authn

Documentation

Index

• Constants
• func Code(err error) string
• type Error
  • func (e *Error) Code() string
  • func (e *Error) Error() string
• type KeyLookup
• type ResolvedKey
• type Verified
  • func Verify(r *http.Request, body []byte, now time.Time, skew time.Duration, ...) (*Verified, error)

Constants

const (
	CodeMissingAuthenticationToken = "MissingAuthenticationToken"
	CodeInvalidClientTokenId       = "InvalidClientTokenId"
	CodeSignatureDoesNotMatch      = "SignatureDoesNotMatch"
	CodeRequestTimeTooSkewed       = "RequestTimeTooSkewed"
)

AWS error codes returned by SigV4 verification failures.

Functions

func Code

func Code(err error) string

Code extracts the AWS error code from err, or "" if unknown.

Types

type Error

type Error struct {
	// contains filtered or unexported fields
}

Error is a distinguishable authn failure with an AWS error code.

func (*Error) Code

func (e *Error) Code() string

Code returns the AWS error code for e.

func (*Error) Error

func (e *Error) Error() string

type KeyLookup

type KeyLookup func(accessKeyID string) (ResolvedKey, error)

KeyLookup resolves an access key id to credential material.

type ResolvedKey

type ResolvedKey struct {
	AccountID          string
	Secret             string
	IsRoot             bool
	UserName           string
	Status             string
	SessionToken       string
	RoleARN            string
	SessionName        string
	FederatedUser      string
	SessionPolicy      string
	ExpiresAt          time.Time
	MFAAuthenticated   bool
	MFAAuthenticatedAt time.Time
}

ResolvedKey is the credential material returned by KeyLookup.

type Verified

type Verified struct {
	Principal       identity.Principal
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string
	Region          string
	Service         string
	AccountID       string
	// SourceIP is the caller address for aws:SourceIp (set by the HTTP server).
	SourceIP string
	// Plumbed once from ResolvedKey so authorize paths need no re-Lookup.
	SessionPolicy      string
	MFAAuthenticated   bool
	MFAAuthenticatedAt time.Time
	UserName           string
	IsRoot             bool
	FederatedUser      string
}

Verified is the result of a successful SigV4 verification.

func Verify

func Verify(r *http.Request, body []byte, now time.Time, skew time.Duration, lookup KeyLookup) (*Verified, error)

Verify validates AWS SigV4 Authorization header or query authentication.