auth

Documentation

Index

• Variables
• type Config
  • func (c *Config) Enabled() bool
  • func (c *Config) Load(ctx context.Context) (*LoadedConfig, error)
  • func (c *Config) RegisterFlags(fs *pflag.FlagSet, prefix string)
• type JWKSConfig
  • func (j *JWKSConfig) Load(ctx context.Context) (*LoadedJWKS, error)
  • func (j *JWKSConfig) RegisterFlags(fs *pflag.FlagSet, prefix string)
• type JWTClaims
• type JWTVerifier
  • func NewJWTVerifier(conf *LoadedConfig) *JWTVerifier
  • func (v *JWTVerifier) Verify(tokenString string) (*Token, error)
• type LoadedConfig
• type LoadedJWKS
• type MultiTenantVerifier
  • func NewMultiTenantVerifier(defaultVerifier Verifier, tenantVerifiers map[string]Verifier) *MultiTenantVerifier
  • func (v *MultiTenantVerifier) Verify(token string, tenantID string) (*Token, error)
• type PikoClaims
• type Token
  • func (t *Token) EndpointPermitted(endpointID string) bool
• type Verifier

Variables

var (
	ErrInvalidToken  = errors.New("invalid token")
	ErrExpiredToken  = errors.New("expired token")
	ErrUnknownTenant = errors.New("unknown tenant")
)

Types

type Config

type Config struct {
	// HMACSecretKey is the secret key to authenticate HMAC endpoint
	// connection JWTs.
	HMACSecretKey string `json:"hmac_secret_key" yaml:"hmac_secret_key"`

	// RSAPublicKey is the public key to authenticate RSA endpoint
	// connection JWTs.
	RSAPublicKey string `json:"rsa_public_key" yaml:"rsa_public_key"`

	// ECDSAPublicKey is the public key to authenticate ECDSA endpoint
	// connection JWTs.
	ECDSAPublicKey string `json:"ecdsa_public_key" yaml:"ecdsa_public_key"`

	// Audience is the required 'aud' claim of the authenticated JWTs.
	//
	// If not given the 'aud' claim will be ignored.
	Audience string `json:"audience" yaml:"audience"`

	// Issuer is the required 'iss' claim of the authenticated JWTs.
	//
	// If not given the 'iss' claim will be ignored.
	Issuer string `json:"issuer" yaml:"issuer"`

	// DisableDisconnectOnExpiry disables disconnecting the client when their
	// token expires.
	//
	// Piko still verifies the token expiry when the client first connects.
	DisableDisconnectOnExpiry bool `json:"disable_disconnect_on_expiry" yaml:"disable_disconnect_on_expiry"`

	// JWKS is the JSON Web Key Set to use for verifying JWTs.
	//
	// If provided, it will take precedence over the other keys.
	JWKS JWKSConfig `json:"jwks" yaml:"jwks"`
}

Config configures how to verify client JWT tokens.

func (*Config) Enabled

func (c *Config) Enabled() bool

Enabled returns whether authentication is enabled.

It is enabled when at least one verification key is configured.

func (*Config) Load

func (c *Config) Load(ctx context.Context) (*LoadedConfig, error)

func (*Config) RegisterFlags

func (c *Config) RegisterFlags(fs *pflag.FlagSet, prefix string)

type JWKSConfig

type JWKSConfig struct {
	// Endpoint to load the JWKS from.
	//
	// Supports schemes http, https or file.
	Endpoint string `json:"endpoint" yaml:"endpoint"`

	// How long to cache the JWKS for before reloading.
	CacheTTL time.Duration `json:"cache_ttl" yaml:"cache_ttl"`

	// Timeout for loading the JWKS.
	Timeout time.Duration `json:"timeout" yaml:"timeout"`
}

func (*JWKSConfig) Load

func (j *JWKSConfig) Load(ctx context.Context) (*LoadedJWKS, error)

Load will ensure that the correct KeyFunc is loaded and available as part of the returned LoadedJWKS pointer.

func (*JWKSConfig) RegisterFlags

func (j *JWKSConfig) RegisterFlags(fs *pflag.FlagSet, prefix string)

type JWTClaims

type JWTClaims struct {
	jwt.RegisteredClaims
	Piko PikoClaims `json:"piko"`
}

type JWTVerifier

type JWTVerifier struct {
	// contains filtered or unexported fields
}

JWTVerifier verifies client JWT tokens.

func NewJWTVerifier

func NewJWTVerifier(conf *LoadedConfig) *JWTVerifier

func (*JWTVerifier) Verify

func (v *JWTVerifier) Verify(tokenString string) (*Token, error)

type LoadedConfig

type LoadedConfig struct {
	HMACSecretKey             []byte
	RSAPublicKey              *rsa.PublicKey
	ECDSAPublicKey            *ecdsa.PublicKey
	Audience                  string
	Issuer                    string
	DisableDisconnectOnExpiry bool
	JWKS                      *LoadedJWKS
}

LoadedConfig is the same as Config except it parses the RSA, ECDSA keys and JWKS.

type LoadedJWKS

type LoadedJWKS struct {
	// KeyFunc is the key function to use for verifying JWTs.
	KeyFunc jwt.Keyfunc
}

LoadedJWKS provides a ready to use jwt.KeyFunc for token verification.

type MultiTenantVerifier

type MultiTenantVerifier struct {
	// contains filtered or unexported fields
}

func NewMultiTenantVerifier

func NewMultiTenantVerifier(
	defaultVerifier Verifier,
	tenantVerifiers map[string]Verifier,
) *MultiTenantVerifier

func (*MultiTenantVerifier) Verify

func (v *MultiTenantVerifier) Verify(token string, tenantID string) (*Token, error)

type PikoClaims

type PikoClaims struct {
	Endpoints []string `json:"endpoints"`
}

type Token

type Token struct {
	// Expiry contains the time the token expires, or zero if there is no
	// expiry.
	Expiry time.Time

	// Endpoints contains the list of endpoint IDs the connection is permitted
	// to access (either connect to or listen on). If empty then all endpoints
	// are allowed.
	Endpoints []string

	// TenantID is the ID of the client tenant.
	TenantID string
}

Token represents an authenticated Piko token.

func (*Token) EndpointPermitted

func (t *Token) EndpointPermitted(endpointID string) bool

EndpointPermitted returns whether the token it permitted to access the endpoint with the given ID.

If the token doesn't include any endpoints, it can access all endpoints.

type Verifier

type Verifier interface {
	Verify(token string) (*Token, error)
}

Verifier verifies client tokens.