v1.1.131 Latest Latest

This package is not in the latest version of its module.

Go to latest
Published: Sep 27, 2023 License: Apache-2.0 Imports: 52 Imported by: 4



Contains types needed to start up a standalone OAuth2 Authorization Server or delegate authentication to an external provider. It supports OpenId connect for user authentication.



View Source
const (
	IdpConnectionTimeout = 10 * time.Second

	ErrauthCtx        errors.ErrorCode = "AUTH_CONTEXT_SETUP_FAILED"
	ErrConfigFileRead errors.ErrorCode = "CONFIG_OPTION_FILE_READ_FAILED"
View Source
const (
	// OAuth2 Parameters
	CsrfFormKey                   = "state"
	AuthorizationResponseCodeType = "code"
	DefaultAuthorizationHeader    = "authorization"
	BearerScheme                  = "Bearer"
	IDTokenScheme                 = "IDToken"
	// Add the -bin suffix so that the header value is automatically base64 encoded
	UserInfoMDKey = "UserInfo-bin"

	// This should be defined without a leading slash. If there is one, the url library's ResolveReference will make it a root path
	OAuth2MetadataEndpoint = ".well-known/oauth-authorization-server"

	// This should be defined without a leading slash. If there is one, the url library's ResolveReference will make it a root path
	OIdCMetadataEndpoint = ".well-known/openid-configuration"

	ContextKeyIdentityContext = contextutils.Key("identity_context")
	ScopeAll                  = "all"
View Source
const (
	ErrSecureCookie errors.ErrorCode = "SECURE_COOKIE_ERROR"
	// #nosec
	ErrInvalidCsrfToken errors.ErrorCode = "CSRF_TOKEN_VALIDATION_FAILED"
View Source
const (
	ErrB64Decoding errors.ErrorCode = "BINARY_DECODING_FAILED"
	// #nosec
	ErrTokenNil errors.ErrorCode = "EMPTY_OAUTH_TOKEN"
	// #nosec
	ErrNoIDToken errors.ErrorCode = "NO_ID_TOKEN_IN_RESPONSE"
View Source
const (
	RedirectURLParameter = "redirect_url"
	FromHTTPKey          = "from_http"
	FromHTTPVal          = "true"
View Source
const (
	SymmetricKeyLength   = 32
	CookieHashKeyLength  = 64
	CookieBlockKeyLength = 32
View Source
const (
	ErrRefreshingToken errors.ErrorCode = "TOKEN_REFRESH_FAILURE"
	ErrTokenExpired    errors.ErrorCode = "JWT_EXPIRED"
	ErrJwtValidation   errors.ErrorCode = "JWT_VERIFICATION_FAILED"
View Source
const (
	PodNamespaceEnvVar = "POD_NAMESPACE"


View Source
var AllowedChars = []rune("abcdefghijklmnopqrstuvwxyz1234567890")


func AuthenticationLoggingInterceptor

func AuthenticationLoggingInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error)

func BlanketAuthorization added in v1.1.6

func BlanketAuthorization(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (
	resp interface{}, err error)

func ExecutionUserIdentifierInterceptor added in v1.1.96

func ExecutionUserIdentifierInterceptor(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (
	resp interface{}, err error)

ExecutionUserIdentifierInterceptor injects identityContext.UserID() to identityContext.executionIdentity

func FirstURL

func FirstURL(urls ...*url.URL) *url.URL

FirstURL gets the first non-nil url from a list of given urls.

func GRPCGetIdentityFromAccessToken

func GRPCGetIdentityFromAccessToken(ctx context.Context, authCtx interfaces.AuthenticationContext) (
	interfaces.IdentityContext, error)

GRPCGetIdentityFromAccessToken attempts to extract a token from the context, and will then call the validation function, passing up any errors.

func GRPCGetIdentityFromIDToken

func GRPCGetIdentityFromIDToken(ctx context.Context, clientID string, provider *oidc.Provider) (
	interfaces.IdentityContext, error)

