Documentation
¶
Overview ¶
Package workloadjwt verifies cloud-issued workload identity JWTs.
Callers supply the issuer and audience; they are never read out of the presented token, so an unauthenticated caller cannot steer which key set is trusted.
Index ¶
Constants ¶
const AzureManagementAudience = "https://management.azure.com/"
Graph looks like the safer audience -- a token for a role-less identity can do nothing -- but Microsoft signs Graph access tokens with a key that is not in the tenant JWKS, so a third party cannot verify them. ARM tokens are ordinary v1 tokens and verify against the tenant keys, which is why runner auth already uses this audience.
The identity is created with no role assignments, so an ARM token minted for it is authorized for nothing either.
Variables ¶
This section is empty.
Functions ¶
func AzureIssuer ¶
AzureIssuer builds the v1 Entra issuer for a tenant. IMDS mints v1 tokens, so the issuer is sts.windows.net rather than the v2 login.microsoftonline.com form.
func AzurePhoneHomeIdentityName ¶
Rendered into the ARM template and compared against the verified xms_mirid, so both sides must stay in step.
func StringClaim ¶
StringClaim reads a string claim. A claim of any other type is treated as absent rather than coerced.
Types ¶
type AzureManagedIdentity ¶
type AzureManagedIdentity struct {
SubscriptionID string
ResourceGroup string
Name string
PrincipalID string
TenantID string
}
func ParseAzureManagedIdentity ¶
func ParseAzureManagedIdentity(claims map[string]any) (*AzureManagedIdentity, error)
Only user-assigned identities are accepted. A system-assigned identity puts the compute resource in xms_mirid -- the runner's VMSS is one -- so a loose shape check would let a runner token pass as a phone-home identity.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
func NewVerifier ¶
func NewVerifier() *Verifier
Source Files