Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewKeystoreCollector ¶
func NewKeystoreCollector(ks *KeyStore) prometheus.Collector
NewKeystoreCollector returns a prometheus.Collector that will export metrics for the given KeyStore instance.
Types ¶
type Config ¶
type Config struct {
SSOPublicKeyFile string `yaml:"sso_public_key_file"`
SSOService string `yaml:"sso_service"`
SSODomain string `yaml:"sso_domain"`
Backend *backend.Config `yaml:"backend"`
}
Config for the KeyStore.
type KeyStore ¶
type KeyStore struct {
// contains filtered or unexported fields
}
KeyStore holds decrypted secrets for users in memory for a short time (of the order of a SSO session lifespan). User secrets can be opened with a password (used to decrypt the key, which is stored encrypted in a database), queried, and closed (forgotten).
The database can provide multiple versions of the encrypted key (to support multiple decryption passwords), in which case we'll try them all sequentially until one of them decrypts successfully with the provided password.
In order to query the KeyStore, you need to present a valid SSO token for the user whose secrets you would like to obtain.
func NewKeyStore ¶
NewKeyStore creates a new KeyStore with the given config and returns it.
func (*KeyStore) Close ¶
Close the user's key store and wipe the associated unencrypted key from memory. Returns true if a key was actually discarded.
func (*KeyStore) Get ¶
Get the unencrypted key for the specified user. The caller needs to provide a valid SSO ticket for the user.
func (*KeyStore) Open ¶
func (s *KeyStore) Open(ctx context.Context, username, password, sessionID string, ttlSeconds int) error
Open the user's key store with the given password. If successful, the unencrypted user key will be stored for at most ttlSeconds, or until Close is called with the same session ID.
Note that the key is fetched from the backend and decrypted even if we already have it in memory (for instance belonging to a separate session), because this acts as an implicit ACL check: does the user have access to the key because it can decrypt it with the provided credentials?
A Context is needed because this method might issue an RPC.
Source Files