tok

Documentation

Overview

Package tok provides AuthN token (structure and methods) for validation by AIS gateways

• Copyright (c) 2018-2022, NVIDIA CORPORATION. All rights reserved.

Index

• Variables
• func ExtractToken(hdr http.Header) (string, error)
• func IssueAdminJWT(expires time.Time, userID, secret string) (string, error)
• func IssueJWT(expires time.Time, userID string, bucketACLs []*authn.BckACL, ...) (string, error)
• type Token
  • func DecryptToken(tokenStr, secret string) (*Token, error)
  • func (tk *Token) CheckPermissions(clusterID string, bck *cmn.Bck, perms apc.AccessAttrs) error
  • func (tk *Token) String() string

Variables

var (
	ErrNoPermissions = errors.New("insufficient permissions")
	ErrInvalidToken  = errors.New("invalid token")
	ErrNoToken       = errors.New("token required")
	ErrNoBearerToken = errors.New("invalid token: no bearer")
	ErrTokenExpired  = errors.New("token expired")
	ErrTokenRevoked  = errors.New("token revoked")
)

Functions

func ExtractToken

func ExtractToken(hdr http.Header) (string, error)

Header format: 'Authorization: Bearer <token>'

func IssueAdminJWT

func IssueAdminJWT(expires time.Time, userID, secret string) (string, error)

func IssueJWT

func IssueJWT(expires time.Time, userID string, bucketACLs []*authn.BckACL, clusterACLs []*authn.CluACL,
	secret string) (string, error)

Types

type Token

type Token struct {
	UserID      string          `json:"username"`
	Expires     time.Time       `json:"expires"`
	Token       string          `json:"token"`
	ClusterACLs []*authn.CluACL `json:"clusters"`
	BucketACLs  []*authn.BckACL `json:"buckets,omitempty"`
	IsAdmin     bool            `json:"admin"`
}

func DecryptToken

func DecryptToken(tokenStr, secret string) (*Token, error)

func (*Token) CheckPermissions

func (tk *Token) CheckPermissions(clusterID string, bck *cmn.Bck, perms apc.AccessAttrs) error

A user has two-level permissions: cluster-wide and on per bucket basis. To be able to access data, a user must have either permission. This allows creating users, e.g, with read-only access to the entire cluster, and read-write access to a single bucket. Per-bucket ACL overrides cluster-wide one. Permissions for a cluster with empty ID are used as default ones when a user do not have permissions for the given `clusterID`.

ACL rules are checked in the following order (from highest to the lowest priority):

1. A user's role is an admin.
2. User's permissions for the given bucket
3. User's permissions for the given cluster
4. User's default cluster permissions (ACL for a cluster with empty clusterID)

If there are no defined ACL found at any step, any access is denied.

func (*Token) String

func (tk *Token) String() string