Documentation
¶
Index ¶
Constants ¶
const ( // ExternalResolverStrategySmart tries the configured resolve endpoints, then // falls back to smart (per-trust-anchor) resolving and finally local // resolving. ExternalResolverStrategySmart externalResolverStrategy = "smart" // ExternalResolverStrategyStrict only uses the configured resolve endpoints // and propagates the last error when none succeeds. ExternalResolverStrategyStrict externalResolverStrategy = "strict" )
Variables ¶
var DefaultForwardHeaders = map[string]oidfed.SliceOrSingleValue[model.Claim]{
"X-Forwarded-User": {
"preferred_username",
"sub",
},
"X-Forwarded-Email": {"email"},
"X-Forwarded-Provider": {"iss"},
"X-Forwarded-Subject": {"sub"},
"X-Forwarded-Groups": {
"entitlements",
"groups",
},
"X-Forwarded-Name": {"name"},
}
var DefaultMemCachedClaims = map[string]oidfed.SliceOrSingleValue[model.Claim]{
"UserName": {
"preferred_username",
"sub",
},
"Groups": {"groups"},
"Email": {"email"},
"Name": {"name"},
"GivenName": {"given_name"},
"Provider": {"iss"},
"Subject": {"sub"},
}
Functions ¶
func MustLoadConfig ¶
func MustLoadConfig()
Types ¶
type AuthRule ¶
type AuthRule struct {
Domain string `yaml:"domain"`
DomainRegex string `yaml:"domain_regex"`
DomainPattern *regexp.Regexp `yaml:"-"`
Path string `yaml:"path"`
PathRegex string `yaml:"path_regex"`
PathPattern *regexp.Regexp `yaml:"-"`
Require oidfed.SliceOrSingleValue[map[model.Claim]oidfed.SliceOrSingleValue[string]] `yaml:"require"`
ForwardHeaders map[string]oidfed.SliceOrSingleValue[model.Claim] `yaml:"forward_headers"`
ForwardHeadersPrefix string `yaml:"forward_headers_prefix"`
RedirectStatusCode int `yaml:"redirect_status"`
}
type AuthorityHint ¶ added in v0.5.0
type AuthorityHint struct {
EntityID string `yaml:"entity_id"`
JWKSSync JWKSSyncConf `yaml:"jwks_sync"`
}
AuthorityHint is a federation authority hint: a direct superior entity that issues a statement about OFFA. The optional JWKSSync configures syncing of rotated federation keys to this authority hint.
type AuthorityHintList ¶ added in v0.5.0
type AuthorityHintList []AuthorityHint
AuthorityHintList is a list of AuthorityHint with a YAML unmarshaler that accepts both the legacy plain-string form and the structured object form. A plain string is equivalent to an object with entity_id set and jwks_sync.mode = "none".
func (AuthorityHintList) EntityIDs ¶ added in v0.5.0
func (l AuthorityHintList) EntityIDs() []string
EntityIDs returns the entity IDs of all authority hints.
func (AuthorityHintList) HasSyncMode ¶ added in v0.5.0
func (l AuthorityHintList) HasSyncMode() bool
HasSyncMode returns true if any authority hint uses a non-none sync mode.
func (*AuthorityHintList) UnmarshalYAML ¶ added in v0.5.0
func (l *AuthorityHintList) UnmarshalYAML(value *yaml.Node) error
UnmarshalYAML implements yaml.Unmarshaler. Each item may be either a scalar (the entity_id) or a mapping with entity_id and optional jwks_sync.
type Config ¶
type Config struct {
Server serverConf `yaml:"server"`
Logging loggingConf `yaml:"logging"`
Federation federationConf `yaml:"federation"`
Auth authConf `yaml:"auth"`
SessionStorage sessionConf `yaml:"sessions"`
Signing signingConf `yaml:"signing"`
DebugAuth bool `yaml:"debug_auth"`
OPDiscovery opDiscoveryConf `yaml:"op_discovery"`
}
Config holds the configuration for this application
type JWKSSyncConf ¶ added in v0.5.0
type JWKSSyncConf struct {
// Mode selects the sync mechanism. Default: none.
Mode JWKSSyncMode `yaml:"mode"`
// JWTLifetime is the lifetime (exp - iat) of the signed JWKS JWT sent in
// push mode. Default: 10 minutes. Ignored in other modes.
JWTLifetime duration.DurationOption `yaml:"jwt_lifetime"`
// Timeout is the HTTP client timeout for the sync request. Default: 20s.
Timeout duration.DurationOption `yaml:"timeout"`
// Headers are additional HTTP headers set on the sync request.
Headers map[string]string `yaml:"headers"`
}
JWKSSyncConf configures optional syncing of rotated federation keys to an authority hint. It only has an effect when automatic key rollover is enabled for the federation signing keys (signing.federation.automatic_key_rollover).
type JWKSSyncMode ¶ added in v0.5.0
type JWKSSyncMode string
JWKSSyncMode selects how (if at all) rotated federation keys are synced to an authority hint after a key rotation.
const ( // JWKSSyncNone disables syncing. This is the default for legacy // string-form authority hints. JWKSSyncNone JWKSSyncMode = "none" // JWKSSyncPush pushes a signed JWK Set (application/jwk-set+jwt) to the // authority hint's federation_jwks_update_endpoint. The endpoint URL and // acceptable signing algorithms are resolved dynamically from the // authority hint's Entity Configuration on each rotation. Corresponds to // oidfed.JWKSUpdateHook in the go-oidfed lib. JWKSSyncPush JWKSSyncMode = "push" // JWKSSyncTrigger POSTs the entity_id to the authority hint's // federation_jwks_update_trigger_endpoint (authenticated with // private_key_jwt), telling it to re-fetch this entity's JWKS from its // Entity Configuration. Corresponds to oidfed.TriggerUpdateHook in the // go-oidfed lib. JWKSSyncTrigger JWKSSyncMode = "trigger" )
type KeyStorageConf ¶ added in v0.4.4
type LoggerConf ¶
LoggerConf holds configuration related to logging
Source Files