Documentation
¶
Index ¶
- Constants
- Variables
- func ContextWithIDToken(ctx context.Context, idToken *jwt.Token) context.Context
- func GetIDToken(ctx context.Context) (*jwt.Token, error)
- func IsValidPolicy(policy api.IAMPolicy) (bool, string)
- func NewAuthMiddleware(oidc *OIDC) (func(http.Handler) http.Handler, error)
- func NewAuthMiddlewareForOIDC(oidc *OIDC) (func(http.Handler) http.Handler, error)
- type AllowAllChecker
- type AuthContext
- type Checker
- type GenericProvider
- type GoogleProvider
- type IDTokenKeyType
- type OIDC
- type OIDCProvider
- type PolicyChecker
- type TestIDP
Constants ¶
const ( OIDCPathPrefix = "/oidc" SessionCookieName = "agent-session" SessionOAuthTokenName = "agent-oauth-token" )
Variables ¶
var ( ErrPrincipalExtraction = errors.New("could not extract principal from token") ErrRoleDenied = errors.New("user does not have the required role") )
Functions ¶
func ContextWithIDToken ¶
ContextWithIDToken adds the IDToken to the context
func GetIDToken ¶
GetIDToken retrieves the ID token from the context if there is one or nil
func IsValidPolicy ¶
IsValidPolicy checks if the IAM policy is valid. If its not it returns a string with a human readable message about the violations
func NewAuthMiddleware ¶
NewAuthMiddleware creates a middleware that enforces OIDC authentication
Types ¶
type AllowAllChecker ¶
type AllowAllChecker struct{}
AllowAllChecker is a no auth checker that allows all requests.
func (*AllowAllChecker) GetPrincipal ¶
func (c *AllowAllChecker) GetPrincipal(idToken *jwt.Token) (string, error)
GetPrincipal returns empty principal.
type AuthContext ¶
todo(sebastian): use everywhere? AuthContext encapsulates the Auth/IAM context for handlers.
func (*AuthContext) AuthorizeBearerToken ¶ added in v3.16.6
func (*AuthContext) AuthorizeRequest ¶
func (a *AuthContext) AuthorizeRequest(ctx context.Context, req *streamv1.WebsocketRequest) error
type GenericProvider ¶
type GenericProvider struct {
// contains filtered or unexported fields
}
GenericProvider implements OIDCProvider for generic OIDC providers
func NewGenericProvider ¶
func NewGenericProvider(cfg *config.GenericOIDCConfig) *GenericProvider
func (*GenericProvider) GetDiscoveryURL ¶
func (p *GenericProvider) GetDiscoveryURL() string
func (*GenericProvider) GetOAuth2Config ¶
func (p *GenericProvider) GetOAuth2Config() (*oauth2.Config, error)
func (*GenericProvider) ValidateDomainClaims ¶
func (p *GenericProvider) ValidateDomainClaims(claims jwt.MapClaims, allowedDomains []string) error
type GoogleProvider ¶
type GoogleProvider struct {
// contains filtered or unexported fields
}
GoogleProvider implements OIDCProvider for Google OAuth2
func NewGoogleProvider ¶
func NewGoogleProvider(cfg *config.GoogleOIDCConfig) *GoogleProvider
func (*GoogleProvider) GetDiscoveryURL ¶
func (p *GoogleProvider) GetDiscoveryURL() string
func (*GoogleProvider) GetOAuth2Config ¶
func (p *GoogleProvider) GetOAuth2Config() (*oauth2.Config, error)
func (*GoogleProvider) ValidateDomainClaims ¶
func (p *GoogleProvider) ValidateDomainClaims(claims jwt.MapClaims, allowedDomains []string) error
type IDTokenKeyType ¶
type IDTokenKeyType string
IDTokenKeyType string is the key used to store the ID token in the context We define a type to avoid collisions with other context keys
const (
IDTokenKey IDTokenKeyType = "idToken"
)
type OIDC ¶
type OIDC struct {
// contains filtered or unexported fields
}
OIDC handles OAuth2 authentication setup and management
func (*OIDC) CallbackHandler ¶
func (o *OIDC) CallbackHandler(w http.ResponseWriter, r *http.Request)
callbackHandler handles the OAuth2 callback
func (*OIDC) DoClientExchange ¶ added in v3.15.2
DoClientExchange true if the token exchange happens on the client
func (*OIDC) LoginHandler ¶
func (o *OIDC) LoginHandler(w http.ResponseWriter, r *http.Request)
loginHandler handles the OAuth2 login flow
func (*OIDC) LogoutHandler ¶
func (o *OIDC) LogoutHandler(w http.ResponseWriter, r *http.Request)
LogoutHandler handles the OAuth2 logout
type OIDCProvider ¶
type OIDCProvider interface {
// GetOAuth2Config returns the OAuth2 configuration
GetOAuth2Config() (*oauth2.Config, error)
// GetDiscoveryURL returns the OpenID Connect discovery URL
GetDiscoveryURL() string
}
OIDCProvider defines the interface for OIDC providers
type PolicyChecker ¶
type PolicyChecker struct {
// contains filtered or unexported fields
}
PolicyChecker enforces IAMPolicies. It checks if a user has the required permissions to perform an action.
func NewChecker ¶
func NewChecker(policy api.IAMPolicy) (*PolicyChecker, error)
NewChecker creates a new IAM policy checker.
func (*PolicyChecker) Check ¶
func (c *PolicyChecker) Check(principal string, role string) bool
Check returns true if and only if the principal has the given role in the IAM policy.
func (*PolicyChecker) GetPrincipal ¶
func (c *PolicyChecker) GetPrincipal(idToken *jwt.Token) (string, error)
GetPrincipal returns the principal from the idToken.
type TestIDP ¶
type TestIDP struct {
OIDC *OIDC
OIDCCfg *config.OIDCConfig
// contains filtered or unexported fields
}
Source Files