Documentation
¶
Overview ¶
Package broker is the only path from a stored credential to an authenticated request. It checks authorization and state, unseals the credential, and returns an HTTP client that authenticates each request and may reach only the provider's hosts. Callers never receive the credential.
Index ¶
- type Broker
- func (b *Broker) HTTPClient(ctx context.Context, owner cf.OwnerID, p cf.Principal, connID string, ...) (*http.Client, error)
- func (b *Broker) ProviderClient(m provider.Manifest) (*http.Client, error)
- func (b *Broker) Seal(ctx context.Context, c cf.Connection, v int, m provider.Material) (cf.Credential, error)
- func (b *Broker) Unseal(ctx context.Context, c cf.Connection) (provider.Material, error)
- type Options
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Broker ¶
type Broker struct {
// contains filtered or unexported fields
}
Broker hands out authenticated clients.
func (*Broker) HTTPClient ¶
func (b *Broker) HTTPClient(ctx context.Context, owner cf.OwnerID, p cf.Principal, connID string, use cf.Use) (*http.Client, error)
HTTPClient returns a client whose requests carry the connection's credential. The principal must be allowed to use the connection, and the connection must be connected. The credential is read once, when the client is made: make a client per unit of work, so a disconnect or a refresh applies to the next one.
func (*Broker) ProviderClient ¶
ProviderClient returns an unauthenticated client restricted to the manifest's hosts, for validation.
type Options ¶
type Options struct {
Store cf.Store // required
Crypto cf.Cryptographer // required
Providers *provider.Registry
Authorizer cf.Authorizer // required
// Auditor records refusals. Optional.
Auditor cf.Auditor
// Egress is the policy template; its Hosts are replaced by each
// provider's manifest hosts.
Egress egress.Policy
// OnUse, if set, is called for each client handed out, for use counters.
OnUse func(ctx context.Context, c cf.Connection, u cf.Use)
Clock cf.Clock
}
Options configures a Broker.
Source Files