaml:"admin_tls" envconfig:"ADMIN_TLS"`
	// TLS holds TLS configuration.
	// Env prefix: LH_SERVER_TLS_
	TLS tlsConf `yaml:"tls" envconfig:"TLS"`
	// TrustedProxies is a list of trusted proxy IPs.
	// Env: LH_SERVER_TRUSTED_PROXIES (comma-separated)
	TrustedProxies []string `yaml:"trusted_proxies" envconfig:"TRUSTED_PROXIES"`
	// ForwardedIPHeader is the header name for forwarded IP.
	// Env: LH_SERVER_FORWARDED_IP_HEADER
	ForwardedIPHeader string `yaml:"forwarded_ip_header" envconfig:"FORWARDED_IP_HEADER"`
	// CORS holds CORS middleware configuration for the main server.
	// Env prefix: LH_SERVER_CORS_
	CORS CORSConf `yaml:"cors" envconfig:"CORS"`
	// AccessLogWriter is the io.Writer used for HTTP access logs (fiber
	// logger middleware). Set internally by the application entry point from
	// the logging configuration; not configurable via YAML or env.
	AccessLogWriter io.Writer `yaml:"-" envconfig:"-"`
}

ServerConf holds the server configuration.

Environment variables (accent prefix LH_SERVER_):

  • LH_SERVER_IP_LISTEN: IP address to listen on
  • LH_SERVER_PORT: HTTP server port
  • LH_SERVER_TRUSTED_PROXIES: Comma-separated list of trusted proxy IPs
  • LH_SERVER_FORWARDED_IP_HEADER: Header name for forwarded IP
  • LH_SERVER_TLS_ENABLED: Enable TLS
  • LH_SERVER_TLS_REDIRECT_HTTP: Redirect HTTP to HTTPS
  • LH_SERVER_TLS_CERT: Path to TLS certificate
  • LH_SERVER_TLS_KEY: Path to TLS private key
  • LH_SERVER_CORS_*: CORS configuration (see CORSConf)

type SigningConf added in v0.20.0 

type SigningConf struct {
	// KMS specifies the key management system to use.
	// Env: LH_SIGNING_KMS
	KMS string `yaml:"kms" envconfig:"KMS"`
	// PKBackend specifies the public key storage backend.
	// Env: LH_SIGNING_PK_BACKEND
	PKBackend string `yaml:"pk_backend" envconfig:"PK_BACKEND"`
	// AutoGenerateKeys enables automatic key generation if keys are missing.
	// Env: LH_SIGNING_AUTO_GENERATE_KEYS
	AutoGenerateKeys bool `yaml:"auto_generate_keys" envconfig:"AUTO_GENERATE_KEYS"`
	// FileSystemBackend holds filesystem-based key storage configuration.
	// Env prefix: LH_SIGNING_FILESYSTEM_
	FileSystemBackend struct {
		// KeyFile is the path to a single key file.
		// Env: LH_SIGNING_FILESYSTEM_KEY_FILE
		KeyFile string `yaml:"key_file" envconfig:"KEY_FILE"`
		// KeyDir is the directory for key files.
		// Env: LH_SIGNING_FILESYSTEM_KEY_DIR
		KeyDir string `yaml:"key_dir" envconfig:"KEY_DIR"`
	} `yaml:"filesystem" envconfig:"FILESYSTEM"`
	// PKCS11Backend holds PKCS#11 (HSM) configuration.
	// Env prefix: LH_SIGNING_PKCS11_
	PKCS11Backend struct {
		// StorageDir is the storage directory for PKCS#11.
		// Env: LH_SIGNING_PKCS11_STORAGE_DIR
		StorageDir string `yaml:"storage_dir" envconfig:"STORAGE_DIR"`

