auth

Documentation

Overview

Package auth authenticates incoming HTTP requests.

Index

• Constants
• Variables
• type Authenticator
• type OIDC
  • func NewOIDC(ctx context.Context, issuer, audience string) (*OIDC, error)
  • func (o *OIDC) Authenticate(r *http.Request) (string, error)
• type Static
  • func (s Static) Authenticate(r *http.Request) (string, error)

Constants

const HeaderUserSub = "X-User-Sub"

HeaderUserSub carries the caller's subject; with OIDC enabled it must match the validated JWT sub claim.

Variables

var ErrUnauthenticated = errors.New("unauthenticated")

ErrUnauthenticated is returned for any authentication failure.

Types

type Authenticator

type Authenticator interface {
	// Authenticate returns the verified subject or ErrUnauthenticated.
	Authenticate(r *http.Request) (string, error)
}

Authenticator extracts and verifies the caller identity of a request.

type OIDC

type OIDC struct {
	// contains filtered or unexported fields
}

OIDC validates RFC 6750 bearer tokens against an OIDC provider (Keycloak or any other compliant issuer) and enforces JWT.sub == X-User-Sub.

func NewOIDC

func NewOIDC(ctx context.Context, issuer, audience string) (*OIDC, error)

NewOIDC discovers the provider configuration from the issuer URL. When audience is empty the audience check is skipped.

func (*OIDC) Authenticate

func (o *OIDC) Authenticate(r *http.Request) (string, error)

Authenticate implements Authenticator.

type Static

type Static struct {
	DefaultSub string
}

Static is the development/test authenticator used when auth is disabled. It trusts X-User-Sub when present and falls back to the configured default subject.

func (Static) Authenticate

func (s Static) Authenticate(r *http.Request) (string, error)

Authenticate implements Authenticator.