Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

security

package

Go to main page

Versions in this module

v1

v1.1.0

Mar 15, 2026

Changes in this version

type ACLAuthorizer

+ func (a *ACLAuthorizer) HasACLEntries() bool

type Manager

+ func (m *Manager) HasACLEntries() bool

v1.0.1

Nov 22, 2025

Changes in this version

+ const PrincipalContextKey

+ func ContextWithPrincipal(ctx context.Context, principal *Principal) context.Context

+ func DeriveKeyFromPassword(password string, salt []byte, iterations int) []byte

+ func GenerateAPIKey() (string, error)

+ func GenerateSalt() ([]byte, error)

+ func GetRecommendedCipherSuites() []uint16

+ func NewTLSConfig(cfg *TLSConfig) (*tls.Config, error)

+ func VerifyPassword(user *User, password string, authMethod AuthMethod) error

+ type ACLAuthorizer struct

+ func NewACLAuthorizer(config *SecurityConfig) *ACLAuthorizer

+ func (a *ACLAuthorizer) AddACL(entry *ACLEntry) error

+ func (a *ACLAuthorizer) Authorize(ctx context.Context, principal *Principal, action Action, resource Resource) (bool, error)

+ func (a *ACLAuthorizer) ClearACLs()

+ func (a *ACLAuthorizer) FindACLs(resourceType ResourceType, resourceName string, action Action) []*ACLEntry

+ func (a *ACLAuthorizer) GetACL(id string) (*ACLEntry, error)

+ func (a *ACLAuthorizer) ListACLs() []*ACLEntry

+ func (a *ACLAuthorizer) RemoveACL(id string) error

+ type ACLBuilder struct

+ func NewACLBuilder() *ACLBuilder

+ func (b *ACLBuilder) Allow() *ACLBuilder

+ func (b *ACLBuilder) Build() *ACLEntry

+ func (b *ACLBuilder) CreatedBy(creator string) *ACLBuilder

+ func (b *ACLBuilder) Deny() *ACLBuilder

+ func (b *ACLBuilder) ForAction(action Action) *ACLBuilder

+ func (b *ACLBuilder) ForPrincipal(principal string) *ACLBuilder

+ func (b *ACLBuilder) OnResource(resourceType ResourceType, resourceName string) *ACLBuilder

+ func (b *ACLBuilder) WithPatternType(patternType PatternType) *ACLBuilder

+ type ACLEntry struct

+ Action Action

+ CreatedAt time.Time

+ CreatedBy string

+ ID string

+ PatternType PatternType

+ Permission Permission

+ Principal string

+ ResourceName string

+ ResourceType ResourceType

+ func DefaultACLs() []*ACLEntry

+ func RestrictiveACLs() []*ACLEntry

+ type APIKey struct

+ Attributes map[string]string

+ CreatedAt time.Time

+ Enabled bool

+ ExpiresAt *time.Time

+ Groups []string

+ Key string

+ PrincipalID string

+ Secret string

+ Type PrincipalType

+ type APIKeyAuthenticator struct

+ func NewAPIKeyAuthenticator() *APIKeyAuthenticator

+ func (a *APIKeyAuthenticator) AddAPIKey(key *APIKey)

+ func (a *APIKeyAuthenticator) Authenticate(ctx context.Context, credentials interface{}) (*Principal, error)

+ func (a *APIKeyAuthenticator) Method() AuthMethod

+ type APIKeyCredentials struct

+ APIKey string

+ APISecret string

+ func (c *APIKeyCredentials) Type() AuthMethod

+ type Action string

+ const ActionClusterAction

+ const ActionClusterAlter

+ const ActionClusterDescribe

+ const ActionGroupDelete

+ const ActionGroupDescribe

+ const ActionGroupRead

+ const ActionSchemaCompat

+ const ActionSchemaDelete

+ const ActionSchemaRead

+ const ActionSchemaWrite

+ const ActionTopicAlter

+ const ActionTopicCreate

+ const ActionTopicDelete

+ const ActionTopicDescribe

+ const ActionTopicRead

+ const ActionTopicReadCommit

+ const ActionTopicWrite

+ const ActionTransactionDescribe

+ const ActionTransactionWrite

+ type AuditEvent struct

+ Action Action

+ ClientIP string

+ ErrorMessage string

+ Metadata map[string]string

+ Principal *Principal

+ Resource Resource

+ Result AuditResult

+ Timestamp time.Time

+ type AuditEventBuilder struct

+ func NewAuditEventBuilder() *AuditEventBuilder

+ func (b *AuditEventBuilder) Build() *AuditEvent

+ func (b *AuditEventBuilder) WithAction(action Action) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithClientIP(ip string) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithError(err error) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithMetadata(key, value string) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithPrincipal(principal *Principal) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithResource(resource Resource) *AuditEventBuilder

