Documentation
¶
Overview ¶
Package spiffeauth provides shared SPIFFE authentication primitives for the authorization server.
Index ¶
- Constants
- func ContextWithSPIFFEID(ctx context.Context, id spiffeid.ID) context.Context
- func Middleware(next http.Handler) http.Handler
- func SPIFFEIDFromCertificate(cert *x509.Certificate) (spiffeid.ID, error)
- func SPIFFEIDFromContext(ctx context.Context) (spiffeid.ID, bool)
- type SPIFFEAuthenticationMethod
Constants ¶
const SPIFFEJWTAssertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-spiffe"
SPIFFEJWTAssertionType identifies SPIFFE JWT-SVID client assertions.
Variables ¶
This section is empty.
Functions ¶
func ContextWithSPIFFEID ¶
ContextWithSPIFFEID returns a new context with the SPIFFE ID stored.
func Middleware ¶ added in v0.56.0
Middleware extracts a claimed SPIFFE ID from token-endpoint client certificates that contain a SPIFFE URI SAN. Certificates without a SPIFFE URI SAN pass through unchanged; credential validation remains the responsibility of the client-authentication strategy.
func SPIFFEIDFromCertificate ¶ added in v0.56.0
func SPIFFEIDFromCertificate(cert *x509.Certificate) (spiffeid.ID, error)
SPIFFEIDFromCertificate returns the single non-root SPIFFE URI SAN in cert.
Types ¶
type SPIFFEAuthenticationMethod ¶
type SPIFFEAuthenticationMethod string
SPIFFEAuthenticationMethod identifies the credential type permitted for a SPIFFE workload. Methods are explicit so introducing another credential type cannot silently broaden a policy.
It is declared here, in this leaf package, rather than as authserver's own type: package server's SPIFFEClientResolver (spiffe_client_auth.go) needs a method type for its resolver signature, and package server cannot import authserver (authserver imports server). authserver.SPIFFEAuthenticationMethod stays its own independent plain type; the two are related only by a small explicit conversion at the one call site that constructs the resolver closure (see authserver.newSPIFFEClientResolver).
const ( // SPIFFEAuthenticationMethodX509 authenticates a workload with an X.509-SVID. SPIFFEAuthenticationMethodX509 SPIFFEAuthenticationMethod = "spiffe_x509" // SPIFFEAuthenticationMethodJWT authenticates a workload with a JWT-SVID. SPIFFEAuthenticationMethodJWT SPIFFEAuthenticationMethod = "spiffe_jwt" )
Source Files