Documentation
¶
Index ¶
Constants ¶
const ( CategoryMalformed = "malformed" CategorySignature = "signature" CategoryIssuer = "issuer" CategoryAudience = "audience" CategoryExpired = "expired" CategoryNotYetValid = "not_yet_valid" CategoryUnknownKID = "unknown_kid" CategoryAlgorithm = "algorithm" CategoryTyp = "typ" CategoryScope = "scope" CategoryIdentity = "identity" )
Failure categories logged instead of token material or issuer URLs.
Variables ¶
var ErrInsufficientScope = errors.New("insufficient_scope")
ErrInsufficientScope is returned when required scopes are missing.
var ErrInvalidToken = errors.New("invalid_token")
ErrInvalidToken is returned for a token the resource server rejects.
ErrUnavailable is returned when the authorization server cannot be used.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Issuer string
Audience string
JWKSURL string
RequiredScopes []string
IdentityClaim string
}
Config is the resource-server verification configuration. IdentityClaim empty means "sub".
type DiscoveryError ¶
type DiscoveryError struct {
Category string
// contains filtered or unexported fields
}
DiscoveryError is a discovery or key-set failure. Error text does not include the issuer URL or any token.
func (*DiscoveryError) Error ¶
func (e *DiscoveryError) Error() string
func (*DiscoveryError) Is ¶
func (e *DiscoveryError) Is(target error) bool
func (*DiscoveryError) Unwrap ¶
func (e *DiscoveryError) Unwrap() error
type Principal ¶
Principal is a verified access token's identity. ID is the identity claim. Scopes is the union of scope and scp. Expiry is the token exp.
type ScopeError ¶
ScopeError is an insufficient-scope rejection. Required is the configured scope list, used in the WWW-Authenticate scope parameter.
func (*ScopeError) Error ¶
func (e *ScopeError) Error() string
func (*ScopeError) Is ¶
func (e *ScopeError) Is(target error) bool
func (*ScopeError) Unwrap ¶
func (e *ScopeError) Unwrap() error
type TokenError ¶
TokenError is an invalid token with a log category. It never carries the raw token.
func (*TokenError) Error ¶
func (e *TokenError) Error() string
func (*TokenError) Is ¶
func (e *TokenError) Is(target error) bool
func (*TokenError) Unwrap ¶
func (e *TokenError) Unwrap() error
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier validates RFC 9068 access tokens against an external issuer. A failed startup discovery does not make New fail closed: Ready retries with backoff, and protected routes answer 503 until a key set is available.
func New ¶
New builds a verifier and attempts discovery once, bounded by 10 seconds. The returned verifier is usable when err is non-nil: Ready retries. ctx is the daemon lifetime context used for later JWKS refreshes. client, when nil, is an http.Client with a 10-second timeout.
func (*Verifier) Close ¶
func (v *Verifier) Close()
Close cancels outstanding JWKS fetches when the owning server shuts down.
Source Files