Documentation
¶
Overview ¶
Package auth provides a simple wrapper around values needed for the openidconnect package
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrBadConfig = errors.New("invalid config")
Functions ¶
func MultiTokenMiddlewareFromConfigs ¶ added in v0.14.0
func MultiTokenMiddlewareFromConfigs( auths []configs.Auth, logger *zap.Logger, auditWriter *auditevent.EventWriter, ) (*ginauth.MultiTokenMiddleware, error)
MultiTokenMiddlewareFromConfigs builds a MultiTokenMiddleware from the given auth providers. Each provider contributes exactly one verifier: a Cedar verifier when its cedar block is enabled (authenticates against that issuer, then authorizes via the sidecar), otherwise the plain scope-based ginjwt verifier. The middleware runs all verifiers concurrently and passes on the first success, so a token from a Cedar-authorized issuer succeeds via its Cedar verifier while tokens from scope-gated issuers succeed via their own ginjwt verifiers.
auditWriter, when non-nil, is the same auditevent.EventWriter the caller uses for its HTTP audit log, so Cedar authorization decisions land in that log as ordinary auditevent.AuditEvent records rather than a separate ad hoc format.
Types ¶
type OIDCProviderConfig ¶
type OIDCProviderConfig struct {
OIDCClientKey string
OIDCClientSecret string
OIDCCallbackURL string
OIDCDiscoveryURL string
OIDCProviderName string
OIDCScopes []string
}
OIDCProviderConfig is used to configure the openidconnect object from the openidconnect package github.com/markbates/goth/providers/openidConnect
type OIDCUserInfo ¶
type OIDCUserInfo struct {
Name string `json:"name"`
Email string `json:"email"`
Sub string `json:"sub"`
}
OIDCUserInfo provides basic user info from OIDC
func UserInfoFromJWT ¶
func UserInfoFromJWT(ctx context.Context, rawToken string, oidcConfigs []configs.Auth) (*OIDCUserInfo, error)
UserInfoFromJWT tries to retrieve the user info (id token claims) using the given jwt token. It will use the oidc provider matching the issuer in the access token
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package authz provides a Verifier that delegates authorization to an external Decider (in place of the usual scope check), along with the Decider interface that concrete backends implement.
|
Package authz provides a Verifier that delegates authorization to an external Decider (in place of the usual scope check), along with the Decider interface that concrete backends implement. |
|
Package cedar provides an optional Cedar-based authorization layer that authorizes callers from a given OIDC issuer via a local cedar-agent sidecar instead of by governor scopes.
|
Package cedar provides an optional Cedar-based authorization layer that authorizes callers from a given OIDC issuer via a local cedar-agent sidecar instead of by governor scopes. |