Documentation
¶
Overview ¶
Package authentication runs ordered trusted authentication handlers. It never trusts cookies or forwarded headers automatically and writes no HTTP response. Hosting must terminate failed credentials (401); exhaustion remains anonymous for authorization to decide. Anonymous role denial is ordinarily 403.
Index ¶
Examples ¶
Constants ¶
const MicrosoftIdentityProviderClaim = "urn:cratis:arc:identity:provider"
MicrosoftIdentityProviderClaim is Arc-authored forwarded provider metadata.
Variables ¶
var ( // ErrFailed identifies recognized rejected credentials. ErrFailed = errors.New("authentication failed") // ErrInvalidHandler identifies a nil or typed-nil handler. ErrInvalidHandler = errors.New("invalid authentication handler") // ErrInvalidPrincipal identifies an anonymous success principal. ErrInvalidPrincipal = errors.New("invalid authenticated principal") // ErrInvalidRequest identifies a nil request, context or chain. ErrInvalidRequest = errors.New("invalid authentication request") )
Functions ¶
This section is empty.
Types ¶
type Chain ¶
type Chain struct {
// contains filtered or unexported fields
}
Chain is immutable and concurrent-safe when its borrowed handlers are. Zero is an empty chain. No callback is run after a terminal success or failure.
func (*Chain) Authenticate ¶
Authenticate installs the supplied context on a request clone. Context, headers and URL are isolated from the caller; Body is shared and handlers must not read it. Other request data is not guaranteed isolated. Errors are infrastructure failures, not credential rejection.
type Failure ¶
type Failure struct {
// contains filtered or unexported fields
}
Failure represents rejected credentials, not an infrastructure error.
type Handler ¶
Handler authenticates synchronously, borrowing request data for the call only. Handlers must not read Body: it is shared with the caller, not cloned. Shared handlers must support concurrent calls and honor cancellation. Errors are server faults logged by the host and must not contain or wrap token text, credentials or header values. Use Failed for credential rejection; its diagnostic reason is never logged by Arc ingress.
func HostPrincipal ¶
func HostPrincipal() Handler
HostPrincipal reads only trusted typed identity context metadata. It does not authenticate headers, JWT payloads, Basic credentials or display cookies.
Example ¶
package main
import (
"context"
"fmt"
"net/http/httptest"
"github.com/cratis/arc.go/authentication"
"github.com/cratis/arc.go/identity"
)
func main() {
chain, err := authentication.New(authentication.HostPrincipal())
if err != nil {
panic(err)
}
ctx := identity.WithPrincipal(context.Background(), identity.System("jobs"))
result, err := chain.Authenticate(ctx, httptest.NewRequest("GET", "/", nil))
if err != nil {
panic(err)
}
actor, ok := result.Principal()
fmt.Println(actor.Name(), ok)
}
Output: [System] true
func MicrosoftIdentityPlatform ¶
func MicrosoftIdentityPlatform(options MicrosoftIdentityOptions) (Handler, error)
MicrosoftIdentityPlatform explicitly constructs a borrowed concurrent-safe handler; it is never registered automatically and does not validate JWTs.
type HandlerFunc ¶
HandlerFunc adapts a trusted authentication callback.
func (HandlerFunc) Authenticate ¶
Authenticate invokes f with borrowed request data.
type MicrosoftIdentityOptions ¶
type MicrosoftIdentityOptions struct {
TrustForwardedIdentityHeaders bool
MaxPrincipalBytes int
// Logger receives a warning once per process when untrusted forwarded headers
// are ignored. Nil disables diagnostics; header values are never logged.
Logger *slog.Logger
}
MicrosoftIdentityOptions configures the unsigned forwarded-principal adapter. TrustForwardedIdentityHeaders requires an isolating, credential-validating ingress which strips caller headers, writes verified replacements and prevents direct backend access. Base64 is not authentication proof. Zero trust ignores all headers. MaxPrincipalBytes zero selects 64 KiB; negative is invalid.
type Result ¶
type Result struct {
// contains filtered or unexported fields
}
Result is immutable; zero is anonymous. Success and failure are terminal.
func Authenticated ¶
Authenticated returns success only for a trusted authenticated snapshot.
Source Files