Documentation
¶
Overview ¶
Package auth provides authentication and authorization support. Authentication: You are who you say you are. Authorization: You have permission to do what you are requesting to do.
Index ¶
Constants ¶
const ( RuleAuthenticate = "auth" RuleAny = "rule_any" RuleAdminOnly = "rule_admin_only" RuleUserOnly = "rule_user_only" RuleAdminOrSubject = "rule_admin_or_subject" )
These the current set of rules we have for auth.
Variables ¶
var ErrForbidden = errors.New("attempted action is not allowed")
ErrForbidden is returned when a auth issue is identified.
Functions ¶
func IsAuthError ¶
IsAuthError checks if an error of type AuthError exists.
func NewAuthError ¶
NewAuthError creates an AuthError for the provided message.
Types ¶
type Auth ¶
type Auth struct {
// contains filtered or unexported fields
}
Auth is used to authenticate clients. It can generate a token for a set of user claims and recreate the claims by parsing the token.
func (*Auth) Authenticate ¶
Authenticate processes the token(signature of the jwt) to validate the sender's token is valid using the public key pair of the private key that signed the jwt.
type Claims ¶
type Claims struct {
jwt.RegisteredClaims
Roles []user.Role `json:"roles"`
}
Claims represents the authorization claims transmitted via a JWT.
type Config ¶
type Config struct {
Log *zap.SugaredLogger
KeyLookup KeyLookup
Issuer string
}
Config represents information required to initialize auth.
type KeyLookup ¶
type KeyLookup interface {
PrivateKey(kid string) (key string, err error)
PublicKey(kid string) (key string, err error)
}
KeyLookup declares a method set of behavior for looking up private and public keys for JWT use. The return could be a PEM encoded string or a JWS based key.
The interface methods return the pem encoded data. Because OPA wants pem encoded data to do the validation. So we should name the first return
value as `pem` not `key`. Right? Well no, because there are other formats other than pem that might represent the key and OPA supports them as well. So we keep it more generic by naming it `key` instead of `pem`. Because the key can come in many forms like pem or ... .
Source Files