authorization

type AuthInfo ¶ added in v1.4.0

type AuthInfo struct {
	AuthToken     string
	TLSSubject    *pkix.Name
	TLSConnection *credentials.TLSInfo
	ExtraData     string
	Audience      string
}

@@@SNIPSTART temporal-common-authorization-authinfo Authentication information from subject's JWT token or/and mTLS certificate

type Authorizer ¶

type Authorizer interface {
	Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
}

@@@SNIPSTART temporal-common-authorization-authorizer-interface Authorizer is an interface for implementing authorization logic

func GetAuthorizerFromConfig(config *config.Authorization) (Authorizer, error)

func NewDefaultAuthorizer() Authorizer

func NewNoopAuthorizer() Authorizer

type CallTarget ¶ added in v1.4.0

type CallTarget struct {
	// APIName must be the full API function name.
	// Example: "/temporal.api.workflowservice.v1.WorkflowService/StartWorkflowExecution".
	APIName string
	// If a Namespace is not being targeted this be set to an empty string.
	Namespace string
	// Request contains a deserialized copy of the API request object
	Request interface{}
}

@@@SNIPSTART temporal-common-authorization-authorizer-calltarget CallTarget is contains information for Authorizer to make a decision. It can be extended to include resources like WorkflowType and TaskQueue

type ClaimMapper ¶ added in v1.4.0

type ClaimMapper interface {
	GetClaims(authInfo *AuthInfo) (*Claims, error)
}

@@@SNIPSTART temporal-common-authorization-claimmapper-interface ClaimMapper converts authorization info of a subject into Temporal claims (permissions) for authorization

func GetClaimMapperFromConfig(config *config.Authorization, logger log.Logger) (ClaimMapper, error)

func NewDefaultJWTClaimMapper(provider TokenKeyProvider, cfg *config.Authorization, logger log.Logger) ClaimMapper

func NewNoopClaimMapper() ClaimMapper

type ClaimMapperWithAuthInfoRequired ¶ added in v1.20.3

type ClaimMapperWithAuthInfoRequired interface {
	AuthInfoRequired() bool
}

Normally, GetClaims will never be called without either an auth token or TLS metadata set in AuthInfo. However, if you want your ClaimMapper to be called in all cases, you can implement this additional interface and return false.

type Claims ¶ added in v1.4.0

type Claims struct {
	// Identity of the subject
	Subject string
	// Role within the context of the whole Temporal cluster or a multi-cluster setup
	System Role
	// Roles within specific namespaces
	Namespaces map[string]Role
	// Free form bucket for extra data
	Extensions interface{}
}

@@@SNIPSTART temporal-common-authorization-claims Claims contains the identity of the subject and subject's roles at the system level and for individual namespaces

type Decision ¶

type Decision int

Decision is enum type for auth decision

const (
	// DecisionDeny means auth decision is deny
	DecisionDeny Decision = iota + 1
	// DecisionAllow means auth decision is allow
	DecisionAllow
)

type JWTAudienceMapper ¶ added in v1.10.3

type JWTAudienceMapper interface {
	Audience(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo) string
}

JWTAudienceMapper returns JWT audience for a given request

type MockAuthorizer ¶

type MockAuthorizer struct {
	// contains filtered or unexported fields
}

MockAuthorizer is a mock of Authorizer interface.

func NewMockAuthorizer(ctrl *gomock.Controller) *MockAuthorizer

func (m *MockAuthorizer) Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)

func (m *MockAuthorizer) EXPECT() *MockAuthorizerMockRecorder

type MockAuthorizerMockRecorder ¶

type MockAuthorizerMockRecorder struct {
	// contains filtered or unexported fields
}

MockAuthorizerMockRecorder is the mock recorder for MockAuthorizer.

func (mr *MockAuthorizerMockRecorder) Authorize(ctx, caller, target interface{}) *gomock.Call

type MockClaimMapper ¶ added in v1.4.0

type MockClaimMapper struct {
	// contains filtered or unexported fields
}

MockClaimMapper is a mock of ClaimMapper interface.

func NewMockClaimMapper(ctrl *gomock.Controller) *MockClaimMapper

func (m *MockClaimMapper) EXPECT() *MockClaimMapperMockRecorder

func (m *MockClaimMapper) GetClaims(authInfo *AuthInfo) (*Claims, error)

type MockClaimMapperMockRecorder ¶ added in v1.4.0

type MockClaimMapperMockRecorder struct {
	// contains filtered or unexported fields
}

MockClaimMapperMockRecorder is the mock recorder for MockClaimMapper.

func (mr *MockClaimMapperMockRecorder) GetClaims(authInfo interface{}) *gomock.Call

type MockClaimMapperWithAuthInfoRequired ¶ added in v1.20.3

type MockClaimMapperWithAuthInfoRequired struct {
	// contains filtered or unexported fields
}

MockClaimMapperWithAuthInfoRequired is a mock of ClaimMapperWithAuthInfoRequired interface.

func NewMockClaimMapperWithAuthInfoRequired(ctrl *gomock.Controller) *MockClaimMapperWithAuthInfoRequired

func (m *MockClaimMapperWithAuthInfoRequired) AuthInfoRequired() bool

func (m *MockClaimMapperWithAuthInfoRequired) EXPECT() *MockClaimMapperWithAuthInfoRequiredMockRecorder

type MockClaimMapperWithAuthInfoRequiredMockRecorder ¶ added in v1.20.3

type MockClaimMapperWithAuthInfoRequiredMockRecorder struct {
	// contains filtered or unexported fields
}

MockClaimMapperWithAuthInfoRequiredMockRecorder is the mock recorder for MockClaimMapperWithAuthInfoRequired.

func (mr *MockClaimMapperWithAuthInfoRequiredMockRecorder) AuthInfoRequired() *gomock.Call

type MockhasNamespace ¶ added in v1.8.2

type MockhasNamespace struct {
	// contains filtered or unexported fields
}

MockhasNamespace is a mock of hasNamespace interface.

func NewMockhasNamespace(ctrl *gomock.Controller) *MockhasNamespace

func (m *MockhasNamespace) EXPECT() *MockhasNamespaceMockRecorder

func (m *MockhasNamespace) GetNamespace() string

type MockhasNamespaceMockRecorder ¶ added in v1.8.2

type MockhasNamespaceMockRecorder struct {
	// contains filtered or unexported fields
}

MockhasNamespaceMockRecorder is the mock recorder for MockhasNamespace.

func (mr *MockhasNamespaceMockRecorder) GetNamespace() *gomock.Call

type RawTokenKeyProvider ¶ added in v1.15.0

type RawTokenKeyProvider interface {
	GetKey(ctx context.Context, token *jwt.Token) (interface{}, error)
	SupportedMethods() []string
	Close()
}

RawTokenKeyProvider is a TokenKeyProvider that provides keys for validating JWT tokens

type Result ¶

type Result struct {
	Decision Decision
	// Reason may contain a message explaining the value of the Decision field.
	Reason string
}

Result is result from authority.

type Role ¶ added in v1.4.0

type Role int16

func (b Role) IsValid() bool

type TokenKeyProvider ¶ added in v1.4.0

type TokenKeyProvider interface {
	EcdsaKey(alg string, kid string) (*ecdsa.PublicKey, error)
	HmacKey(alg string, kid string) ([]byte, error)
	RsaKey(alg string, kid string) (*rsa.PublicKey, error)
	SupportedMethods() []string
	Close()
}

@@@SNIPSTART temporal-common-authorization-tokenkeyprovider-interface Provides keys for validating JWT tokens