Documentation
¶
Overview ¶
Package iam builds the platform's authentication and authorization identity layer: the authenticator chain (NewIdentity), the persona authorizer (NewAuthorizer), and the role-to-persona membership resolver (PersonasForRoles) that persona-scoped surfaces read a caller's memberships through.
Constructors take an explicit Input rather than the platform config, so the layer can be built and tested on its own. The package must not import pkg/platform: the auth config types live there, so importing it would create a cycle. Callers translate their config into Input at the boundary.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Authority ¶ added in v1.143.0
func Authority(authz middleware.Authorizer, isAdmin func(name string) bool) func(roles []string) (name string, admin bool)
Authority returns what a request presenting roles acts as: the persona the authorizer resolves them to, and whether that persona is the administrator's, which isAdmin decides from its name (the registry's IsAdminName, so an external persona carrying the name is not, #2257). It is how work the platform does on a person's behalf outside a request, a managed-script run's library write (#2080), is held to the authority that person's own request would have. Nil without an authorizer.
func NewAuthorizer ¶
func NewAuthorizer(in Input) middleware.Authorizer
NewAuthorizer builds the persona-based authorizer from in. It is independent of NewIdentity so a caller can override one without constructing the other.
func PersonasForRoles ¶ added in v1.120.0
func PersonasForRoles(pr *persona.Registry) middleware.PersonasForRoles
PersonasForRoles returns the resolver that answers which personas a caller BELONGS TO, given their roles. It is distinct from the single resolved persona a request acts as: surfaces whose visibility rule is membership (managed resources, prompt completion, discovery) scope on this set.
Types ¶
type Identity ¶
type Identity struct {
// Authenticator is the assembled authenticator (a chain, or a noop when
// nothing is configured).
Authenticator middleware.Authenticator
// APIKeyAuth is the API key authenticator when API keys are enabled, or nil.
// The caller keeps it so DB-backed keys can be appended after startup.
APIKeyAuth *auth.APIKeyAuthenticator
}
Identity is the authenticator half of the identity layer.
func NewIdentity ¶
NewIdentity builds the authenticator chain from in. Authenticators are ordered OAuth JWT → OIDC → API key so a token issued by our own OAuth server is checked first; when none are configured a permissive noop is returned.
type Input ¶
type Input struct {
// OAuthEnabled gates the OAuth JWT authenticator (for tokens issued by our
// own OAuth server). It is only added when a signing key is also present.
OAuthEnabled bool
OAuthJWT auth.OAuthJWTConfig
// OIDCEnabled gates the OIDC authenticator (for tokens from an external IdP).
OIDCEnabled bool
OIDC auth.OIDCConfig
// APIKeysEnabled gates the API key authenticator.
APIKeysEnabled bool
APIKeys []auth.APIKey
// AllowAnonymous permits unauthenticated access through the chained
// authenticator; ignored when no authenticators are configured (noop).
AllowAnonymous bool
// Authorizer inputs.
PersonaRegistry *persona.Registry
RoleClaimPath string
RolePrefix string
OIDCToPersona map[string]string
}
Input holds the values NewIdentity and NewAuthorizer need. Callers build it from their own config, keeping platform config types out of this package.
Source Files