Documentation
¶
Index ¶
- Constants
- Variables
- func Anonymous() *identity
- func AnonymousRoles() types.RoleSet
- func ApplyRoleSecurity(permitted, prohibited, forced []uint64, rr ...uint64) (out []uint64)
- func Authenticated(id uint64, rr ...uint64) *identity
- func AuthenticatedRoles() types.RoleSet
- func BypassRoles() types.RoleSet
- func CheckJwtScope(token jwt.Token, required ...string) bool
- func CheckScope(scope string, required ...string) bool
- func DefaultAccessTokenGenerator(ctx context.Context, req TokenRequest) (string, string, error)
- func ExtraReqInfoMiddleware(next http.Handler) http.Handler
- func ExtractFromSubClaim(sub string) (userID uint64, rr []uint64)
- func FederationUser() *types.User
- func HmacSigner(secret string) *hmacSigner
- func HttpTokenValidator(scope ...string) func(http.Handler) http.Handler
- func IdentityFromToken(token jwt.Token) *identity
- func NewTokenIssuer(opt ...IssuerOptFn) (issuer *tokenIssuer, err error)
- func ProvisionUser() *types.User
- func ServiceUser() *types.User
- func SetIdentityToContext(ctx context.Context, identity Identifiable) context.Context
- func SetSystemRoles(rr types.RoleSet)
- func SetSystemUsers(uu types.UserSet, rr types.RoleSet)
- func SetupSigner(secret string) (err error)
- func TokenVerifierMiddlewareWithSecretSigner(secret string) (_ func(http.Handler) http.Handler, err error)
- type ExtraReqInfo
- type Identifiable
- type IssueOptFn
- type IssuerOptFn
- func WithDefaultClientID(ID uint64) IssuerOptFn
- func WithDefaultExpiration(exp time.Duration) IssuerOptFn
- func WithDefaultIssuer(iss string) IssuerOptFn
- func WithGenerator(fn tokenIssuerGenerator) IssuerOptFn
- func WithLookup(fn tokenIssuerLookup) IssuerOptFn
- func WithSecretSigner(secret string) IssuerOptFn
- func WithSigner(fn tokenIssuerSigner) IssuerOptFn
- func WithStore(fn tokenIssuerStore) IssuerOptFn
- type Signer
- type TokenRequest
Constants ¶
const ( ProvisionUserHandle = "corteza-provisioner" ServiceUserHandle = "corteza-service" FederationUserHandle = "corteza-federation" BypassRoleHandle = "super-admin" AuthenticatedRoleHandle = "authenticated" AnonymousRoleHandle = "anonymous" )
Variables ¶
var (
HttpTokenVerifier func(http.Handler) http.Handler
)
var (
TokenIssuer *tokenIssuer
)
Functions ¶
func Anonymous ¶
func Anonymous() *identity
Anonymous constructs and returns new anonymous identity with system anonymous roles
func AnonymousRoles ¶
AnonymousRoles returns all anonymous Roles
func ApplyRoleSecurity ¶
ApplyRoleSecurity takes role security params (set of permitted, prohibited and forced roles) and applies these rules to the set of given roles
Filtered set of roles is returned ¶
String slices are used intentionally, because of the data source used
func Authenticated ¶
Authenticated constructs and returns new authenticated identity with assigned roles + system authenticated roles
func AuthenticatedRoles ¶
AuthenticatedRoles returns all authenticated Roles
func CheckJwtScope ¶
CheckJwtScope verifies if required scope is in claim We're using interface{} and casting it if needed to simplify usage of the fn by directly using it with map[string]interface{} claims type
func CheckScope ¶
func DefaultAccessTokenGenerator ¶
DefaultAccessTokenGenerator uses token generator from oauth2 lib
func ExtractFromSubClaim ¶
func FederationUser ¶
FederationUser returns clone of system federation user
func HmacSigner ¶
func HmacSigner(secret string) *hmacSigner
func HttpTokenValidator ¶
HttpTokenValidator checks if there is a token with identity and matching scope claim
Empty scope defaults to "api"!
func IdentityFromToken ¶
IdentityFromToken decodes sub & roles claims into identity
func NewTokenIssuer ¶
func NewTokenIssuer(opt ...IssuerOptFn) (issuer *tokenIssuer, err error)
NewTokenIssuer initializes and returns new instance of JWT manager
func ProvisionUser ¶
ProvisionUser returns clone of system provision user
func SetIdentityToContext ¶
func SetIdentityToContext(ctx context.Context, identity Identifiable) context.Context
func SetSystemRoles ¶
func SetSystemUsers ¶
SetSystemUsers takes list of users and sets/updates appropriate provision, service & fed users
These are then accessed via special *User() fn.
func SetupSigner ¶
Types ¶
type ExtraReqInfo ¶
func GetExtraReqInfoFromContext ¶
func GetExtraReqInfoFromContext(ctx context.Context) ExtraReqInfo
type Identifiable ¶
func GetIdentityFromContext ¶
func GetIdentityFromContext(ctx context.Context) Identifiable
GetIdentityFromContext always returns identity, either valid or anonymous
For anonymous user, it auto appends all anonymous defined on the system
func GetIdentityFromContextWithKey ¶
func GetIdentityFromContextWithKey(ctx context.Context, key interface{}) Identifiable
type IssueOptFn ¶
type IssueOptFn func(*TokenRequest) error
IssueOptFn functions modify TokenRequest
func WithAccessToken ¶
func WithAccessToken(access string) IssueOptFn
func WithAudience ¶
func WithAudience(aud string) IssueOptFn
func WithClientID ¶
func WithClientID(id uint64) IssueOptFn
func WithExpiration ¶
func WithExpiration(e time.Duration) IssueOptFn
func WithIdentity ¶
func WithIdentity(i Identifiable) IssueOptFn
func WithScope ¶
func WithScope(ss ...string) IssueOptFn
type IssuerOptFn ¶
type IssuerOptFn func(*tokenIssuer) error
IssuerOptFn modify toeknIssuer
func WithDefaultClientID ¶
func WithDefaultClientID(ID uint64) IssuerOptFn
WithDefaultClientID configures ID of the default auth client
func WithDefaultExpiration ¶
func WithDefaultExpiration(exp time.Duration) IssuerOptFn
WithDefaultExpiration configures default token expiration time
func WithDefaultIssuer ¶
func WithDefaultIssuer(iss string) IssuerOptFn
WithDefaultIssuer configures default issuer claim
func WithGenerator ¶
func WithGenerator(fn tokenIssuerGenerator) IssuerOptFn
WithGenerator configures generator function
func WithLookup ¶
func WithLookup(fn tokenIssuerLookup) IssuerOptFn
WithLookup configures lookup function
func WithSecretSigner ¶
func WithSecretSigner(secret string) IssuerOptFn
WithSecretSigner configures token issuer with
func WithSigner ¶
func WithSigner(fn tokenIssuerSigner) IssuerOptFn
WithSigner configures signer function
func WithStore ¶
func WithStore(fn tokenIssuerStore) IssuerOptFn
WithStore configures store function
Source Files