		// ModulePath is the path to the PKCS#11 module (crypto11.Config.Path)
		// Env: LH_SIGNING_PKCS11_MODULE_PATH
		ModulePath string `yaml:"module_path" envconfig:"MODULE_PATH"`
		// TokenLabel selects the token by label (crypto11.Config.TokenLabel)
		// Env: LH_SIGNING_PKCS11_TOKEN_LABEL
		TokenLabel string `yaml:"token_label" envconfig:"TOKEN_LABEL"`
		// TokenSerial selects the token by serial (crypto11.Config.TokenSerial)
		// Env: LH_SIGNING_PKCS11_TOKEN_SERIAL
		TokenSerial string `yaml:"token_serial" envconfig:"TOKEN_SERIAL"`
		// SlotNumber selects the token by slot number (crypto11.Config.SlotNumber)
		// Env: LH_SIGNING_PKCS11_TOKEN_SLOT
		SlotNumber *int `yaml:"token_slot" envconfig:"TOKEN_SLOT"`
		// Pin is the user PIN for the token (crypto11.Config.Pin)
		// Env: LH_SIGNING_PKCS11_PIN
		Pin string `yaml:"pin" envconfig:"PIN"`

		// MaxSessions is the maximum number of concurrent sessions to open.
		// If zero, DefaultMaxSessions is used. Otherwise, must be at least 2.
		// Env: LH_SIGNING_PKCS11_MAX_SESSIONS
		MaxSessions int `yaml:"max_sessions" envconfig:"MAX_SESSIONS"`

		// UserType identifies the user type logging in. If zero, DefaultUserType is used.
		// Env: LH_SIGNING_PKCS11_USER_TYPE
		UserType int `yaml:"user_type" envconfig:"USER_TYPE"`

		// LoginNotSupported should be set to true for tokens that do not support logging in.
		// Env: LH_SIGNING_PKCS11_NO_LOGIN
		LoginNotSupported bool `yaml:"no_login" envconfig:"NO_LOGIN"`

		// LabelPrefix is an optional prefix for object labels inside HSM.
		// Env: LH_SIGNING_PKCS11_LABEL_PREFIX
		LabelPrefix string `yaml:"label_prefix" envconfig:"LABEL_PREFIX"`

		// ExtraLabels are HSM object labels to load into this KMS even if
		// they are not present yet in the PublicKeyStorage.
		// Env: LH_SIGNING_PKCS11_LOAD_LABELS (comma-separated)
		ExtraLabels []string `yaml:"load_labels" envconfig:"LOAD_LABELS"`
	} `yaml:"pkcs11" envconfig:"PKCS11"`
}

SigningConf holds signing configuration.

Environment variables (with prefix LH_SIGNING_):

  • LH_SIGNING_KMS: Key management system ("filesystem", "pkcs11", or "db")
  • LH_SIGNING_PK_BACKEND: Public key storage backend ("filesystem" or "db")
  • LH_SIGNING_AUTO_GENERATE_KEYS: Auto-generate keys if missing (bool)
  • LH_SIGNING_FILESYSTEM_KEY_FILE: Path to single key file
  • LH_SIGNING_FILESYSTEM_KEY_DIR: Directory for key files
  • LH_SIGNING_PKCS11_STORAGE_DIR: PKCS#11 storage directory
  • LH_SIGNING_PKCS11_MODULE_PATH: Path to PKCS#11 module
  • LH_SIGNING_PKCS11_TOKEN_LABEL: HSM token label
  • LH_SIGNING_PKCS11_TOKEN_SERIAL: HSM token serial
  • LH_SIGNING_PKCS11_TOKEN_SLOT: HSM slot number
  • LH_SIGNING_PKCS11_PIN: HSM user PIN
  • LH_SIGNING_PKCS11_MAX_SESSIONS: Maximum concurrent sessions
  • LH_SIGNING_PKCS11_USER_TYPE: User type for login
  • LH_SIGNING_PKCS11_NO_LOGIN: Token doesn't support login (bool)
  • LH_SIGNING_PKCS11_LABEL_PREFIX: Prefix for object labels
  • LH_SIGNING_PKCS11_LOAD_LABELS: Extra labels to load (comma-separated)

type SubordinateListingRequest added in v0.20.0 

type SubordinateListingRequest struct {
	EntityType    []string `json:"entity_type" query:"entity_type"`
	Intermediate  bool     `json:"intermediate" query:"intermediate"`
	TrustMarked   bool     `json:"trust_marked" query:"trust_marked"`
	TrustMarkType string   `json:"trust_mark_type" query:"trust_mark_type"`
}

type TLSConf added in v0.20.4 

type TLSConf struct {
	// Enabled enables TLS.
	// Env: *_TLS_ENABLED
	Enabled bool `yaml:"enabled" envconfig:"ENABLED"`
	// RedirectHTTP redirects HTTP to HTTPS.
	// Env: *_TLS_REDIRECT_HTTP
	RedirectHTTP bool `yaml:"redirect_http" envconfig:"REDIRECT_HTTP"`
	// Cert is the path to the TLS certificate.
	// Env: *_TLS_CERT
	Cert string `yaml:"cert" envconfig:"CERT"`
	// Key is the path to the TLS private key.
	// Env: *_TLS_KEY
	Key string `yaml:"key" envconfig:"KEY"`
}

TLSConf holds TLS configuration.