+ func (b *AuditEventBuilder) WithResult(result AuditResult) *AuditEventBuilder

+ type AuditLogger interface

+ LogEvent func(event *AuditEvent) error

+ type AuditResult string

+ const AuditResultDenied

+ const AuditResultFailure

+ const AuditResultSuccess

+ type AuthMethod string

+ const AuthMethodAPIKey

+ const AuthMethodJWT

+ const AuthMethodMTLS

+ const AuthMethodNone

+ const AuthMethodOAuth

+ const AuthMethodSASLPlain

+ const AuthMethodSASLSCRAM256

+ const AuthMethodSASLSCRAM512

+ const AuthMethodTLS

+ type Authenticator interface

+ Authenticate func(ctx context.Context, credentials interface{}) (*Principal, error)

+ Method func() AuthMethod

+ type Authorizer interface

+ Authorize func(ctx context.Context, principal *Principal, action Action, resource Resource) (bool, error)

+ type Credentials interface

+ Type func() AuthMethod

+ type DataEncryptionKey struct

+ Active bool

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ Key []byte

+ type EncryptedData struct

+ Algorithm string

+ CreatedAt time.Time

+ Data []byte

+ KeyID string

+ Nonce []byte

+ type EncryptionAlgorithm string

+ const EncryptionAlgorithmAES256GCM

+ type EncryptionConfig struct

+ Algorithm EncryptionAlgorithm

+ Enabled bool

+ KeyRotationInterval time.Duration

+ MasterKeyPath string

+ PBKDF2Iterations int

+ func DefaultEncryptionConfig() *EncryptionConfig

+ type EncryptionService struct

+ func NewEncryptionService(config *EncryptionConfig) (*EncryptionService, error)

+ func (es *EncryptionService) Close()

+ func (es *EncryptionService) Decrypt(encrypted *EncryptedData) ([]byte, error)

+ func (es *EncryptionService) DecryptFromBase64(encoded string) ([]byte, error)

+ func (es *EncryptionService) Encrypt(plaintext []byte) (*EncryptedData, error)

+ func (es *EncryptionService) EncryptToBase64(plaintext []byte) (string, error)

+ type FileAuditLogger struct

+ func NewFileAuditLogger(filePath string, logger *logging.Logger) (*FileAuditLogger, error)

+ func (l *FileAuditLogger) Close() error

+ func (l *FileAuditLogger) LogEvent(event *AuditEvent) error

+ type KeyManager struct

+ func NewKeyManager(config *EncryptionConfig) (*KeyManager, error)

+ func (km *KeyManager) Close()

+ func (km *KeyManager) GetActiveKey() ([]byte, string, error)

+ func (km *KeyManager) GetKey(keyID string) ([]byte, error)

+ type Manager struct

+ func NewManager(config *SecurityConfig, logger *logging.Logger) (*Manager, error)

+ func (m *Manager) AddACL(entry *ACLEntry) error

+ func (m *Manager) AddAPIKey(key *APIKey) error

+ func (m *Manager) AddUser(username, password string, authMethod AuthMethod, groups []string) error

+ func (m *Manager) AuditAction(ctx context.Context, principal *Principal, action Action, resource Resource, ...)

+ func (m *Manager) AuditFailure(ctx context.Context, principal *Principal, action Action, resource Resource, ...)

+ func (m *Manager) Authenticate(ctx context.Context, method AuthMethod, credentials interface{}) (*Principal, error)

+ func (m *Manager) Authorize(ctx context.Context, principal *Principal, action Action, resource Resource) (bool, error)

+ func (m *Manager) Close() error

+ func (m *Manager) Decrypt(encrypted *EncryptedData) ([]byte, error)

+ func (m *Manager) Encrypt(data []byte) (*EncryptedData, error)

+ func (m *Manager) GetAuthorizer() Authorizer

+ func (m *Manager) GetEncryption() *EncryptionService

+ func (m *Manager) IsAuditEnabled() bool

+ func (m *Manager) IsAuthenticationEnabled() bool

+ func (m *Manager) IsAuthorizationEnabled() bool

+ func (m *Manager) IsEncryptionEnabled() bool

+ func (m *Manager) ListACLs() []*ACLEntry

+ func (m *Manager) RemoveACL(id string) error

+ type MasterKey struct

+ CreatedAt time.Time

+ ID string

+ Key []byte

+ type MemoryAuditLogger struct

+ func NewMemoryAuditLogger() *MemoryAuditLogger

+ func (l *MemoryAuditLogger) Clear()

