authn

Documentation

Overview

Package authn provides mTLS-based authentication for forwarding Azure credentials into local containers. It enables DefaultAzureCredential to work inside Docker containers by providing a host-side token server that the in-container azd shim communicates with over mTLS.

Index

• Constants
• func ClientTLSConfig(b *Bundle) (*tls.Config, error)
• func GetToken(scope string) (string, time.Time, error)
• func ServerTLSConfig(b *Bundle) (*tls.Config, error)
• func WriteCertsToDir(b *Bundle, dir string) error
• type AzdTokenProvider
• type Bundle
  • func GenerateBundle(extraSANs ...string) (*Bundle, error)
  • func (b *Bundle) Validate() error
• type Server
  • func (s *Server) Bundle() *Bundle
  • func (s *Server) CertsDir() string
  • func (s *Server) Port() int
  • func (s *Server) Start(ctx context.Context) error
  • func (s *Server) Stop()
• type ServerConfig
• type TokenProvider
• type TokenRequest
• type TokenResponse

Constants

const DefaultCertValidity = 24 * time.Hour

DefaultCertValidity is the validity duration for ephemeral mTLS certificates.

Functions

func ClientTLSConfig

func ClientTLSConfig(b *Bundle) (*tls.Config, error)

ClientTLSConfig creates a tls.Config for the client with mTLS enabled. It uses the client certificate and trusts the CA from the bundle.

func GetToken

func GetToken(scope string) (string, time.Time, error)

GetToken retrieves a token for the given scope by calling the azd CLI. It runs "azd auth token --scope <scope> --output json" and parses the result.

SECURITY: Never log the returned token string or raw command output.

func ServerTLSConfig

func ServerTLSConfig(b *Bundle) (*tls.Config, error)

ServerTLSConfig creates a tls.Config for the server with mTLS enabled. It requires and verifies client certificates using the CA from the bundle.

func WriteCertsToDir

func WriteCertsToDir(b *Bundle, dir string) error

WriteCertsToDir writes the CA certificate, client certificate, and client key to the specified directory. These files can be mounted into a container. The files created are:

• ca.pem: CA certificate
• client.pem: Client certificate
• client-key.pem: Client private key

Types

type AzdTokenProvider

type AzdTokenProvider struct{}

AzdTokenProvider implements TokenProvider by calling the azd CLI.

type Bundle

type Bundle struct {
	CACertPEM     []byte
	ServerCertPEM []byte
	ServerKeyPEM  []byte
	ClientCertPEM []byte
	ClientKeyPEM  []byte
}

Bundle holds PEM-encoded mTLS certificate material. A Bundle is safe for concurrent use once created; its fields should not be modified.

func GenerateBundle

func GenerateBundle(extraSANs ...string) (*Bundle, error)

GenerateBundle creates a complete set of ephemeral certificates for mTLS authentication. It generates a self-signed CA, a server certificate, and a client certificate. All certificates are valid for 24 hours and use ECDSA P-256 keys. extraSANs are additional DNS names or IP addresses to add to the server certificate.

func (*Bundle) Validate

func (b *Bundle) Validate() error

Validate checks that all required PEM fields in the bundle are non-empty.

type Server

type Server struct {
	Config ServerConfig
	// contains filtered or unexported fields
}

Server is an mTLS token server that forwards Azure credential requests to the host's azd CLI.

func (*Server) Bundle

func (s *Server) Bundle() *Bundle

Bundle returns the certificate bundle used by the server.

func (*Server) CertsDir

func (s *Server) CertsDir() string

CertsDir returns the directory where client certificates were written.

func (*Server) Port

func (s *Server) Port() int

Port returns the actual port the server is listening on.

func (*Server) Start

func (s *Server) Start(ctx context.Context) error

Start generates certificates, writes client certs, starts the mTLS server in a background goroutine, and calls OnReady with the actual port.

func (*Server) Stop

func (s *Server) Stop()

Stop gracefully shuts down the server and cleans up resources.

type ServerConfig

type ServerConfig struct {
	// Port to listen on. Use 0 for auto-assign.
	Port int
	// Bind address. Empty string auto-detects: 0.0.0.0 on Linux, 127.0.0.1 elsewhere.
	Bind string
	// CertsDir is the directory to write client certs. Empty string uses a temp dir.
	CertsDir string
	// AllowedScopes is a comma-separated list of allowed scopes, or "*" for all.
	AllowedScopes string
	// ExtraSANs are additional DNS names or IP addresses for the server certificate.
	ExtraSANs []string
	// OnReady is called after the server starts listening, with the actual port.
	OnReady func(port int)
}

ServerConfig holds the configuration for the mTLS token server.

type TokenProvider

type TokenProvider interface {
	GetToken(scope string) (string, time.Time, error)
}

TokenProvider retrieves Azure access tokens for the given scope.

type TokenRequest

type TokenRequest struct {
	Scopes []string `json:"scopes"`
}

TokenRequest is the HTTP API request accepted by the token server.

type TokenResponse

type TokenResponse struct {
	Token     string `json:"token"`
	ExpiresOn string `json:"expiresOn"`
}

TokenResponse is the HTTP API response returned by the token server.