Environment variables (with prefix based on parent, e.g., LH_SERVER_TLS_ or LH_API_ADMIN_TLS_):

  • *_TLS_ENABLED: Enable TLS
  • *_TLS_REDIRECT_HTTP: Redirect HTTP to HTTPS
  • *_TLS_CERT: Path to TLS certificate
  • *_TLS_KEY: Path to TLS private key

type TrustAnchorRepo added in v0.22.0 

type TrustAnchorRepo struct {
	// contains filtered or unexported fields
}

TrustAnchorRepo is the in-memory, single-source-of-truth repository for trust anchors. It holds canonical *oidfed.TrustAnchor instances keyed by entity_id, loaded from the database at startup.

All consumers across LightHouse (client auth middleware, entity checkers, allowed-trust-anchor lists, ...) resolve TAs by entity_id through this repo so that JWKS refreshed by the TAJWKSRefresher propagate live to every usage without restart.

func NewTrustAnchorRepo added in v0.22.0 

func NewTrustAnchorRepo(store model.TrustAnchorStore) *TrustAnchorRepo

NewTrustAnchorRepo creates a new TrustAnchorRepo backed by the given store. Call Load() to populate it from the database.

func (*TrustAnchorRepo) Add added in v0.22.0 

func (r *TrustAnchorRepo) Add(m *model.TrustAnchor)

Add adds or replaces a trust anchor in the in-memory map from a model row. This does not write to the database; use the storage layer for persistence.

func (*TrustAnchorRepo) AddOrUpdate added in v0.22.0 

func (r *TrustAnchorRepo) AddOrUpdate(entityID string)

AddOrUpdate loads a TA from the store by entity_id and adds or updates it in the in-memory repo. This is used by the admin API after a DB mutation.

func (*TrustAnchorRepo) All added in v0.22.0 

func (r *TrustAnchorRepo) All() oidfed.TrustAnchors

All returns all trust anchors currently in the repository.

func (*TrustAnchorRepo) AllWithJWKSUpdate added in v0.22.0 

func (r *TrustAnchorRepo) AllWithJWKSUpdate() oidfed.TrustAnchors

AllWithJWKSUpdate returns all trust anchors with EnableJWKSUpdate=true.

func (*TrustAnchorRepo) Count added in v0.22.0 

func (r *TrustAnchorRepo) Count() int

Count returns the number of trust anchors in the repository.

func (*TrustAnchorRepo) Get added in v0.22.0 

func (r *TrustAnchorRepo) Get(entityID string) *oidfed.TrustAnchor

Get returns the *oidfed.TrustAnchor for the given entity_id, or nil if not found.

func (*TrustAnchorRepo) Has added in v0.22.0 

func (r *TrustAnchorRepo) Has(entityID string) bool

Has reports whether an entity is in the repository.

func (*TrustAnchorRepo) Load added in v0.22.0 

func (r *TrustAnchorRepo) Load() error

Load (re)loads all trust anchors from the database into the in-memory map. Existing *oidfed.TrustAnchor pointers are preserved when the entity still exists (so concurrent readers holding a pointer see the JWKS update in place); entries for removed TAs are dropped.

func (*TrustAnchorRepo) Remove added in v0.22.0 

func (r *TrustAnchorRepo) Remove(entityID string)

Remove removes a trust anchor from the in-memory map.

func (*TrustAnchorRepo) Resolve added in v0.22.0 

func (r *TrustAnchorRepo) Resolve(entityIDs ...string) oidfed.TrustAnchors

Resolve returns oidfed.TrustAnchors for the given entity ids, skipping any that are not in the repository.

