Documentation
¶
Overview ¶
Package sign holds the request/assertion signing schemes Geiger modules need: RS256 JWT assertions (GCP, Salesforce, Snowflake), Azure SharedKey, HTTP Digest (MongoDB Atlas), and generic HMAC. AWS SigV4 lives in sigv4.go.
Index ¶
- func AzureSharedKey(account string, accountKeyB64 string, stringToSign string) (string, error)
- func CanonicalizeHeaders(prefix string, headers map[string]string) string
- func DigestAuthHeader(user, pass, method, uri string, ch DigestChallenge, nc, cnonce string) string
- func HMACSHA1Hex(key, msg []byte) string
- func HMACSHA256Hex(key, msg []byte) string
- func ParseRSAPrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)
- func RS256Assertion(pemBytes []byte, kid string, claims map[string]any, ttl time.Duration) (string, error)
- func SigV4(ctx context.Context, req *http.Request, ...) error
- type DigestChallenge
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AzureSharedKey ¶
AzureSharedKey computes the Authorization header value for the Azure Storage Shared Key scheme: "SharedKey {account}:{base64(HMAC-SHA256(key, StringToSign))}". stringToSign must already be assembled per the storage REST contract.
func CanonicalizeHeaders ¶
CanonicalizeHeaders is a small helper for signing schemes that need sorted canonical header strings (e.g. x-ms-* for Azure).
func DigestAuthHeader ¶
func DigestAuthHeader(user, pass, method, uri string, ch DigestChallenge, nc, cnonce string) string
DigestAuthHeader builds an RFC 2617 Digest Authorization header value (MD5, qop=auth) for MongoDB Atlas-style HTTP Digest auth. nc/cnonce make the response unique per request.
func HMACSHA1Hex ¶
HMACSHA1Hex returns hex(HMAC-SHA1(key, msg)), used by the Duo Admin API's canonical-request signing scheme.
func HMACSHA256Hex ¶
HMACSHA256Hex returns hex(HMAC-SHA256(key, msg)), used by exchange-style APIs (e.g. Coinbase legacy signing).
func ParseRSAPrivateKey ¶
func ParseRSAPrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)
ParseRSAPrivateKey accepts PKCS#1 or PKCS#8 PEM.
func RS256Assertion ¶
func RS256Assertion(pemBytes []byte, kid string, claims map[string]any, ttl time.Duration) (string, error)
RS256Assertion builds a signed JWT for an OAuth jwt-bearer grant. kid may be empty. claims is the full claim set (iss, sub, aud, scope, …); iat/exp are set here if absent.
func SigV4 ¶
func SigV4(ctx context.Context, req *http.Request, accessKey, secretKey, session, service, region string, body []byte) error
SigV4 signs an AWS request in place using the aws-sdk-go-v2 signer. session may be empty for long-term keys. body is the exact request body (nil for empty). It mutates req's headers to carry the signature.
Types ¶
type DigestChallenge ¶
type DigestChallenge struct {
Realm, Nonce, QOP, Opaque, Algorithm string
}
DigestChallenge holds the fields parsed from a WWW-Authenticate: Digest header.
func ParseDigestChallenge ¶
func ParseDigestChallenge(header string) DigestChallenge
ParseDigestChallenge extracts fields from a WWW-Authenticate Digest header.
Source Files