Documentation
¶
Index ¶
- Constants
- Variables
- func GetSubjectAccountAndCapability(subject string) (string, settings.AccountCapability)
- func GetUserIdentifier(ctx context.Context) string
- func Groups(ctx context.Context, scopes []string) []string
- func Iat(ctx context.Context) (time.Time, error)
- func Iss(ctx context.Context) string
- func LoggedIn(ctx context.Context) bool
- func NewUserStateStorage(redis *kv.Client) *userStateStorage
- func Username(ctx context.Context) string
- func WithAuthMiddleware(disabled bool, isSSOConfigured bool, ssoClientApp *oidcutil.ClientApp, ...) http.Handler
- type LoginAttempts
- type MetricsRegistry
- type SessionManager
- func (mgr *SessionManager) AuthMiddlewareFunc(disabled bool, isSSOConfigured bool, ssoClientApp *oidcutil.ClientApp) func(http.Handler) http.Handler
- func (mgr *SessionManager) CollectMetrics(registry MetricsRegistry)
- func (mgr *SessionManager) Create(subject string, secondsBeforeExpiry int64, id string) (string, error)
- func (mgr *SessionManager) GetLoginFailures() map[string]LoginAttempts
- func (mgr *SessionManager) IncLoginRequestCounter(status string)
- func (mgr *SessionManager) Parse(tokenString string) (jwt.Claims, string, error)
- func (mgr *SessionManager) RevokeToken(ctx context.Context, id string, expiringAt time.Duration) error
- func (mgr *SessionManager) VerifyToken(ctx context.Context, tokenString string) (jwt.Claims, string, error)
- func (mgr *SessionManager) VerifyUsernamePassword(username string, password string) error
- type TokenVerifier
- type UserStateStorage
Constants ¶
const ( // SessionManagerClaimsIssuer fills the "iss" field of the token. SessionManagerClaimsIssuer = "hanzocd" AuthErrorCtxKey = "auth-error" )
Variables ¶
var InvalidLoginErr = status.Errorf(codes.Unauthenticated, invalidLoginError)
Functions ¶
func GetSubjectAccountAndCapability ¶ added in v1.8.8
func GetSubjectAccountAndCapability(subject string) (string, settings.AccountCapability)
GetSubjectAccountAndCapability analyzes Hanzo CD account token subject and extract account name and the capability it was generated for (default capability is API Key).
func GetUserIdentifier ¶ added in v1.8.8
GetUserIdentifier returns the user identifier from context, prioritizing federated claims over subject
func NewUserStateStorage ¶ added in v1.8.8
func NewUserStateStorage(redis *kv.Client) *userStateStorage
func Username ¶ added in v0.7.0
Username is a helper to extract a human readable username from a context
func WithAuthMiddleware ¶ added in v1.8.8
func WithAuthMiddleware(disabled bool, isSSOConfigured bool, ssoClientApp *oidcutil.ClientApp, authn TokenVerifier, next http.Handler) http.Handler
WithAuthMiddleware is an HTTP middleware used to ensure incoming requests are authenticated before invoking the target handler. If disabled is true, it will just invoke the next handler in the chain.
Types ¶
type LoginAttempts ¶ added in v1.5.3
type LoginAttempts struct {
// Time of the last failed login
LastFailed time.Time `json:"lastFailed"`
// Number of consecutive login failures
FailCount int `json:"failCount"`
}
LoginAttempts is a timestamped counter for failed login attempts
type MetricsRegistry ¶ added in v1.8.8
type MetricsRegistry interface {
IncLoginRequestCounter(status string)
}
type SessionManager ¶
type SessionManager struct {
// contains filtered or unexported fields
}
SessionManager generates and validates JWT tokens for login sessions.
func NewSessionManager ¶ added in v0.4.0
func NewSessionManager(settingsMgr *settings.SettingsManager, projectsLister v1alpha1.AppProjectNamespaceLister, dexServerAddr string, dexTLSConfig *dex.DexTLSConfig, storage UserStateStorage) *SessionManager
NewSessionManager creates a new session manager from Hanzo CD settings
func (*SessionManager) AuthMiddlewareFunc ¶ added in v1.8.8
func (mgr *SessionManager) AuthMiddlewareFunc(disabled bool, isSSOConfigured bool, ssoClientApp *oidcutil.ClientApp) func(http.Handler) http.Handler
AuthMiddlewareFunc returns a function that can be used as an authentication middleware for HTTP requests.
func (*SessionManager) CollectMetrics ¶ added in v1.8.8
func (mgr *SessionManager) CollectMetrics(registry MetricsRegistry)
func (*SessionManager) Create ¶
func (mgr *SessionManager) Create(subject string, secondsBeforeExpiry int64, id string) (string, error)
Create creates a new token for a given subject (user) and returns it as a string. Passing a value of `0` for secondsBeforeExpiry creates a token that never expires. The id parameter holds an optional unique JWT token identifier and stored as a standard claim "jti" in the JWT token.
func (*SessionManager) GetLoginFailures ¶ added in v1.5.3
func (mgr *SessionManager) GetLoginFailures() map[string]LoginAttempts
GetLoginFailures retrieves the login failure information from the cache. Any modifications to the LoginAttemps map must be done in a thread-safe manner.
func (*SessionManager) IncLoginRequestCounter ¶ added in v1.8.8
func (mgr *SessionManager) IncLoginRequestCounter(status string)
func (*SessionManager) Parse ¶
Parse tries to parse the provided string and returns the token claims for local login.
func (*SessionManager) RevokeToken ¶ added in v1.8.8
func (*SessionManager) VerifyToken ¶ added in v0.4.0
func (mgr *SessionManager) VerifyToken(ctx context.Context, tokenString string) (jwt.Claims, string, error)
VerifyToken verifies if a token is correct. Tokens can be issued either from us or by an IDP. We choose how to verify based on the issuer.
func (*SessionManager) VerifyUsernamePassword ¶ added in v0.4.0
func (mgr *SessionManager) VerifyUsernamePassword(username string, password string) error
VerifyUsernamePassword verifies if a username/password combo is correct
type TokenVerifier ¶ added in v1.8.8
type TokenVerifier interface {
VerifyToken(ctx context.Context, token string) (jwt.Claims, string, error)
}
TokenVerifier defines the contract to invoke token verification logic
type UserStateStorage ¶ added in v1.5.3
type UserStateStorage interface {
Init(ctx context.Context)
// GetLoginAttempts return number of concurrent login attempts
GetLoginAttempts() map[string]LoginAttempts
// SetLoginAttempts sets number of concurrent login attempts
SetLoginAttempts(attempts map[string]LoginAttempts) error
// RevokeToken revokes token with given id (information about revocation expires after specified timeout)
RevokeToken(ctx context.Context, id string, expiringAt time.Duration) error
// IsTokenRevoked checks if given token is revoked
IsTokenRevoked(id string) bool
// GetLockObject returns a lock used by the storage
GetLockObject() *sync.RWMutex
}
Source Files