+ func (l *MemoryAuditLogger) GetEvents() []*AuditEvent

+ func (l *MemoryAuditLogger) LogEvent(event *AuditEvent) error

+ type MultiAuditLogger struct

+ func NewMultiAuditLogger(loggers ...AuditLogger) *MultiAuditLogger

+ func (l *MultiAuditLogger) AddLogger(logger AuditLogger)

+ func (l *MultiAuditLogger) LogEvent(event *AuditEvent) error

+ type PatternType string

+ const PatternTypeLiteral

+ const PatternTypePrefix

+ const PatternTypeWildcard

+ type Permission string

+ const PermissionAllow

+ const PermissionDeny

+ type Principal struct

+ Attributes map[string]string

+ AuthMethod AuthMethod

+ AuthTime time.Time

+ ClientCertCN string

+ ClientIP string

+ ExpiresAt *time.Time

+ ID string

+ Type PrincipalType

+ func PrincipalFromContext(ctx context.Context) (*Principal, bool)

+ func (p *Principal) HasGroup(group string) bool

+ func (p *Principal) IsExpired() bool

+ func (p *Principal) IsSuperUser(superUsers []string) bool

+ type PrincipalType string

+ const PrincipalTypeAnonymous

+ const PrincipalTypeService

+ const PrincipalTypeSystemInternal

+ const PrincipalTypeUser

+ type Resource struct

+ Name string

+ PatternType PatternType

+ Type ResourceType

+ type ResourceType string

+ const ResourceTypeCluster

+ const ResourceTypeConsumerGroup

+ const ResourceTypeSchema

+ const ResourceTypeTopic

+ const ResourceTypeTransaction

+ type SASLAuthenticator struct

+ func NewSASLAuthenticator(cfg *SASLConfig) *SASLAuthenticator

+ func (a *SASLAuthenticator) Authenticate(ctx context.Context, credentials interface{}) (*Principal, error)

+ func (a *SASLAuthenticator) Method() AuthMethod

+ type SASLConfig struct

+ Enabled bool

+ Mechanisms []AuthMethod

+ Users map[string]*User

+ type SASLCredentials struct

+ Mechanism AuthMethod

+ Password string

+ Username string

+ func (c *SASLCredentials) Type() AuthMethod

+ type SecurityConfig struct

+ APIKeyEnabled bool

+ AllowAnonymous bool

+ AuditEnabled bool

+ AuditLogFile string

+ AuthzEnabled bool

+ Encryption *EncryptionConfig

+ SASL *SASLConfig

+ SuperUsers []string

+ TLS *TLSConfig

+ UseDefaultACLs bool

+ func DefaultSecurityConfig() *SecurityConfig

+ type StructuredAuditLogger struct

+ func NewStructuredAuditLogger(logger *logging.Logger) *StructuredAuditLogger

+ func (l *StructuredAuditLogger) LogEvent(event *AuditEvent) error

+ type TLSAuthenticator struct

+ func NewTLSAuthenticator(cfg *TLSConfig) *TLSAuthenticator

+ func (a *TLSAuthenticator) Authenticate(ctx context.Context, credentials interface{}) (*Principal, error)

+ func (a *TLSAuthenticator) Method() AuthMethod

+ type TLSConfig struct

+ AllowedClientCNs []string

+ CAFile string

+ CertFile string

+ CipherSuites []uint16

+ Enabled bool

+ KeyFile string

+ MinVersion uint16

+ RequireClientCert bool

+ VerifyClientCert bool

+ func DefaultTLSConfig() *TLSConfig

+ func (cfg *TLSConfig) GetTLSConfig() *tls.Config

+ func (cfg *TLSConfig) ValidateClientCert(cert *x509.Certificate) error

+ type TLSCredentials struct

+ ClientCert *tls.Certificate

+ CommonName string

+ DNSNames []string

+ func (c *TLSCredentials) Type() AuthMethod

+ type User struct

+ Attributes map[string]string

+ CreatedAt time.Time

+ Enabled bool

+ Groups []string

+ Iterations int

+ PasswordHash []byte

+ Salt []byte

+ UpdatedAt time.Time

+ Username string

+ func CreateUser(username, password string, authMethod AuthMethod, groups []string) (*User, error)