Documentation
¶
Overview ¶
Package auth provides application-layer authentication for the proxy: authenticating inbound requests (Authenticator) and presenting credentials on outbound requests to upstreams (CredentialProvider).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Module = fx.Options(fx.Provide(func(cfg *config.Config) (Authenticator, error) { auth := cfg.Auth if auth == nil { return &defaultAuthenticator{}, nil } switch { case auth.StaticToken != nil && auth.JWKS == nil: return NewStaticTokenAuthenticator( auth.StaticToken.Token, auth.StaticToken.Header, auth.StaticToken.Scheme, ) case auth.JWKS != nil && auth.StaticToken == nil: return NewJWKSAuthenticator( auth.JWKS.URL, auth.JWKS.Audiences, auth.JWKS.Issuer, auth.JWKS.Header, auth.JWKS.Scheme, ) default: return nil, errors.New("auth: exactly one of staticToken or jwks must be configured") } }))
Module provides the inbound Authenticator selected by configuration: StaticToken or OIDC/JWKS when exactly one is configured. With no auth block it provides a default authenticator that admits every request (authentication is opt-in); a block that selects neither or both is a configuration error, so an invalid block fails closed rather than admitting traffic. The server adapts the Authenticator into a stream interceptor via StreamServerInterceptor.
Functions ¶
func DialOptions ¶
func DialOptions(cp CredentialProvider) []grpc.DialOption
DialOptions returns the dial options that install cp on an outbound connection: the per-RPC credential itself, plus client interceptors that strip cp's header from each call's forwarded metadata so a forwarded value on the same header cannot collide with the credential.
func StreamServerInterceptor ¶
func StreamServerInterceptor(a Authenticator, log logger.Logger) grpc.StreamServerInterceptor
StreamServerInterceptor adapts an Authenticator to a gRPC stream server interceptor, logging each rejection's detailed reason (never the token) via log. a must be non-nil; callers get one from the auth module, where the unconfigured case is the admit-all default. A nil log falls back to the default logger.
Types ¶
type Authenticator ¶
type Authenticator interface {
Authenticate(ctx context.Context, md metadata.MD) error
Header() string
}
Authenticator authenticates an inbound request from its metadata. It returns nil to allow the request, or a gRPC status error to reject it. Header reports the metadata header the authenticator consumes, so the proxy can strip the caller's credential before forwarding upstream; it returns "" when the authenticator consumes no header.
type CredentialProvider ¶
type CredentialProvider interface {
credentials.PerRPCCredentials
Header() string
}
CredentialProvider supplies per-RPC metadata for outbound calls to an upstream. Header reports the metadata header it sets, so the proxy can strip any forwarded value on that header before the credential adds its own.
func CredentialProviderFor ¶
func CredentialProviderFor(cfg *config.CredentialConfig) (CredentialProvider, error)
CredentialProviderFor maps configuration to the selected CredentialProvider. It returns (nil, nil) only when cfg is nil (no credential configured); a present-but-empty block fails closed with an error rather than silently dialing the upstream without the configured credential.
type JWKSAuthenticator ¶
type JWKSAuthenticator struct {
// contains filtered or unexported fields
}
JWKSAuthenticator verifies an inbound JWT's signature against a JWKS keyset and checks its standard claims.
func NewJWKSAuthenticator ¶
func NewJWKSAuthenticator(rawURL string, audiences []string, issuer, header, scheme string) (*JWKSAuthenticator, error)
NewJWKSAuthenticator builds a JWKSAuthenticator that resolves signing keys from the JWKS at rawURL.
keyfunc.NewDefaultOverrideCtx performs its first key fetch synchronously (see github.com/MicahParks/jwkset's NewStorageFromHTTP), so calling it directly here would block construction for up to its HTTP timeout if the IdP is unreachable. To keep construction non-blocking, the fetch is kicked off in a background goroutine (via deferredKeyfunc); until it completes, Authenticate reports codes.Unavailable (fail closed, retryable) instead of blocking startup.
rawURL is validated synchronously before the goroutine is started, so a malformed configuration (bad scheme/host, not a transient IdP outage) fails construction immediately instead of surfacing as a permanent codes.Unavailable for every future request.
func (*JWKSAuthenticator) Authenticate ¶
Authenticate verifies the JWT carried in md: signature via the JWKS keyset, expiry, and (when configured) issuer and audience.
func (*JWKSAuthenticator) Header ¶
func (a *JWKSAuthenticator) Header() string
Header reports the metadata header this authenticator consumes, so StreamServerInterceptor can strip it before forwarding upstream.
type StaticCredentialProvider ¶
type StaticCredentialProvider struct {
// contains filtered or unexported fields
}
StaticCredentialProvider attaches a fixed bearer header to every outbound request to an upstream. It implements google.golang.org/grpc/credentials PerRPCCredentials and requires transport security, so gRPC refuses to send the credential over an insecure connection.
func NewStaticCredentialProvider ¶
func NewStaticCredentialProvider(apiKey, header, scheme string) (*StaticCredentialProvider, error)
NewStaticCredentialProvider builds a StaticCredentialProvider. header and scheme default to "authorization" and "Bearer" when blank. A blank apiKey is an error.
func (*StaticCredentialProvider) GetRequestMetadata ¶
func (p *StaticCredentialProvider) GetRequestMetadata(context.Context, ...string) (map[string]string, error)
GetRequestMetadata returns the fixed credential header for every call.
func (*StaticCredentialProvider) Header ¶
func (p *StaticCredentialProvider) Header() string
Header returns the metadata header this credential sets.
func (*StaticCredentialProvider) RequireTransportSecurity ¶
func (p *StaticCredentialProvider) RequireTransportSecurity() bool
RequireTransportSecurity reports that the credential must only travel over a secure transport.
type StaticTokenAuthenticator ¶
type StaticTokenAuthenticator struct {
// contains filtered or unexported fields
}
StaticTokenAuthenticator authenticates a request by comparing the bearer token in its metadata against a fixed configured value.
func NewStaticTokenAuthenticator ¶
func NewStaticTokenAuthenticator(token, header, scheme string) (*StaticTokenAuthenticator, error)
NewStaticTokenAuthenticator builds a StaticTokenAuthenticator. header and scheme default to "authorization" and "Bearer" when blank. A blank token is an error.
func (*StaticTokenAuthenticator) Authenticate ¶
Authenticate compares the extracted token against the configured value in constant time.
func (*StaticTokenAuthenticator) Header ¶
func (a *StaticTokenAuthenticator) Header() string
Header reports the metadata header this authenticator consumes, so StreamServerInterceptor can strip it before forwarding upstream.
Source Files