Affected by 
Documentation
¶
Index ¶
- func SelectorData(am *structs.ACLAuthMethod, idClaims, userClaims map[string]interface{}) (*structs.ACLAuthClaims, error)
- type Binder
- type BinderStateStore
- type Bindings
- type CallbackServer
- func (s *CallbackServer) Close() error
- func (s *CallbackServer) ErrorCh() <-chan error
- func (s *CallbackServer) Nonce() string
- func (s *CallbackServer) RedirectURI() string
- func (s *CallbackServer) ServeHTTP(w http.ResponseWriter, req *http.Request)
- func (s *CallbackServer) SuccessCh() <-chan *api.ACLOIDCCompleteAuthRequest
- type Identity
- type ProviderCache
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SelectorData ¶
func SelectorData( am *structs.ACLAuthMethod, idClaims, userClaims map[string]interface{}) (*structs.ACLAuthClaims, error)
SelectorData returns the data for go-bexpr for selector evaluation.
Types ¶
type Binder ¶
type Binder struct {
// contains filtered or unexported fields
}
Binder is responsible for collecting the ACL roles and policies to be assigned to a token generated as a result of "logging in" via an auth method.
It does so by applying the auth method's configured binding rules.
func NewBinder ¶
func NewBinder(store BinderStateStore) *Binder
NewBinder creates a Binder with the given state store.
type BinderStateStore ¶
type BinderStateStore interface {
GetACLBindingRulesByAuthMethod(ws memdb.WatchSet, authMethod string) (memdb.ResultIterator, error)
GetACLRoleByName(ws memdb.WatchSet, roleName string) (*structs.ACLRole, error)
ACLPolicyByName(ws memdb.WatchSet, name string) (*structs.ACLPolicy, error)
}
BinderStateStore is the subset of state store methods used by the binder.
type Bindings ¶
type Bindings struct {
Management bool
Roles []*structs.ACLTokenRoleLink
Policies []string
}
Bindings contains the ACL roles and policies to be assigned to the created token.
type CallbackServer ¶
type CallbackServer struct {
// contains filtered or unexported fields
}
CallbackServer is started with NewCallbackServer and creates an HTTP server for handling loopback OIDC auth redirects.
func NewCallbackServer ¶
func NewCallbackServer(addr string) (*CallbackServer, error)
NewCallbackServer creates and starts a new local HTTP server for OIDC authentication to redirect to. This is used to capture the necessary information to complete the authentication.
func (*CallbackServer) Close ¶
func (s *CallbackServer) Close() error
Close cleans up and shuts down the server. On close, errors may be sent to ErrorCh and should be ignored.
func (*CallbackServer) ErrorCh ¶
func (s *CallbackServer) ErrorCh() <-chan error
ErrorCh returns a channel where any errors are sent. Errors may be sent after Close and should be disregarded.
func (*CallbackServer) Nonce ¶
func (s *CallbackServer) Nonce() string
Nonce returns a generated nonce that can be used for the request.
func (*CallbackServer) RedirectURI ¶
func (s *CallbackServer) RedirectURI() string
RedirectURI is the redirect URI that should be provided for the auth.
func (*CallbackServer) ServeHTTP ¶
func (s *CallbackServer) ServeHTTP(w http.ResponseWriter, req *http.Request)
ServeHTTP implements http.Handler and handles the callback request. This isn't usually used directly; use the server address instead.
func (*CallbackServer) SuccessCh ¶
func (s *CallbackServer) SuccessCh() <-chan *api.ACLOIDCCompleteAuthRequest
SuccessCh returns a channel that gets sent a partially completed request to complete the OIDC auth with the Nomad server.
type Identity ¶
type Identity struct {
// Claims is the format of this Identity suitable for selection
// with a binding rule.
Claims interface{}
// ClaimMappings is the format of this Identity suitable for interpolation in a
// bind name within a binding rule.
ClaimMappings map[string]string
}
func NewIdentity ¶
func NewIdentity( authMethodConfig *structs.ACLAuthMethodConfig, authClaims *structs.ACLAuthClaims) *Identity
NewIdentity builds a new Identity that can be used to generate bindings via Bind for ACL token creation.
type ProviderCache ¶
type ProviderCache struct {
// contains filtered or unexported fields
}
ProviderCache is a cache for OIDC providers. OIDC providers are something you don't want to recreate per-request since they make HTTP requests when they're constructed.
The ProviderCache purges a provider under two scenarios: (1) the provider config is updated, and it is different and (2) after a set amount of time (see cacheExpiry for value) in case the remote provider configuration changed.
func NewProviderCache ¶
func NewProviderCache() *ProviderCache
NewProviderCache should be used to initialize a provider cache. This will start up background resources to manage the cache.
func (*ProviderCache) Delete ¶
func (c *ProviderCache) Delete(name string)
Delete force deletes a single auth method from the cache by name.
func (*ProviderCache) Get ¶
func (c *ProviderCache) Get(authMethod *structs.ACLAuthMethod) (*oidc.Provider, error)
Get returns the OIDC provider for the given auth method configuration. This will initialize the provider if it isn't already in the cache or if the configuration changed.
func (*ProviderCache) Shutdown ¶
func (c *ProviderCache) Shutdown()
Shutdown stops any long-lived cache process and informs each OIDC provider that they are done. This should be called whenever the Nomad server is shutting down.
Source Files