func (*TrustAnchorRepo) Store added in v0.22.0 

func (r *TrustAnchorRepo) Store() model.TrustAnchorStore

Store returns the underlying trust anchor store (for admin API use).

func (*TrustAnchorRepo) UpdateJWKS added in v0.22.0 

func (r *TrustAnchorRepo) UpdateJWKS(entityID string, jwks jwx.JWKS)

UpdateJWKS updates the in-memory JWKS for an entity atomically.

type TrustMarkEndpointConfig added in v0.20.0 

type TrustMarkEndpointConfig struct {
	// Store for subject status (backward compatibility)
	Store model.TrustMarkedEntitiesStorageBackend
	// SpecStore for loading TrustMarkSpec from DB (new)
	SpecStore model.TrustMarkSpecStore
	// InstanceStore for tracking issued trust mark instances
	InstanceStore model.IssuedTrustMarkInstanceStore
	// Checkers map for backward compatibility (config-based checkers).
	//
	// Deprecated: This field is no longer used. Checkers should be configured
	// per TrustMarkSpec via EligibilityConfig in the database using the Admin API.
	// This field will be removed in a future version.
	Checkers map[string]EntityChecker
	// Cache for eligibility results
	Cache *EligibilityCache
	// IssuedTrustMarkCache caches issued trust mark JWTs to avoid repeated signing.
	// The TTL is configured per trust mark type via the TrustMarkSpec.CacheTTL field.
	IssuedTrustMarkCache *IssuedTrustMarkCache
}

TrustMarkEndpointConfig holds configuration for the trust mark endpoint

type TrustMarkEntityChecker 

type TrustMarkEntityChecker struct {
	TrustMarkType       string                    `yaml:"trust_mark_type" json:"trust_mark_type"`
	TrustAnchorIDs      []string                  `yaml:"trust_anchors" json:"trust_anchors"`
	TrustMarkIssuerJWKS jwx.JWKS                  `yaml:"trust_mark_issuer_jwks" json:"trust_mark_issuer_jwks"`
	TrustMarkOwnerSpec  oidfed.TrustMarkOwnerSpec `yaml:"trust_mark_owner" json:"trust_mark_owner"`
}

TrustMarkEntityChecker checks that the entity has a valid trust mark. The trust mark can be checked with a specific issuer or through the federation

func (TrustMarkEntityChecker) Check 

func (c TrustMarkEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	entityTypes []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*TrustMarkEntityChecker) UnmarshalYAML 

func (c *TrustMarkEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interface

type TrustMarkStatusConfig added in v0.20.0 

type TrustMarkStatusConfig struct {
	// InstanceStore for checking issued trust mark instances
	InstanceStore model.IssuedTrustMarkInstanceStore
}

TrustMarkStatusConfig holds configuration for the trust mark status endpoint

type TrustMarkStatusResponse added in v0.20.0 

type TrustMarkStatusResponse struct {
	Issuer    string `json:"iss"`
	IssuedAt  int64  `json:"iat"`
	TrustMark string `json:"trust_mark"`
	Status    string `json:"status"`
}

TrustMarkStatusResponse represents the JWT payload for trust mark status response

type TrustPathEntityChecker 

type TrustPathEntityChecker struct {
	TrustAnchorIDs []string `yaml:"trust_anchors" json:"trust_anchors"`
}

TrustPathEntityChecker checks that the entity has a valid trust path to a trust anchor

func (TrustPathEntityChecker) Check 

func (c TrustPathEntityChecker) Check(
	entityConfiguration *oidfed.EntityStatement,
	entityTypes []string,
) (bool, int, *oidfed.Error)

Check implements the EntityChecker interface

func (*TrustPathEntityChecker) UnmarshalYAML 

func (c *TrustPathEntityChecker) UnmarshalYAML(node *yaml.Node) error

UnmarshalYAML implements the yaml.Unmarshaler and EntityChecker interface

Source Files

View all Source files

Directories

Path Synopsis
api
adminapi
Package adminapi provides the admin API for managing subordinates in the lighthouse federation.
 Package adminapi provides the admin API for managing subordinates in the lighthouse federation.
stats
cmd
lhcli command
lhmigrate command
lhsetup command
lighthouse command
lighthouse/config
logger
migration
stats
utils
version
model

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.