Documentation
¶
Index ¶
- Variables
- func GetClaimsFromTokenInRequest(req *http.Request) (*models.Principal, error)
- func GetConsoleCredentialsForOperator(jwt string) (*credentials.Credentials, error)
- func GetCredentialsFromLDAP(client *http.Client, endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error)
- func GetTokenFromRequest(r *http.Request) (string, error)
- func IsSessionTokenValid(token string) bool
- func NewEncryptedTokenForClient(credentials *credentials.Value, accountAccessKey string, actions []string) (string, error)
- type IdentityProvider
- type IdentityProviderI
- type OperatorClient
- type TokenClaims
Constants ¶
This section is empty.
Variables ¶
var (
ErrNoAuthToken = errors.New("session token missing")
)
Session token errors
Functions ¶
func GetConsoleCredentialsForOperator ¶
func GetConsoleCredentialsForOperator(jwt string) (*credentials.Credentials, error)
GetConsoleCredentialsForOperator will validate the provided JWT (service account token) and return it in the form of credentials.Login
func GetCredentialsFromLDAP ¶
func GetCredentialsFromLDAP(client *http.Client, endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error)
GetCredentialsFromLDAP authenticates the user against MinIO when the LDAP integration is enabled if the authentication succeed *credentials.Login object is returned and we continue with the normal STSAssumeRole flow
func GetTokenFromRequest ¶
GetTokenFromRequest returns a token from a http Request either defined on a cookie `token` or on Authorization header.
Authorization Header needs to be like "Authorization Bearer <token>"
func IsSessionTokenValid ¶
IsSessionTokenValid returns true or false depending if the provided session token is valid or not
func NewEncryptedTokenForClient ¶
func NewEncryptedTokenForClient(credentials *credentials.Value, accountAccessKey string, actions []string) (string, error)
NewEncryptedTokenForClient generates a new session token with claims based on the provided STS credentials, first encrypts the claims and the sign them
Types ¶
type IdentityProvider ¶
Interface implementation
Define the structure of a IdentityProvider with Client inside and define the functions that are used during the authentication flow.
func (IdentityProvider) GenerateLoginURL ¶
func (c IdentityProvider) GenerateLoginURL() string
GenerateLoginURL returns a new URL used by the user to login against the idp
func (IdentityProvider) VerifyIdentity ¶
func (c IdentityProvider) VerifyIdentity(ctx context.Context, code, state string) (*credentials.Credentials, error)
VerifyIdentity will verify the user identity against the idp using the authorization code flow
type IdentityProviderI ¶
type IdentityProviderI interface {
VerifyIdentity(ctx context.Context, code, state string) (*credentials.Credentials, error)
GenerateLoginURL() string
}
IdentityProviderI interface with all functions to be implemented by mock when testing, it should include all IdentityProvider respective api calls that are used within this project.
type OperatorClient ¶
OperatorClient interface with all functions to be implemented by mock when testing, it should include all OperatorClient respective api calls that are used within this project.
type TokenClaims ¶
type TokenClaims struct {
STSAccessKeyID string `json:"stsAccessKeyID,omitempty"`
STSSecretAccessKey string `json:"stsSecretAccessKey,omitempty"`
STSSessionToken string `json:"stsSessionToken,omitempty"`
AccountAccessKey string `json:"accountAccessKey,omitempty"`
Actions []string `json:"actions,omitempty"`
}
TokenClaims claims struct for decrypted credentials
func SessionTokenAuthenticate ¶
func SessionTokenAuthenticate(token string) (*TokenClaims, error)
SessionTokenAuthenticate takes a session token, decode it, extract claims and validate the signature if the session token claims are valid we proceed to decrypt the information inside
returns claims after validation in the following format:
type TokenClaims struct {
STSAccessKeyID
STSSecretAccessKey
STSSessionToken
AccountAccessKey
Actions
}
Source Files
Directories