authorize

Documentation

Overview

Package authorize is a pomerium service that is responsible for determining if a given request should be authorized (AuthZ).

Index

• type AccessTracker
  • func NewAccessTracker(provider AccessTrackerProvider, maxSize int, debouncePeriod time.Duration) *AccessTracker
  • func (tracker *AccessTracker) Run(ctx context.Context)
  • func (tracker *AccessTracker) TrackServiceAccountAccess(serviceAccountID string)
  • func (tracker *AccessTracker) TrackSessionAccess(sessionID string)
• type AccessTrackerProvider
• type Authorize
  • func New(cfg *config.Config) (*Authorize, error)
  • func (a *Authorize) Check(ctx context.Context, in *envoy_service_auth_v3.CheckRequest) (out *envoy_service_auth_v3.CheckResponse, err error)
  • func (a *Authorize) GetDataBrokerServiceClient() databroker.DataBrokerServiceClient
  • func (a *Authorize) OnConfigChange(ctx context.Context, cfg *config.Config)
  • func (a *Authorize) Run(ctx context.Context) error

Types

type AccessTracker

type AccessTracker struct {
	// contains filtered or unexported fields
}

A AccessTracker tracks accesses to sessions

func NewAccessTracker

func NewAccessTracker(
	provider AccessTrackerProvider,
	maxSize int,
	debouncePeriod time.Duration,
) *AccessTracker

NewAccessTracker creates a new SessionAccessTracker.

func (*AccessTracker) Run

func (tracker *AccessTracker) Run(ctx context.Context)

Run runs the access tracker.

func (*AccessTracker) TrackServiceAccountAccess

func (tracker *AccessTracker) TrackServiceAccountAccess(serviceAccountID string)

TrackServiceAccountAccess tracks a service account access.

func (*AccessTracker) TrackSessionAccess

func (tracker *AccessTracker) TrackSessionAccess(sessionID string)

TrackSessionAccess tracks a session access.

type AccessTrackerProvider

type AccessTrackerProvider interface {
	GetDataBrokerServiceClient() databroker.DataBrokerServiceClient
}

A AccessTrackerProvider provides the databroker service client for tracking session access.

type Authorize

type Authorize struct {
	// contains filtered or unexported fields
}

Authorize struct holds

func New

func New(cfg *config.Config) (*Authorize, error)

New validates and creates a new Authorize service from a set of config options.

func (*Authorize) Check

func (a *Authorize) Check(ctx context.Context, in *envoy_service_auth_v3.CheckRequest) (out *envoy_service_auth_v3.CheckResponse, err error)

Check implements the envoy auth server gRPC endpoint.

func (*Authorize) GetDataBrokerServiceClient

func (a *Authorize) GetDataBrokerServiceClient() databroker.DataBrokerServiceClient

GetDataBrokerServiceClient returns the current DataBrokerServiceClient.

func (*Authorize) OnConfigChange

func (a *Authorize) OnConfigChange(ctx context.Context, cfg *config.Config)

OnConfigChange updates internal structures based on config.Options

func (*Authorize) Run

func (a *Authorize) Run(ctx context.Context) error

Run runs the authorize service.