Documentation
¶
Index ¶
- Constants
- Variables
- func Authorizer(sessionManager *SessionManager, whitelistChecker func(url string) bool, ...) func(next http.Handler) http.Handler
- func Username(ctx context.Context) string
- func WhitelistChecker(url string) bool
- type Account
- type AccountCapability
- type Config
- type LoginService
- type SessionManager
- func (mgr *SessionManager) Create(subject string, secondsBeforeExpiry int64, id string) (string, error)
- func (mgr *SessionManager) GetUserSessionDuration() time.Duration
- func (mgr *SessionManager) Parse(tokenString string) (jwt.Claims, error)
- func (mgr *SessionManager) ParseApiToken(tokenString string) (jwt.Claims, error)
- func (mgr *SessionManager) UpdateSettings(settings *oidc.Settings, config *client.DexConfig)
- func (mgr *SessionManager) VerifyToken(tokenString string) (jwt.Claims, error)
- type Token
Constants ¶
const ( // SessionManagerClaimsIssuer fills the "iss" field of the token. SessionManagerClaimsIssuer = "argocd" // ApiTokenClaimIssuer is the issuer who generated api-token for APIs ApiTokenClaimIssuer = "apiTokenIssuer" )
const (
AccountCapabilityLogin = "login"
)
const ApiTokenHeaderKey = "api-token"
Variables ¶
var (
InvalidLoginErr = status.Errorf(codes.Unauthenticated, invalidLoginError)
)
Functions ¶
func Authorizer ¶
func Authorizer(sessionManager *SessionManager, whitelistChecker func(url string) bool, userStatusCheckInDb func(token string) (bool, int32, error)) func(next http.Handler) http.Handler
Authorizer is a middleware for authorization
func WhitelistChecker ¶
Types ¶
type Account ¶
type Account struct {
PasswordHash string
PasswordMtime *time.Time
Enabled bool
Capabilities []AccountCapability
Tokens []Token
}
func (*Account) FormatCapabilities ¶
FormatCapabilities returns comma separate list of user capabilities.
func (*Account) FormatPasswordMtime ¶
FormatPasswordMtime return the formatted password modify time or empty string of password modify time is nil.
func (*Account) HasCapability ¶
func (a *Account) HasCapability(capability AccountCapability) bool
HasCapability return true if the account has the specified capability.
func (*Account) TokenIndex ¶
TokenIndex return an index of a token with the given identifier or -1 if token not found.
type AccountCapability ¶
type AccountCapability string
type LoginService ¶
type LoginService struct {
// contains filtered or unexported fields
}
func NewUserLogin ¶
func NewUserLogin(sessionManager *SessionManager, k8sClient *client.K8sClient) *LoginService
func (*LoginService) GetAccount ¶
func (impl *LoginService) GetAccount(name string) (*Account, error)
type SessionManager ¶
type SessionManager struct {
// contains filtered or unexported fields
}
SessionManager generates and validates JWT tokens for login sessions.
func NewSessionManager ¶
func NewSessionManager(settings *oidc.Settings, config *client.DexConfig, apiTokenSecretStore *apiTokenAuth.ApiTokenSecretStore) *SessionManager
NewSessionManager creates a new session manager from Argo CD settings
func (*SessionManager) Create ¶
func (mgr *SessionManager) Create(subject string, secondsBeforeExpiry int64, id string) (string, error)
Create creates a new token for a given subject (user) and returns it as a string. Passing a value of `0` for secondsBeforeExpiry creates a token that never expires.
func (*SessionManager) GetUserSessionDuration ¶
func (mgr *SessionManager) GetUserSessionDuration() time.Duration
func (*SessionManager) Parse ¶
func (mgr *SessionManager) Parse(tokenString string) (jwt.Claims, error)
Parse tries to parse the provided string and returns the token claims for local superuser login.
func (*SessionManager) ParseApiToken ¶ added in v0.4.28
func (mgr *SessionManager) ParseApiToken(tokenString string) (jwt.Claims, error)
ParseApiToken tries to parse the provided string and returns the token claims for api-token user.
func (*SessionManager) UpdateSettings ¶ added in v0.4.24
func (mgr *SessionManager) UpdateSettings(settings *oidc.Settings, config *client.DexConfig)
func (*SessionManager) VerifyToken ¶
func (mgr *SessionManager) VerifyToken(tokenString string) (jwt.Claims, error)
VerifyToken verifies if a token is correct. Tokens can be issued either from us or by an IDP. We choose how to verify based on the issuer.
Source Files