GRPCGetIdentityFromIDToken attempts to extract a token from the context, and will then call the validation function, passing up any errors.

func GetAuthFlowEndRedirect added in v1.1.127

func GetAuthFlowEndRedirect(ctx context.Context, authCtx interfaces.AuthenticationContext, request *http.Request) string

GetAuthFlowEndRedirect returns the redirect URI according to data in request. At the end of the OAuth flow, the server needs to send the user somewhere. This should have been stored as a cookie during the initial /login call. If that cookie is missing from the request, it will default to the one configured in this package's Config object.

func GetAuthenticationCustomMetadataInterceptor

func GetAuthenticationCustomMetadataInterceptor(authCtx interfaces.AuthenticationContext) grpc.UnaryServerInterceptor

GetAuthenticationCustomMetadataInterceptor produces a gRPC middleware interceptor intended to be used when running authentication with non-default gRPC headers (metadata). Because the default `authorization` header is reserved for use by Envoy, clients wishing to pass tokens to Admin will need to use a different string, specified in this package's Config object. This interceptor will scan for that arbitrary string, and then rename it to the default string, which the downstream auth/auditing interceptors will detect and validate.

func GetAuthenticationInterceptor

func GetAuthenticationInterceptor(authCtx interfaces.AuthenticationContext) func(context.Context) (context.Context, error)

GetAuthenticationInterceptor chooses to enforce or not enforce authentication. It will attempt to get the token from the incoming context, validate it, and decide whether or not to let the request through.

func GetCallbackHandler

func GetCallbackHandler(ctx context.Context, authCtx interfaces.AuthenticationContext, pluginRegistry *plugins.Registry) http.HandlerFunc

GetCallbackHandler returns a handler that is called by the OIdC provider with the authorization code to complete the user authentication flow.

func GetCreateSecretsCommand added in v1.1.65

func GetCreateSecretsCommand() *cobra.Command

func GetInitSecretsCommand

func GetInitSecretsCommand() *cobra.Command

GetInitSecretsCommand creates a command to issue secrets to be used for Auth settings. It writes the secrets to the working directory. The expectation is that they are put in a location and made available to the serve command later. To configure where the serve command looks for secrets, update this config:

  secrets-prefix: <my custom path>

func GetLoginHandler

func GetLoginHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc

GetLoginHandler builds an http handler that handles authentication calls. Before redirecting to the authentication provider, it saves a cookie that contains the redirect url for after the authentication flow is done.

func GetLogoutEndpointHandler

func GetLogoutEndpointHandler(ctx context.Context, authCtx interfaces.AuthenticationContext, pluginRegistry *plugins.Registry) http.HandlerFunc

func GetOAuth2ClientConfig

func GetOAuth2ClientConfig(ctx context.Context, options config.OpenIDOptions, providerEndpoints oauth2.Endpoint, sm core.SecretManager) (cfg oauth2.Config, err error)

This creates a oauth2 library config object, with values from the Flyte Admin config

func GetOIdCMetadataEndpointRedirectHandler

func GetOIdCMetadataEndpointRedirectHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc

This returns a handler that will redirect (303) to the well-known metadata endpoint for the OAuth2 authorization server See for more information.

func GetPublicURL

func GetPublicURL(ctx context.Context, req *http.Request, cfg *config.Config) *url.URL

GetPublicURL attempts to retrieve the public url of the service. If httpPublicUri is set in the config, it takes precedence. If the request is not nil and has a host set, it comes second and lastly it attempts to retrieve the url from context if set (e.g. by gRPC gateway).

func GetRefreshedToken

func GetRefreshedToken(ctx context.Context, oauth *oauth2.Config, accessToken, refreshToken string) (*oauth2.Token, error)

Refresh a JWT

func HashCsrfState

func HashCsrfState(csrf string) string

func IdentityContextFromIDTokenToken

func IdentityContextFromIDTokenToken(ctx context.Context, tokenStr, clientID string, provider *oidc.Provider,
	userInfo *service.UserInfoResponse) (interfaces.IdentityContext, error)

func NewCsrfCookie

func NewCsrfCookie() http.Cookie

func NewCsrfToken

func NewCsrfToken(seed int64) string

func NewRedirectCookie

func NewRedirectCookie(ctx context.Context, redirectURL string) *http.Cookie

This function takes in a string and returns a cookie that's used to keep track of where to send the user after the OAuth2 login flow is complete.

func NewSecureCookie

func NewSecureCookie(cookieName, value string, hashKey, blockKey []byte, domain string, sameSiteMode http.SameSite) (http.Cookie, error)

func ParseIDTokenAndValidate

func ParseIDTokenAndValidate(ctx context.Context, clientID, rawIDToken string, provider *oidc.Provider) (*oidc.IDToken, error)

func QueryUserInfo

func QueryUserInfo(ctx context.Context, identityContext interfaces.IdentityContext, request *http.Request,
	authCtx interfaces.AuthenticationContext) (*service.UserInfoResponse, error)

func QueryUserInfoUsingAccessToken

func QueryUserInfoUsingAccessToken(ctx context.Context, originalRequest *http.Request, authCtx interfaces.AuthenticationContext, accessToken string) (
	*service.UserInfoResponse, error)

Extract User info from access token for HTTP request

func ReadSecureCookie

func ReadSecureCookie(ctx context.Context, cookie http.Cookie, hashKey, blockKey []byte) (string, error)

func RefreshTokensIfExists

func RefreshTokensIfExists(ctx context.Context, authCtx interfaces.AuthenticationContext, authHandler http.HandlerFunc) http.HandlerFunc

Look for access token and refresh token, if both are present and the access token is expired, then attempt to refresh. Otherwise do nothing and proceed to the next handler. If successfully refreshed, proceed to the landing page.

func RegisterHandlers

func RegisterHandlers(ctx context.Context, handler interfaces.HandlerRegisterer, authCtx interfaces.AuthenticationContext, pluginRegistry *plugins.Registry)

func SetContextForIdentity

func SetContextForIdentity(ctx context.Context, identityContext interfaces.IdentityContext) context.Context

func URLFromContext

func URLFromContext(ctx context.Context) *url.URL

URLFromContext attempts to retrieve the original url from context. gRPC gateway sets metadata in context that refers to the original host. Or nil if metadata isn't set.

func URLFromRequest

func URLFromRequest(req *http.Request) *url.URL

URLFromRequest attempts to reconstruct the url from the request object. Or nil if not possible

func VerifyCsrfCookie

func VerifyCsrfCookie(ctx context.Context, request *http.Request) error

func WithAuditFields

func WithAuditFields(ctx context.Context, subject string, clientIds []string, tokenIssuedAt time.Time) context.Context

func WithUserEmail

func WithUserEmail(ctx context.Context, email string) context.Context


type AuthenticatedClientMeta added in v0.6.114

type AuthenticatedClientMeta struct {
	ClientIds     []string
	TokenIssuedAt time.Time
	ClientIP      string
	Subject       string

type Context

type Context struct {
	// contains filtered or unexported fields

Please see the comment on the corresponding AuthenticationContext for more information.

func NewAuthenticationContext

func NewAuthenticationContext(ctx context.Context, sm core.SecretManager, oauth2Provider interfaces.OAuth2Provider,
	oauth2ResourceServer interfaces.OAuth2ResourceServer, authMetadataService service.AuthMetadataServiceServer,
	identityService service.IdentityServiceServer, options *config.Config) (Context, error)

func (Context) AuthMetadataService

func (c Context) AuthMetadataService() service.AuthMetadataServiceServer

func (Context) CookieManager

func (c Context) CookieManager() interfaces.CookieHandler

func (Context) GetHTTPClient

func (c Context) GetHTTPClient() *http.Client

func (Context) GetOAuth2MetadataURL

func (c Context) GetOAuth2MetadataURL() *url.URL

func (Context) GetOIdCMetadataURL

func (c Context) GetOIdCMetadataURL() *url.URL

func (Context) GetUserInfoURL

func (c Context) GetUserInfoURL() *url.URL

func (Context) IdentityService

func (c Context) IdentityService() service.IdentityServiceServer

func (Context) OAuth2ClientConfig

func (c Context) OAuth2ClientConfig(requestURL *url.URL) *oauth2.Config

func (Context) OAuth2Provider

func (c Context) OAuth2Provider() interfaces.OAuth2Provider

func (Context) OAuth2ResourceServer

func (c Context) OAuth2ResourceServer() interfaces.OAuth2ResourceServer

func (Context) OidcProvider

func (c Context) OidcProvider() *oidc.Provider

func (Context) Options

func (c Context) Options() *config.Config

type CookieManager

type CookieManager struct {
	// contains filtered or unexported fields

func NewCookieManager

func NewCookieManager(ctx context.Context, hashKeyEncoded, blockKeyEncoded string, cookieSettings config.CookieSettings) (CookieManager, error)

func (CookieManager) DeleteCookies

func (c CookieManager) DeleteCookies(_ context.Context, writer http.ResponseWriter)

func (CookieManager) RetrieveAuthCodeRequest

func (c CookieManager) RetrieveAuthCodeRequest(ctx context.Context, request *http.Request) (authRequestURL string, err error)

func (CookieManager) RetrieveTokenValues

func (c CookieManager) RetrieveTokenValues(ctx context.Context, request *http.Request) (idToken, accessToken,
	refreshToken string, err error)

TODO: Separate refresh token from access token, remove named returns, and use stdlib errors. RetrieveTokenValues retrieves id, access and refresh tokens from cookies if they exist. The existence of a refresh token in a cookie is optional and hence failure to find or read that cookie is tolerated. An error is returned in case of failure to retrieve and read either the id or the access tokens.

func (CookieManager) RetrieveUserInfo

func (c CookieManager) RetrieveUserInfo(ctx context.Context, request *http.Request) (*service.UserInfoResponse, error)

func (CookieManager) SetAuthCodeCookie

func (c CookieManager) SetAuthCodeCookie(ctx context.Context, writer http.ResponseWriter, authRequestURL string) error

func (CookieManager) SetTokenCookies

func (c CookieManager) SetTokenCookies(ctx context.Context, writer http.ResponseWriter, token *oauth2.Token) error

func (CookieManager) SetUserInfoCookie

func (c CookieManager) SetUserInfoCookie(ctx context.Context, writer http.ResponseWriter, userInfo *service.UserInfoResponse) error

type HTTPRequestToMetadataAnnotator

type HTTPRequestToMetadataAnnotator func(ctx context.Context, request *http.Request) metadata.MD

func GetHTTPMetadataTaggingHandler

func GetHTTPMetadataTaggingHandler() HTTPRequestToMetadataAnnotator

Intercepts the incoming HTTP requests and marks it as such so that the downstream code can use it to enforce auth. See the enforceHTTP/Grpc options for more information.

func GetHTTPRequestCookieToMetadataHandler

func GetHTTPRequestCookieToMetadataHandler(authCtx interfaces.AuthenticationContext) HTTPRequestToMetadataAnnotator

This is effectively middleware for the grpc gateway, it allows us to modify the translation between HTTP request and gRPC request. There are two potential sources for bearer tokens, it can come from an authorization header (not yet implemented), or encrypted cookies. Note that when deploying behind Envoy, you have the option to look for a configurable, non-standard header name. The token is extracted and turned into a metadata object which is then attached to the request, from which the token is extracted later for verification.

type IdentityContext

type IdentityContext struct {
	// contains filtered or unexported fields

IdentityContext is an abstract entity to enclose the authenticated identity of the user/app. Both gRPC and HTTP servers have interceptors to set the IdentityContext on the context.Context. To retrieve the current IdentityContext call auth.IdentityContextFromContext(ctx). To check whether there is an identity set, call auth.IdentityContextFromContext(ctx).IsEmpty()

func IdentityContextFromContext

func IdentityContextFromContext(ctx context.Context) IdentityContext

IdentityContextFromContext retrieves the authenticated identity from context.Context.

func NewIdentityContext

func NewIdentityContext(audience, userID, appID string, authenticatedAt time.Time, scopes sets.String, userInfo *service.UserInfoResponse, claims map[string]interface{}) (
	IdentityContext, error)

NewIdentityContext creates a new IdentityContext.

func (IdentityContext) AppID

func (c IdentityContext) AppID() string

func (IdentityContext) Audience

func (c IdentityContext) Audience() string

func (IdentityContext) AuthenticatedAt

func (c IdentityContext) AuthenticatedAt() time.Time

func (IdentityContext) Claims added in v1.1.25

func (c IdentityContext) Claims() map[string]interface{}

func (IdentityContext) ExecutionIdentity added in v1.1.96

func (c IdentityContext) ExecutionIdentity() string

func (IdentityContext) IsEmpty

func (c IdentityContext) IsEmpty() bool

func (IdentityContext) Scopes

func (c IdentityContext) Scopes() sets.String

func (IdentityContext) UserID

func (c IdentityContext) UserID() string

func (IdentityContext) UserInfo

func (IdentityContext) WithContext

func (c IdentityContext) WithContext(ctx context.Context) context.Context

func (IdentityContext) WithExecutionUserIdentifier added in v1.1.96

func (c IdentityContext) WithExecutionUserIdentifier(euid string) IdentityContext

WithExecutionUserIdentifier creates a copy of the original identity context and attach ExecutionIdentity

type LogoutHookFunc added in v1.1.127

type LogoutHookFunc func(ctx context.Context, authCtx interfaces.AuthenticationContext, request *http.Request, w http.ResponseWriter) error

type PreRedirectHookError added in v1.1.121

type PreRedirectHookError struct {
	Message string
	Code    int

func (*PreRedirectHookError) Error added in v1.1.121

func (e *PreRedirectHookError) Error() string

type PreRedirectHookFunc added in v1.1.121

type PreRedirectHookFunc func(ctx context.Context, authCtx interfaces.AuthenticationContext, request *http.Request, w http.ResponseWriter) *PreRedirectHookError

PreRedirectHookFunc Interface used for running custom code before the redirect happens during a successful auth flow. This might be useful in cases where the auth flow allows the user to login since the IDP has been configured for eg: to allow all users from a particular domain to login but you want to restrict access to only a particular set of user ids. eg : are allowed to login but user, should only be allowed PreRedirectHookError is the error interface which allows the user to set correct http status code and Message to be set in case the function returns an error without which the current usage in GetCallbackHandler will set this to InternalServerError

type SecretsSet

type SecretsSet struct {
	TokenHashKey              []byte
	TokenSigningRSAPrivateKey *rsa.PrivateKey
	CookieHashKey             []byte
	CookieBlockKey            []byte

func NewSecrets

func NewSecrets() (SecretsSet, error)

type UserInfoForwardResponseHandler added in v1.1.50

type UserInfoForwardResponseHandler func(ctx context.Context, w http.ResponseWriter, m protoiface.MessageV1) error

func GetUserInfoForwardResponseHandler added in v1.1.50

func GetUserInfoForwardResponseHandler() UserInfoForwardResponseHandler

type UserInfoProvider

type UserInfoProvider struct {

func NewUserInfoProvider

func NewUserInfoProvider() UserInfoProvider

func (UserInfoProvider) UserInfo

UserInfo returns user_info claims about the currently logged in user. See the OpenID Connect spec at for more information.


Path Synopsis
OAuthServer implementation that serve oauth2 authorize and client_credentials flows.
OAuthServer implementation that serve oauth2 authorize and client_credentials flows.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL