Documentation
¶
Overview ¶
Package serviceclient lets a SystemAuth service account call SystemForge-powered APIs: it signs a short assertion with the account's private key, exchanges it at SystemAuth's token endpoint for a short-lived DPoP-bound access token (the RFC 7523 JWT-bearer grant), and sends API requests with that token and a DPoP proof (RFC 9449).
The account and its key are set up with the service-account commands; the private key never leaves the workload, and SystemAuth stores only the public key. There is no refresh token: the client signs a new assertion a minute before the token expires.
Index ¶
Constants ¶
const GrantType = "urn:ietf:params:oauth:grant-type:jwt-bearer"
GrantType is the RFC 7523 JWT-bearer grant.
Variables ¶
This section is empty.
Functions ¶
func LoadPrivateKey ¶
LoadPrivateKey reads a PEM private key (PKCS #8, SEC 1 or PKCS #1) from a file that only its owner may read.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client holds a service account's credentials and its current token.
func New ¶
New checks the configuration, finds SystemAuth's token endpoint and prepares the proof key. It makes no token request.
func (*Client) HTTPClient ¶
HTTPClient returns an http.Client whose requests carry the account's token and proofs (see Transport), based on Config.HTTPClient.
func (*Client) Token ¶
Token returns a valid access token, exchanging a new assertion when the current token expires within a minute. Concurrent callers share one exchange.
func (*Client) Transport ¶
func (c *Client) Transport(base http.RoundTripper) http.RoundTripper
Transport returns an http.RoundTripper that authenticates each request as the service account: Authorization: DPoP with a valid token and a proof for the request's method and URL. A request refused with 401 is retried once when its body can be sent again: with the server's nonce for use_dpop_nonce, or with a new token for invalid_token. base nil is http.DefaultTransport.
type Config ¶
type Config struct {
// Issuer is SystemAuth's issuer URL (required).
Issuer string
// Account is the service account's identifier, the assertion's iss and
// sub (required).
Account string
// KeyID is the key's ID at SystemAuth, sent as the assertion's kid
// (required).
KeyID string
// PrivateKey signs assertions: a P-256 ECDSA, RSA (2048 bits or more)
// or Ed25519 key (required). A P-256 key also signs the DPoP proofs;
// for another kind the client makes a P-256 key for them.
PrivateKey crypto.Signer
// Scopes requested; empty requests all the key allows.
Scopes []string
// HTTPClient sends the token requests and is the base of HTTPClient.
// Default: http.DefaultClient.
HTTPClient *http.Client
// Metadata is SystemAuth's provider metadata, when known; nil discovers
// it from Issuer.
Metadata *relyingparty.Metadata
}
Config configures a Client.
Source Files