Documentation
¶
Overview ¶
Package spiffeauth provides shared SPIFFE authentication primitives for the authorization server.
Index ¶
Constants ¶
const SPIFFEJWTAssertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-spiffe"
SPIFFEJWTAssertionType identifies SPIFFE JWT-SVID client assertions.
Variables ¶
This section is empty.
Functions ¶
func SPIFFEIDFromCertificate ¶ added in v0.56.0
func SPIFFEIDFromCertificate(cert *x509.Certificate) (spiffeid.ID, error)
SPIFFEIDFromCertificate returns the single SPIFFE URI SAN in cert. It rejects the root SPIFFE ID (empty path); go-spiffe's parser already enforces a canonical path.
Types ¶
type SPIFFEAuthenticationMethod ¶
type SPIFFEAuthenticationMethod string
SPIFFEAuthenticationMethod identifies the credential type permitted for a SPIFFE workload. Methods are explicit so introducing another credential type cannot silently broaden a policy.
It is declared here, in this leaf package, rather than as authserver's own type: package server's SPIFFEClientResolver (spiffe_client_auth.go) needs a method type for its resolver signature, and package server cannot import authserver (authserver imports server). authserver.SPIFFEAuthenticationMethod stays its own independent plain type; the two are related only by a small explicit conversion at the one call site that constructs the resolver closure (see authserver.newSPIFFEClientResolver).
const ( // SPIFFEAuthenticationMethodX509 authenticates a workload with an X.509-SVID. SPIFFEAuthenticationMethodX509 SPIFFEAuthenticationMethod = "spiffe_x509" // SPIFFEAuthenticationMethodJWT authenticates a workload with a JWT-SVID. SPIFFEAuthenticationMethodJWT SPIFFEAuthenticationMethod = "spiffe_jwt" )
Source Files