Documentation
¶
Overview ¶
Package local implements the local identity adapter: username and password, argon2id.
Identity adapters authenticate only (R-044). Subject carries no roles, no verbs, and no permissions — group names cross the boundary, but what a group can do is Pando's (R-078).
Index ¶
- Constants
- type Adapter
- func (a *Adapter) Authenticate(ctx context.Context, c api.Credential) (api.Subject, error)
- func (a *Adapter) Begin(context.Context, api.BeginRequest) (*api.Redirect, error)
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) ServiceMetadata(context.Context, api.Endpoints) (*api.Metadata, error)
- func (a *Adapter) SessionPolicy() api.SessionPolicy
- func (a *Adapter) SupportsPush() bool
- type Record
- type Users
Constants ¶
const Kind = "local"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter is the local username-and-password identity adapter (R-041).
It is the v1 adapter and the default on a fresh install. R-042 is a documentation requirement rather than a code one: local users must be secure, but are not claimed to be the most secure option, and installs with real security requirements are expected to configure an external provider.
func (*Adapter) Authenticate ¶
Authenticate verifies a username and password.
Every failure returns the same error regardless of cause. Distinguishing "no such user" from "wrong password" turns the login form into an account enumeration oracle, and the work is done either way so the timing does not separate them: a missing user is compared against a decoy hash.
func (*Adapter) HealthCheck ¶
HealthCheck always succeeds: the local adapter has no external dependency, and the store it reads is Pando's own.
func (*Adapter) ServiceMetadata ¶
ServiceMetadata returns nil: there is no provider to tell about Pando.
func (*Adapter) SessionPolicy ¶
func (a *Adapter) SessionPolicy() api.SessionPolicy
SessionPolicy declares this adapter's own session behavior (R-047).
The local adapter owns its user records, so it can revoke immediately — there is no external provider to hear from.
func (*Adapter) SupportsPush ¶
SupportsPush is true in the trivial sense: changes originate here.
type Record ¶
type Record struct {
ExternalID string
Email string
DisplayName string
PasswordHash string
Status string
}
Record is a stored local user.
type Users ¶
type Users interface {
// ByUsername returns the stored record, or ok=false. Implementations must
// not distinguish "no such user" from "wrong password" to the caller; that
// is Authenticate's job below.
ByUsername(ctx context.Context, username string) (Record, bool, error)
}
Users is the adapter's view of stored local users.
Deliberately minimal: the adapter authenticates and nothing more (R-044). It cannot read grants, cannot write audit events, and does not know what a verb is — the R-027 boundary as an interface rather than a convention.
Source Files