Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SetFetchX509SVIDsForTest ¶
func SetFetchX509SVIDsForTest( fn func(context.Context, ...workloadapi.ClientOption) ([]*x509svid.SVID, error), ) func()
SetFetchX509SVIDsForTest replaces the Workload API fetch function and returns a cleanup function that restores the original.
Types ¶
type JWKSURLSigner ¶
type JWKSURLSigner struct {
// contains filtered or unexported fields
}
JWKSURLSigner fetches a JWK set from a URL and uses the first signing key to produce JWT signatures. This is suitable for setups where an admin API (e.g. Ory Hydra) manages the key pairs and exposes them via JWKS.
func NewJWKSURLSigner ¶
func NewJWKSURLSigner(httpClient *http.Client, cfg *config.PrivateKeyJWTConfig) *JWKSURLSigner
NewJWKSURLSigner creates a signer that fetches signing keys from a JWKS URL.
type JWTAssertionSigner ¶
type JWTAssertionSigner interface {
Algorithm(ctx context.Context) (string, error)
KeyID(ctx context.Context) (string, error)
Sign(ctx context.Context, payload []byte) ([]byte, error)
}
JWTAssertionSigner signs JWT client assertions for the private_key_jwt authentication method.
func Resolve ¶
func Resolve( _ context.Context, httpClient *http.Client, cfg *config.PrivateKeyJWTConfig, ) (JWTAssertionSigner, error)
Resolve inspects the private key JWT configuration and returns an appropriate signer implementation.
type WorkloadAPISigner ¶
type WorkloadAPISigner struct {
// contains filtered or unexported fields
}
WorkloadAPISigner signs JWT assertions using SPIFFE X509-SVIDs fetched from the Workload API.
func NewWorkloadAPISigner ¶
func NewWorkloadAPISigner(cfg *config.PrivateKeyJWTConfig) *WorkloadAPISigner
NewWorkloadAPISigner creates a signer backed by the SPIFFE Workload API.
func (*WorkloadAPISigner) Algorithm ¶
func (s *WorkloadAPISigner) Algorithm(ctx context.Context) (string, error)
Source Files