config

type AuthorizationServer struct {
	// Defines the issuer to use when issuing and validating tokens. The default value is https://<requestUri.HostAndPort>/
	Issuer string `` /* 139-byte string literal not displayed */

	// Defines the lifespan of issued access tokens.
	AccessTokenLifespan config.Duration `json:"accessTokenLifespan" pflag:",Defines the lifespan of issued access tokens."`

	// Defines the lifespan of issued access tokens.
	RefreshTokenLifespan config.Duration `json:"refreshTokenLifespan" pflag:",Defines the lifespan of issued access tokens."`

	// Defines the lifespan of issued access tokens.
	AuthorizationCodeLifespan config.Duration `json:"authorizationCodeLifespan" pflag:",Defines the lifespan of issued access tokens."`

	// Secret names, defaults are set in DefaultConfig variable above but are possible to override through configs.
	ClaimSymmetricEncryptionKeySecretName string `json:"claimSymmetricEncryptionKeySecretName" pflag:",OPTIONAL: Secret name to use to encrypt claims in authcode token."`
	TokenSigningRSAKeySecretName          string `json:"tokenSigningRSAKeySecretName" pflag:",OPTIONAL: Secret name to use to retrieve RSA Signing Key."`
	OldTokenSigningRSAKeySecretName       string `` /* 184-byte string literal not displayed */

	// A list of clients to grant access to.
	StaticClients map[string]*fosite.DefaultClient `json:"staticClients" pflag:"-,Defines statically defined list of clients to allow."`
}

type AuthorizationServerType int

type Config struct {
	// These settings are for non-SSL authentication modes, where Envoy is handling SSL termination
	// This is not yet used, but this is the HTTP variant of the setting below.
	HTTPAuthorizationHeader string `json:"httpAuthorizationHeader"`

	// In order to support deployments of this Admin service where Envoy is terminating SSL connections, the metadata
	// header name cannot be "authorization", which is the standard metadata name. Envoy has special handling for that
	// name. Instead, there is a gRPC interceptor, GetAuthenticationCustomMetadataInterceptor, that will translate
	// incoming metadata headers with this config setting's name, into that standard header
	GrpcAuthorizationHeader string `json:"grpcAuthorizationHeader"`

	// To help ease migration, it was helpful to be able to only selectively enforce authentication.  The
	// dimension that made the most sense to cut by at time of writing is HTTP vs gRPC as the web UI mainly used HTTP
	// and the backend used mostly gRPC.  Cutting by individual endpoints is another option but it possibly falls more
	// into the realm of authorization rather than authentication.
	DisableForHTTP bool `json:"disableForHttp" pflag:",Disables auth enforcement on HTTP Endpoints."`
	DisableForGrpc bool `json:"disableForGrpc" pflag:",Disables auth enforcement on Grpc Endpoints."`

	// AuthorizedURIs is optional and defines the set of URIs that clients are allowed to visit the service on. If set,
	// the system will attempt to match the incoming host to the first authorized URIs and use that (including the scheme)
	// when generating metadata endpoints and when validating audience and issuer claims. If no matching authorizedUri
	// is found, it'll default to the first one. If not provided, the urls will be deduced based on the request url and
	// the `secure` setting.
	AuthorizedURIs []config.URL `` /* 415-byte string literal not displayed */

	// HTTPProxyURL allows operators to access external OAuth2 servers using an external HTTP Proxy
	HTTPProxyURL config.URL `json:"httpProxyURL" pflag:",OPTIONAL: HTTP Proxy to be used for OAuth requests."`

	// UserAuth settings used to authenticate end users in web-browsers.
	UserAuth UserAuthConfig `json:"userAuth" pflag:",Defines Auth options for users."`

	// AppAuth settings used to authenticate and control/limit access scopes for apps.
	AppAuth OAuth2Options `json:"appAuth" pflag:",Defines Auth options for apps. UserAuth must be enabled for AppAuth to work."`
}

type CookieSettings struct {
	SameSitePolicy SameSite `` /* 166-byte string literal not displayed */
	Domain         string   `json:"domain" pflag:",OPTIONAL: Allows you to set the domain attribute on the auth cookies."`
}

