Documentation
¶
Overview ¶
Package midgardclient contains a client that can be used to retrieve an Aporeto JWT from various authentication sources.
Index ¶
- func CredsToTLSConfig(creds *gaia.Credential) (tlsConfig *tls.Config, err error)
- func ExtractJWTFromHeader(header http.Header) (string, error)
- func NormalizeAuth(c *types.MidgardClaims) (claims []string)
- func ParseCredentials(data []byte) (creds *gaia.Credential, tlsConfig *tls.Config, err error)
- func UnsecureClaimsFromToken(token string) ([]string, error)
- func VerifyToken(tokenString string, cert *x509.Certificate) (*types.MidgardClaims, error)
- func VerifyTokenSignature(tokenString string, cert *x509.Certificate) ([]string, error)deprecated
- type Client
- func (a *Client) Authentify(ctx context.Context, token string) ([]string, error)
- func (a *Client) IssueFromAWSSecurityToken(ctx context.Context, accessKeyID, secretAccessKey, token string, ...) (string, error)
- func (a *Client) IssueFromAporetoIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
- func (a *Client) IssueFromAzureIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
- func (a *Client) IssueFromCertificate(ctx context.Context, validity time.Duration, options ...Option) (string, error)
- func (a *Client) IssueFromGCPIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
- func (a *Client) IssueFromGoogle(ctx context.Context, googleJWT string, validity time.Duration, ...) (string, error)
- func (a *Client) IssueFromLDAP(ctx context.Context, info *ldaputils.LDAPInfo, namespace string, ...) (string, error)
- func (a *Client) IssueFromOIDCStep1(ctx context.Context, namespace string, provider string, redirectURL string) (string, error)
- func (a *Client) IssueFromOIDCStep2(ctx context.Context, code string, state string, validity time.Duration, ...) (string, error)
- func (a *Client) IssueFromPCIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
- func (a *Client) IssueFromSAMLStep1(ctx context.Context, namespace string, provider string, redirectURL string) (string, error)
- func (a *Client) IssueFromSAMLStep2(ctx context.Context, response string, state string, validity time.Duration, ...) (string, error)
- func (a *Client) IssueFromVince(ctx context.Context, account string, password string, otp string, ...) (string, error)
- type Option
- type TokenManager
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CredsToTLSConfig ¶
func CredsToTLSConfig(creds *gaia.Credential) (tlsConfig *tls.Config, err error)
CredsToTLSConfig converts Crendential to *tlsConfig
func ExtractJWTFromHeader ¶
ExtractJWTFromHeader extracts the JWT from the given http.Header.
func NormalizeAuth ¶ added in v1.59.0
func NormalizeAuth(c *types.MidgardClaims) (claims []string)
NormalizeAuth normalizes the response to a simple structure.
func ParseCredentials ¶
ParseCredentials parses the credential data.
func UnsecureClaimsFromToken ¶
UnsecureClaimsFromToken gets a token and returns the Aporeto claims contained inside. It is Unsecure in the sense that It doesn't verify the token signature, so the token must be first verified in order to use this function securely.
func VerifyToken ¶ added in v1.69.1
func VerifyToken(tokenString string, cert *x509.Certificate) (*types.MidgardClaims, error)
VerifyToken verifies the jwt locally using the given certificate.
func VerifyTokenSignature
deprecated
func VerifyTokenSignature(tokenString string, cert *x509.Certificate) ([]string, error)
VerifyTokenSignature verifies the jwt locally using the given certificate.
Deprecated: VerifyTokenSignature is deprecated in favor of VerifyToken()
Types ¶
type Client ¶
type Client struct {
TrackingType string
// contains filtered or unexported fields
}
A Client allows to interract with a midgard server.
func NewClientWithTLS ¶
NewClientWithTLS returns a new Client configured with the given x509.CAPool.
func (*Client) Authentify ¶
Authentify authentifies the information included in the given token and returns a list of tag string containing the claims.
func (*Client) IssueFromAWSSecurityToken ¶
func (a *Client) IssueFromAWSSecurityToken(ctx context.Context, accessKeyID, secretAccessKey, token string, validity time.Duration, options ...Option) (string, error)
IssueFromAWSSecurityToken issues a Midgard jwt from a security token from amazon. If you don't pass anything, this function will try to retrieve the token using aws magic ip.
