auth

type AuthenticateArgs ¶

type AuthenticateArgs struct {
	Ctx          map[interface{}]interface{}
	ClientID     string
	ClientSecret string
}

AuthenticateArgs for RPC

type AuthenticateReply ¶

type AuthenticateReply struct {
	User  *user.User
	Auth  map[string]*authpb.Scope
	Error error
}

AuthenticateReply for RPC

type Authenticator ¶ added in v2.51.0

type Authenticator func(ctx context.Context) (context.Context, time.Time, error)

Authenticator produces an authenticated context together with the time at which its token expires. A Session calls it once up front and then again shortly before each expiry to keep the context fresh.

type ConfigureArg ¶

type ConfigureArg struct {
	Ml map[string]interface{}
}

ConfigureArg for RPC

type ConfigureReply ¶

type ConfigureReply struct {
	Err error
}

ConfigureReply for RPC

type CredentialStrategy ¶

type CredentialStrategy interface {
	GetCredentials(w http.ResponseWriter, r *http.Request) (*Credentials, error)
	AddWWWAuthenticate(w http.ResponseWriter, r *http.Request, realm string)
}

CredentialStrategy obtains Credentials from the request.

type Credentials ¶

type Credentials struct {
	Type         string
	ClientID     string
	ClientSecret string
}

Credentials contains the auth type, client id and secret.

type Manager ¶

type Manager interface {
	plugin.Plugin
	Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error)
}

Manager is the interface to implement to authenticate users

type ProviderPlugin ¶

type ProviderPlugin struct {
	Impl Manager
}

ProviderPlugin is the implementation of plugin.Plugin so we can serve/consume this.

func (p *ProviderPlugin) Client(b *hcplugin.MuxBroker, c *rpc.Client) (interface{}, error)

func (p *ProviderPlugin) Server(*hcplugin.MuxBroker) (interface{}, error)

type RPCClient ¶

type RPCClient struct{ Client *rpc.Client }

RPCClient is an implementation of Manager that talks over RPC.

func (m *RPCClient) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error)

func (m *RPCClient) Configure(ml map[string]interface{}) error

type RPCServer ¶

type RPCServer struct {
	// This is the real implementation
	Impl Manager
}

RPCServer is the server that RPCClient talks to, conforming to the requirements of net/rpc

func (m *RPCServer) Authenticate(args AuthenticateArgs, resp *AuthenticateReply) error

func (m *RPCServer) Configure(args ConfigureArg, resp *ConfigureReply) error

type Registry ¶

type Registry interface {
	ListProviders(ctx context.Context) ([]*registry.ProviderInfo, error)
	GetProvider(ctx context.Context, authType string) (*registry.ProviderInfo, error)
}

Registry is the interface that auth registries implement for discovering auth providers

type Session ¶ added in v2.51.0

type Session struct {
	// contains filtered or unexported fields
}

Session keeps an authenticated context valid for the whole duration of a long-running task.

Many operations (indexing a space, creating an archive, bulk migrations, …) can outlive the lifetime of a single authentication token. Passing a static context to such a task means its token expires halfway through and every subsequent call fails. Session solves this by owning the context: it authenticates once up front via an Authenticator and then refreshes the context in the background shortly before the token expires. Callers always read the current context through Ctx, so they transparently pick up refreshed tokens without having to thread a new context around. A Session is safe for concurrent use.

func NewSession(parent context.Context, auth Authenticator) (*Session, error)

func NewStaticSession(ctx context.Context) *Session

func (s *Session) Close()

func (s *Session) Ctx() context.Context

type TokenStrategy ¶

type TokenStrategy interface {
	GetToken(r *http.Request) string
}

TokenStrategy obtains a token from the request. If token does not exist returns an empty string.

type TokenWriter ¶

type TokenWriter interface {
	WriteToken(token string, w http.ResponseWriter)
}

TokenWriter stores the token in a http response.