type ExternalAuthorizationServer struct {
	// BaseURL should be the base url of the authorization server that you are trying to hit. With Okta for instance, it will look something like https://company.okta.com/oauth2/abcdef123456789/
	// If not provided, the OpenID.BaseURL will be assumed instead.
	BaseURL             config.URL `` /* 208-byte string literal not displayed */
	AllowedAudience     []string   `` /* 149-byte string literal not displayed */
	MetadataEndpointURL config.URL `` /* 149-byte string literal not displayed */
	// HTTPProxyURL allows operators to access external OAuth2 servers using an external HTTP Proxy
	HTTPProxyURL  config.URL      `json:"httpProxyURL" pflag:",OPTIONAL: HTTP Proxy to be used for OAuth requests."`
	RetryAttempts int             `json:"retryAttempts" pflag:", Optional: The number of attempted retries on a transient failure to get the OAuth metadata"`
	RetryDelay    config.Duration `json:"retryDelay" pflag:", Optional, Duration to wait between retries"`
}

type NebulaClientConfig struct {
	ClientID    string   `json:"clientId" pflag:",public identifier for the app which handles authorization for a Nebula deployment"`
	RedirectURI string   `` /* 128-byte string literal not displayed */
	Scopes      []string `json:"scopes" pflag:",Recommended scopes for the client to request."`
	Audience    string   `json:"audience" pflag:",Audience to use when initiating OAuth2 authorization requests."`
}

type OAuth2Options struct {
	// AuthServerType defines the type of AuthServer to connect to.
	AuthServerType AuthorizationServerType `` /* 148-byte string literal not displayed */

	// SelfAuthServer defines settings for running authorization server locally.
	SelfAuthServer AuthorizationServer `` /* 164-byte string literal not displayed */

	// ExternalAuthServer defines settings for connecting with an external authorization server.
	ExternalAuthServer ExternalAuthorizationServer `json:"externalAuthServer" pflag:",External Authorization Server config."`

	// ThirdParty defines settings for the public client nebula-clients (e.g. nebulactl, nebulacli) should use.
	ThirdParty ThirdPartyConfigOptions `` /* 147-byte string literal not displayed */
}

type OpenIDOptions struct {
	// The client ID for Admin in your IDP
	// See https://tools.ietf.org/html/rfc6749#section-2.2 for more information
	ClientID string `json:"clientId"`

	// The client secret used in the exchange of the authorization code for the token.
	// https://tools.ietf.org/html/rfc6749#section-2.3
	ClientSecretName string `json:"clientSecretName"`

	// Deprecated: Please use ClientSecretName instead.
	DeprecatedClientSecretFile string `json:"clientSecretFile"`

	// This should be the base url of the authorization server that you are trying to hit. With Okta for instance, it
	// will look something like https://company.okta.com/oauth2/abcdef123456789/
	BaseURL config.URL `json:"baseUrl"`

	// Provides a list of scopes to request from the IDP when authenticating. Default value requests claims that should
	// be supported by any OIdC server. Refer to https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims for
	// a complete list. Other providers might support additional scopes that you can define in a config.
	Scopes []string `json:"scopes"`
}

type SameSite int

type SecretName = string

type ThirdPartyConfigOptions struct {
	NebulaClientConfig NebulaClientConfig `json:"nebulaClient"`
}

type UserAuthConfig struct {
	// This is where the user will be redirected to at the end of the flow, but you should not use it. Instead,
	// the initial /login handler should be called with a redirect_url parameter, which will get saved to a cookie.
	// This setting will only be used when that cookie is missing.
	// See the login handler code for more comments.
	RedirectURL config.URL `json:"redirectUrl"`

	// OpenID defines settings for connecting and trusting an OpenIDConnect provider.
	OpenID OpenIDOptions `json:"openId" pflag:",OpenID Configuration for User Auth"`

	// HTTPProxyURL allows operators to access external OAuth2 servers using an external HTTP Proxy
	HTTPProxyURL config.URL `json:"httpProxyURL" pflag:",OPTIONAL: HTTP Proxy to be used for OAuth requests."`

	// Secret names, defaults are set in DefaultConfig variable above but are possible to override through configs.
	CookieHashKeySecretName  string         `json:"cookieHashKeySecretName" pflag:",OPTIONAL: Secret name to use for cookie hash key."`
	CookieBlockKeySecretName string         `json:"cookieBlockKeySecretName" pflag:",OPTIONAL: Secret name to use for cookie block key."`
	CookieSetting            CookieSettings `json:"cookieSetting" pflag:", settings used by cookies created for user auth"`
}