authentication

type AuthorizationServerMetadata ¶ added in v0.110.0

type AuthorizationServerMetadata struct {
	// Issuer is the authorization server's issuer identifier, which is a URL.
	Issuer string `json:"issuer"`
	// AuthorizationEndpoint is the URL of the authorization server's authorization endpoint.
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	// TokenEndpoint is the URL of the authorization server's token endpoint.
	TokenEndpoint string `json:"token_endpoint"`
	// CodeChallengeMethodsSupported lists PKCE code challenge methods supported by this authorization server.
	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
}

AuthorizationServerMetadata represents a subset of the metadata provided by an OAuth 2.0 Authorization Server. See RFC 8414, Section 2 for the full specification: https://datatracker.ietf.org/doc/html/rfc8414#section-2

func GetAuthorizationServerMetadata(ctx context.Context, authorizationServerURL string) (*AuthorizationServerMetadata, error)

type InsecureStaticProvider ¶

type InsecureStaticProvider struct {
	AccessToken string
}

InsecureStaticProvider is an insecure implementation of Provider that always returns the same static access token and does not provide/enforce transport security. This provider is only suitable for testing against LocalNet or other non-production environments.

func NewInsecureStaticProvider(accessToken string) InsecureStaticProvider

func (i InsecureStaticProvider) PerRPCCredentials() credentials.PerRPCCredentials

func (i InsecureStaticProvider) TokenSource() oauth2.TokenSource

func (i InsecureStaticProvider) TransportCredentials() credentials.TransportCredentials

type Provider ¶

type Provider interface {
	// TokenSource returns an oauth2.TokenSource that can be used to retrieve access tokens for authenticating with the participant's API endpoints.
	TokenSource() oauth2.TokenSource
	// TransportCredentials returns gRPC transport credentials to be used when connecting to the participant's RPC endpoints.
	TransportCredentials() credentials.TransportCredentials
	// PerRPCCredentials returns gRPC per-RPC credentials to be used when connecting to the participant's gRPC endpoints.
	PerRPCCredentials() credentials.PerRPCCredentials
}

Provider provides authentication credentials for connecting to a Canton participant's API endpoints. The Provider acts as both a raw token-source for HTTP API authentication, and a gRPC credentials provider for gRPC endpoint authentication.

Implementations of this interface can implement different means of fetching and refreshing authentication tokens, as well as enforcing different levels of transport security. The specific implementation of the Provider should be chosen based on the environment being connected to (e.g. LocalNet vs. production, i.e. CI/OIDC).

type StaticProvider ¶ added in v0.83.0

type StaticProvider struct {
	AccessToken string
}

StaticProvider is a secure implementation of Provider that returns a static access token and enforces TLS transport security. This provider is suitable for remote environments.

func NewStaticProvider(accessToken string) StaticProvider

func (s StaticProvider) PerRPCCredentials() credentials.PerRPCCredentials

func (s StaticProvider) TokenSource() oauth2.TokenSource

func (s StaticProvider) TransportCredentials() credentials.TransportCredentials