plugins

package

v0.13.0 Latest Latest Go to latest Published: Jan 21, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openpubkey/opkssh

Links

Open Source Insights

Documentation ¶

Index ¶

func DefaultCmdExecutor(name string, arg ...string) ([]byte, error)
func PopulatePluginEnvVars(pkt *pktoken.PKToken, userInfoJson string, principal string, sshCert string, ...) (map[string]string, error)
type Audience
- func (a *Audience) UnmarshalJSON(data []byte) error
type CmdExecutor
type PluginConfig
type PluginResult
type PluginResults
- func (r PluginResults) Allowed() bool
- func (r PluginResults) Errors() (errs []error)
type PolicyPluginEnforcer
- func NewPolicyPluginEnforcer() *PolicyPluginEnforcer
- func (p *PolicyPluginEnforcer) CheckPolicies(dir string, pkt *pktoken.PKToken, userInfoJson string, principal string, ...) (PluginResults, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func DefaultCmdExecutor ¶

func DefaultCmdExecutor(name string, arg ...string) ([]byte, error)

func PopulatePluginEnvVars ¶

func PopulatePluginEnvVars(pkt *pktoken.PKToken, userInfoJson string, principal string, sshCert string, keyType string, extraArgs []string) (map[string]string, error)

Types ¶

type Audience ¶

type Audience string

func (*Audience) UnmarshalJSON ¶

func (a *Audience) UnmarshalJSON(data []byte) error

type CmdExecutor ¶

type CmdExecutor func(name string, arg ...string) ([]byte, error)

type PluginConfig ¶

type PluginConfig struct {
	Name    string `yaml:"name"`
	Command string `yaml:"command"`
}

PluginConfig represents the structure of a policy command configuration.

type PluginResult ¶

type PluginResult struct {
	Path         string
	PluginConfig PluginConfig
	Error        error
	CommandRun   []string
	PolicyOutput string
	Allowed      bool
}

type PluginResults ¶

type PluginResults []*PluginResult

func (PluginResults) Allowed ¶

func (r PluginResults) Allowed() bool

func (PluginResults) Errors ¶

func (r PluginResults) Errors() (errs []error)

type PolicyPluginEnforcer ¶

type PolicyPluginEnforcer struct {
	Fs afero.Fs
	// contains filtered or unexported fields
}

func NewPolicyPluginEnforcer ¶

func NewPolicyPluginEnforcer() *PolicyPluginEnforcer

func (*PolicyPluginEnforcer) CheckPolicies ¶

func (p *PolicyPluginEnforcer) CheckPolicies(dir string, pkt *pktoken.PKToken, userInfoJson string, principal string, sshCert string, keyType string, extraArgs []string) (PluginResults, error)

CheckPolicies loads the policies plugin configs in the directory dir and then runs the policy command specified in which policy plugin config to determine if the user is allowed to assume access as the given principal. It returns PluginResults for each plugin configs found in the policy plugin directory.

Run PluginResults.Allowed() to determine if the user is allowed to assume access.

CheckPolicies does not short circuit if a policy returns allow. This is to enable admins to do a test rollout of a new policy plugin without needing to disable the old policy plugin until they are sure the new policy plugin is working correctly.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL