Versions in this module Expand all Collapse all v0 v0.2.0 Jul 3, 2026 v0.1.0 Jun 27, 2026 Changes in this version + const KrbAPReqTokenType + const KrbCCacheTokenType + const SpecVersion + var ErrMalformedSPN = errors.New("kerbexchange: malformed service principal name") + var ErrMissingSubjectToken = errors.New("kerbexchange: missing subject_token") + var ErrNoAPReq = errors.New("kerbexchange: credential has no AP-REQ") + var ErrNoCCache = errors.New("kerbexchange: credential has no ccache") + var ErrNoServiceKey = errors.New("kerbexchange: no service key for principal") + var ErrNoTarget = errors.New("kerbexchange: no resource or audience names a target SPN") + var ErrTokenInvalid = errors.New("kerbexchange: invalid access token") + var ErrUnknownTokenType = errors.New("kerbexchange: unknown requested token type") + var ErrWrongGrantType = errors.New("kerbexchange: grant_type is not token-exchange") + func CacheKey(subject string, spn ServicePrincipal) string + func MarshalAPReqToken(mt MintedTicket) ([]byte, error) + func MarshalCCache(mt MintedTicket) ([]byte, error) + func TokenExchangeErrorCode(err error) string + type Cache interface + Get func(key string) (*Credential, bool) + Put func(key string, cred *Credential) + type ClaimsMapper interface + Map func(id Identity) (subject string, groupNames []string, grantedScopes []string, err error) + type ConfigMapFilter struct + ScopeGroups map[string][]string + func (f ConfigMapFilter) Admit(grantedScopes, candidateGroups []string) []string + type Credential struct + func NewCredential(subject string, target ServicePrincipal, expiry time.Time, ...) *Credential + func (c *Credential) APReq() ([]byte, error) + func (c *Credential) CCache() ([]byte, error) + func (c *Credential) Expiry() time.Time + func (c *Credential) Subject() string + func (c *Credential) Target() ServicePrincipal + type DefaultClaimsMapper struct + GroupsClaim string + func (m DefaultClaimsMapper) Map(id Identity) (string, []string, []string, error) + type DelegatedValidator struct + ValidateFunc func(ctx context.Context, accessToken string) (Identity, error) + func (v DelegatedValidator) Validate(ctx context.Context, accessToken string) (Identity, error) + type DirectMinter struct + func NewDirectMinter(keys KeySource, defaultRealm string) *DirectMinter + func (m *DirectMinter) Mint(spn ServicePrincipal, opts MintOptions) (MintedTicket, error) + func (m *DirectMinter) WithPACBuilder(b PACBuilder) *DirectMinter + type ExchangeRequest struct + AccessToken string + Output OutputType + Target ServicePrincipal + func ExchangeRequestFromWire(w *tokenexchange.TokenExchangeRequest) (ExchangeRequest, error) + type Exchanger interface + Exchange func(ctx context.Context, req ExchangeRequest) (*Credential, error) + type Identity struct + Claims json.RawMessage + Expiry time.Time + Subject string + type IntrospectionValidator struct + ClientID string + ClientSecret string + Endpoint string + HTTPClient *http.Client + func (v *IntrospectionValidator) Validate(ctx context.Context, accessToken string) (Identity, error) + type JWKSOption func(*jwksValidatorConfig) + func WithAudience(aud string) JWKSOption + func WithClockSkew(d time.Duration) JWKSOption + func WithIssuer(iss string) JWKSOption + type JWKSValidator struct + func NewJWKSValidator(ctx context.Context, jwksURL string, opts ...JWKSOption) (*JWKSValidator, error) + func (v *JWKSValidator) Validate(ctx context.Context, accessToken string) (Identity, error) + type KeySource interface + KDCSigningKey func(etype int32) (key types.EncryptionKey, kvno int, err error) + ServiceKey func(spn ServicePrincipal, etype int32) (key types.EncryptionKey, kvno int, err error) + type KeytabSource struct + func LoadKeytabSource(path, defaultRealm string) (*KeytabSource, error) + func NewKeytabSource(kt *keytab.Keytab, defaultRealm string) *KeytabSource + func (s *KeytabSource) KDCSigningKey(etype int32) (types.EncryptionKey, int, error) + func (s *KeytabSource) ServiceKey(spn ServicePrincipal, etype int32) (types.EncryptionKey, int, error) + type MemoryCache struct + func NewMemoryCache() *MemoryCache + func (m *MemoryCache) Get(key string) (*Credential, bool) + func (m *MemoryCache) Put(key string, cred *Credential) + type MintOptions struct + AuthTime time.Time + ClientName types.PrincipalName + ClientRealm string + EndTime time.Time + Identity Identity + RenewTill time.Time + StartTime time.Time + type MintedTicket struct + AuthTime time.Time + ClientName types.PrincipalName + ClientRealm string + EndTime time.Time + SessionKey types.EncryptionKey + Target ServicePrincipal + Ticket messages.Ticket + func (mt MintedTicket) Credential(output OutputType) (*Credential, error) + type Minter interface + Mint func(spn ServicePrincipal, opts MintOptions) (MintedTicket, error) + type OutputType int + const OutputAPReq + const OutputCCache + func OutputTypeFromTokenType(uri string) (OutputType, error) + func (o OutputType) String() string + func (o OutputType) TokenType() string + type PACBuilder interface + Build func(id Identity, authTime time.Time) (*pac.KerbValidationInfo, *pac.ClientInfo, error) + type Resolver interface + Resolve func(ctx context.Context, id Identity, requested ServicePrincipal) (clientName types.PrincipalName, clientRealm string, target ServicePrincipal, ...) + type ScopeFilter interface + Admit func(grantedScopes, candidateGroups []string) []string + type Service struct + Cache Cache + MaxLifetime time.Duration + Minter Minter + Resolver Resolver + Validator TokenValidator + func (s *Service) Exchange(ctx context.Context, req ExchangeRequest) (*Credential, error) + type ServicePrincipal struct + Host string + Realm string + Service string + func ParseServicePrincipal(s string) (ServicePrincipal, error) + func (p ServicePrincipal) Empty() bool + func (p ServicePrincipal) String() string + type StaticResolver struct + DefaultRealm string + func (r StaticResolver) Resolve(_ context.Context, id Identity, requested ServicePrincipal) (types.PrincipalName, string, ServicePrincipal, error) + type SyntheticPACBuilder struct + DefaultPrimaryGroupRID uint32 + DomainSID mstypes.RPCSID + GroupOverrides map[string]uint32 + GroupsClaim string + Mapper ClaimsMapper + ScopeFilter ScopeFilter + func NewSyntheticPACBuilder(domainSID string) (*SyntheticPACBuilder, error) + func (b *SyntheticPACBuilder) Build(id Identity, authTime time.Time) (*pac.KerbValidationInfo, *pac.ClientInfo, error) + type TokenValidator interface + Validate func(ctx context.Context, accessToken string) (Identity, error)
Go to main page