Documentation
¶
Overview ¶
Package auth carries the caller's identity through a request: the one secret every agent of a server shares, and the agent id each agent declares.
Index ¶
- Constants
- Variables
- func Agent(ctx context.Context) (string, bool)
- func Bearer(ctx context.Context) (string, bool)
- func Stream(authenticate Authenticator) grpc.StreamServerInterceptor
- func StreamInterceptor(secret string) grpc.StreamServerInterceptor
- func Unary(authenticate Authenticator) grpc.UnaryServerInterceptor
- func UnaryInterceptor(secret string) grpc.UnaryServerInterceptor
- func WithPrincipal(ctx context.Context, p *Principal) context.Context
- type Authenticator
- type Credentials
- type Principal
Constants ¶
const (
// AgentHeader carries the agent id the caller declares.
AgentHeader = "goback-agent"
)
Variables ¶
var ErrForbidden = errors.New("not allowed for this caller")
ErrForbidden is returned when the principal may not do what it asked.
var ErrUnauthenticated = errors.New("no caller identity")
ErrUnauthenticated is returned when a request carries no principal.
Functions ¶
func Stream ¶
func Stream(authenticate Authenticator) grpc.StreamServerInterceptor
Stream runs authenticate before every streaming call.
func StreamInterceptor ¶
func StreamInterceptor(secret string) grpc.StreamServerInterceptor
StreamInterceptor is UnaryInterceptor for streaming calls.
func Unary ¶
func Unary(authenticate Authenticator) grpc.UnaryServerInterceptor
Unary runs authenticate before every unary call.
func UnaryInterceptor ¶
func UnaryInterceptor(secret string) grpc.UnaryServerInterceptor
UnaryInterceptor rejects calls that do not present secret and attaches the declared agent as the principal of the ones that do.
Types ¶
type Authenticator ¶
Authenticator decides who an incoming call is from and returns the context to handle it with, or a status error refusing it.
func SharedSecret ¶
func SharedSecret(secret string) Authenticator
SharedSecret authenticates callers presenting secret as bearer token and attaches the agent they declare as the principal.
type Credentials ¶
type Credentials struct {
Secret string
AgentID string
// Plaintext allows the secret onto a connection nothing encrypts,
// where anyone on the path can read it and everything it uploads.
// It is for a store on the same machine, nothing further.
Plaintext bool
}
Credentials sends the shared secret and the agent id with every call and refuses to do so over a plaintext connection unless Plaintext says otherwise.
func (Credentials) GetRequestMetadata ¶
GetRequestMetadata implements credentials.PerRPCCredentials.
func (Credentials) RequireTransportSecurity ¶
func (c Credentials) RequireTransportSecurity() bool
RequireTransportSecurity implements credentials.PerRPCCredentials.
Source Files