func (*Client) IssueFromAporetoIdentityToken ¶ added in v1.69.2
func (a *Client) IssueFromAporetoIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
IssueFromAporetoIdentityToken issues a Midgard jwt from an existing one. This new token validity will be capped to the original expiration time and identity claims will be identical. This can be used to issued a token with restrictions without needing the original source of authentication.
func (*Client) IssueFromAzureIdentityToken ¶
func (a *Client) IssueFromAzureIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
IssueFromAzureIdentityToken issues a Midgard jwt from a signed Azure identity document for the given validity duration.
func (*Client) IssueFromCertificate ¶
func (a *Client) IssueFromCertificate(ctx context.Context, validity time.Duration, options ...Option) (string, error)
IssueFromCertificate issues a Midgard jwt from a certificate for the given validity duration.
func (*Client) IssueFromGCPIdentityToken ¶
func (a *Client) IssueFromGCPIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
IssueFromGCPIdentityToken issues a Midgard jwt from a signed GCP identity document for the given validity duration.
func (*Client) IssueFromGoogle ¶
func (a *Client) IssueFromGoogle(ctx context.Context, googleJWT string, validity time.Duration, options ...Option) (string, error)
IssueFromGoogle issues a Midgard jwt from a Google JWT for the given validity duration.
func (*Client) IssueFromLDAP ¶
func (a *Client) IssueFromLDAP(ctx context.Context, info *ldaputils.LDAPInfo, namespace string, provider string, validity time.Duration, options ...Option) (string, error)
IssueFromLDAP issues a Midgard JWT from an LDAP config for the given validity duration.
func (*Client) IssueFromOIDCStep1 ¶
func (a *Client) IssueFromOIDCStep1(ctx context.Context, namespace string, provider string, redirectURL string) (string, error)
IssueFromOIDCStep1 issues a Midgard jwt from a OICD provider. This is performing the first step to validate the issue requests and OIDC provider. It will return the OIDC auth endpoint
func (*Client) IssueFromOIDCStep2 ¶
func (a *Client) IssueFromOIDCStep2(ctx context.Context, code string, state string, validity time.Duration, options ...Option) (string, error)
IssueFromOIDCStep2 issues a Midgard jwt from a OICD provider. This is performing the second step to to exchange the code for a Midgard HWT.
func (*Client) IssueFromPCIdentityToken ¶ added in v1.69.2
func (a *Client) IssueFromPCIdentityToken(ctx context.Context, token string, validity time.Duration, options ...Option) (string, error)
IssueFromPCIdentityToken issues a Midgard jwt from a PCC token.
func (*Client) IssueFromSAMLStep1 ¶ added in v1.51.0
func (a *Client) IssueFromSAMLStep1(ctx context.Context, namespace string, provider string, redirectURL string) (string, error)
IssueFromSAMLStep1 issues a Midgard jwt from a SAML provider. This is performing the first step to validate the issue requests and OIDC provider. It will return the OIDC auth endpoint
func (*Client) IssueFromSAMLStep2 ¶ added in v1.51.0
func (a *Client) IssueFromSAMLStep2(ctx context.Context, response string, state string, validity time.Duration, options ...Option) (string, error)
IssueFromSAMLStep2 issues a Midgard jwt from a SAML provider. This is performing the second step to to exchange the code for a Midgard HWT.
type Option ¶
type Option func(*issueOpts)
An Option is the type of various options You can add the issue requests.
func OptAudience ¶
OptAudience passes the requested audience for the token. Using OptAudience is deprecated. Switch to OptLimitAuthz. (TODO: Find real mapping as OptLimitAuthz does not exist)
func OptRestrictNamespace ¶ added in v1.69.2
OptRestrictNamespace asks for a restricted token on the given namespace.
func OptRestrictNetworks ¶ added in v1.69.2
OptRestrictNetworks asks for a restricted token on the given networks.
func OptRestrictPermissions ¶ added in v1.69.2
OptRestrictPermissions asks for a restricted token on the given permissions.
type TokenManager ¶
type TokenManager struct {
// contains filtered or unexported fields
}
A TokenManager issues an renew tokens periodically.
Source Files