Documentation
¶
Overview ¶
Package caep implements the OpenID CAEP event types and the RFC 9493 subject identifiers they carry. It has no authsome dependencies so it can be tested against spec fixtures on its own.
Index ¶
Constants ¶
const ( EventSessionRevoked = "https://schemas.openid.net/secevent/caep/event-type/session-revoked" EventTokenClaimsChange = "https://schemas.openid.net/secevent/caep/event-type/token-claims-change" // #nosec G101 -- public CAEP event type URI, not a credential EventCredentialChange = "https://schemas.openid.net/secevent/caep/event-type/credential-change" // #nosec G101 -- public CAEP event type URI, not a credential EventAssuranceLevelChange = "https://schemas.openid.net/secevent/caep/event-type/assurance-level-change" EventDeviceComplianceChange = "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change" EventRiskLevelChange = "https://schemas.openid.net/secevent/caep/event-type/risk-level-change" EventVerification = "https://schemas.openid.net/secevent/ssf/event-type/verification" )
CAEP and SSF event type URIs.
const ( FormatAccount = "account" FormatEmail = "email" FormatIssSub = "iss_sub" FormatOpaque = "opaque" FormatPhoneNumber = "phone_number" FormatDID = "did" FormatURI = "uri" FormatAliases = "aliases" )
Subject identifier formats defined by RFC 9493.
Variables ¶
var ComplexSubjectMembers = []string{
"user", "device", "session", "application", "tenant", "org_unit", "group",
}
ComplexSubjectMembers are the member names the SSF spec defines for a Complex Subject. Any other member name is carried but not interpreted.
Functions ¶
func IsKnownEventType ¶
IsKnownEventType reports whether this build understands the event type.
func IsStreamLevel ¶
IsStreamLevel reports whether an event describes the STREAM rather than a principal on it. A stream-level event carries no subject at all, so it can neither be resolved to a user nor be refused for failing to resolve to one. SSF's verification event is the only one today.
Types ¶
type Event ¶
type Event struct {
Type string
// Subject is the zero SubjectID for a stream-level event.
Subject SubjectID
// RawSubject is the exact subject JSON the transmitter sent, kept
// verbatim for the audit row. The receiver deliberately keeps offending
// values out of its error responses on the grounds that they belong in
// the audit record instead, which only works if the audit record
// actually gets them. Empty for a stream-level event.
RawSubject json.RawMessage
EventTimestamp int64
InitiatingEntity string
ReasonAdmin map[string]string
ReasonUser map[string]string
// credential-change
CredentialType string
ChangeType string
FriendlyName string
// assurance-level-change
Namespace string
CurrentLevel string
PreviousLevel string
ChangeDirection string
// device-compliance-change
CurrentStatus string
PreviousStatus string
// token-claims-change
Claims map[string]any
// risk-level-change
RiskReason string
Principal string
// SSF verification
State string
}
Event is one decoded event payload from a SET's events map.
func ParseEvent ¶
func ParseEvent(eventType string, payload json.RawMessage) (Event, error)
ParseEvent decodes one event payload. It accepts the subject under either `sub_id` (CAEP 1.0 final) or `subject` (what Okta and Google ship today), preferring `sub_id` when a payload carries both.
Every CAEP event names a principal and is refused without one. A stream-level event (see IsStreamLevel) is the exception: SSF's verification event describes the stream itself and carries only `state`, so requiring a subject there made the entire verification handshake unprocessable.
type SubjectID ¶
type SubjectID struct {
Format string
Email string
PhoneNumber string
Issuer string
Subject string
ID string
URI string
URL string
Identifiers []SubjectID
Members map[string]SubjectID
}
SubjectID is an RFC 9493 subject identifier. A simple subject sets Format and the members that format requires. A complex subject sets Members instead, with Format empty.
func ParseSubjectID ¶
func ParseSubjectID(raw json.RawMessage) (SubjectID, error)
ParseSubjectID decodes a subject identifier, simple or complex.
Source Files