core

Documentation

Overview

Package core which contains logic that is shared among different compilation units.

This is primarily used to prevent cyclical compilation (forbidden in Go) between compilation units.

Forgive the horizontal slicing, it's not great and is an anti-pattern in Go, but it's also very quick and does the job.

Index

• func WrapError(standardErr AuthenticationProviderError, nestedErr error) error
• type Application
• type AuthenticationProvider
• type AuthenticationProviderError
• type Credentials
  • func (c Credentials) Encrypted() bool
• type Crypto
  • func NewCrypto(provider CryptoProvider) Crypto
  • func (c *Crypto) Decrypt(ctx context.Context, credentials *Credentials) error
  • func (c *Crypto) Encrypt(ctx context.Context, credentials Credentials) (string, error)
• type CryptoProvider
• type KMSProvider
  • func NewKMSProvider(opts *KMSProviderConfig) KMSProvider
  • func (k KMSProvider) Decrypt(ctx context.Context, input []byte) ([]byte, error)
  • func (k KMSProvider) Encrypt(ctx context.Context, input []byte) ([]byte, error)
• type KMSProviderConfig
• type PassThroughProvider
  • func (*PassThroughProvider) Decrypt(_ context.Context, input []byte) ([]byte, error)
  • func (*PassThroughProvider) Encrypt(_ context.Context, input []byte) ([]byte, error)
• type Role
• type SAMLResponse
  • func ParseEncodedResponse(b64EncodedXML string) (*SAMLResponse, error)
  • func (s *SAMLResponse) GetBase64Encoded() *string
• type User

Functions

func WrapError

func WrapError(standardErr AuthenticationProviderError, nestedErr error) error

WrapError wraps an error into a standard authentication provider error.

Types

type Application

type Application struct {
	// LegacyID is used to enable legacy support for the old key-conjurer clients.
	// This is not used past KeyConjurer version 2
	LegacyID uint   `json:"id"`
	ID       string `json:"@id"`
	Name     string `json:"name"`
}

An Application is some SAML-enabled service that a user is entitled to.

type AuthenticationProvider

type AuthenticationProvider interface {
	// Authenticate should validate that the provided credentials are correct for a user.
	Authenticate(ctx context.Context, credentials Credentials) (User, AuthenticationProviderError)
	// ListApplications should list all the applications the given user is entitled to access.
	ListApplications(ctx context.Context, user User) ([]Application, AuthenticationProviderError)
	// GenerateSAMLAssertion should generate a SAML assertion that the user may exchange with the target application in order to gain access to it.
	GenerateSAMLAssertion(ctx context.Context, credentials Credentials, appID string) (*SAMLResponse, AuthenticationProviderError)
}

An AuthenticationProvider is a component which will verify user credentials, list the applications a user is entitled to, the roles the user may assume within that application and generate SAML assertions for federation.

type AuthenticationProviderError

type AuthenticationProviderError error

AuthenticationProviderError is an error returned by an authentication provider.

var (
	ErrBadRequest                    AuthenticationProviderError = errors.New("bad request")
	ErrApplicationNotFound           AuthenticationProviderError = errors.New("application not found")
	ErrAuthenticationFailed          AuthenticationProviderError = errors.New("unauthorized")
	ErrAccessDenied                  AuthenticationProviderError = errors.New("access denied")
	ErrFactorVerificationFailed      AuthenticationProviderError = errors.New("factor verification failed")
	ErrCouldNotSendMfaPush           AuthenticationProviderError = errors.New("could not send MFA push")
	ErrSubmitChallengeResponseFailed AuthenticationProviderError = errors.New("submit challenge response failed")
	ErrCouldNotCreateSession         AuthenticationProviderError = errors.New("could not create a session")
	ErrSAMLError                     AuthenticationProviderError = errors.New("failed to process SAML")
	ErrInternalError                 AuthenticationProviderError = errors.New("internal error")
	ErrUnspecified                   AuthenticationProviderError = errors.New("unspecified")
)

A list of standard errors that can be returned by an authentication provider.

type Credentials

type Credentials struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

Credentials is a struct which contains the username and password for a user.

func (Credentials) Encrypted

func (c Credentials) Encrypted() bool

Encrypted indicates whether or not the credentials are encrypted

type Crypto

type Crypto struct {
	// contains filtered or unexported fields
}

Crypto encrypts credentials using a given provider when handling them from a client connection

func NewCrypto

func NewCrypto(provider CryptoProvider) Crypto

NewCrypto creates a new Crypto with the given provider.

func (*Crypto) Decrypt

func (c *Crypto) Decrypt(ctx context.Context, credentials *Credentials) error

Decrypt decrypts the credentials stored within the given credentials object and updates it in place.

If the credentials object is not encrypted, this is a no-op.

func (*Crypto) Encrypt

func (c *Crypto) Encrypt(ctx context.Context, credentials Credentials) (string, error)

Encrypt encrypts the given credentials and returns a string that is suitable to be stored on the client.

Depending on the implementation, this may take a long time and it is recommended that a context with a deadline be provided.

type CryptoProvider

type CryptoProvider interface {
	Encrypt(ctx context.Context, input []byte) ([]byte, error)
	Decrypt(ctx context.Context, input []byte) ([]byte, error)
}

A CryptoProvider gives the user the ability to encrypt and decrypt bytes using secrets that are not aware to the caller.

type KMSProvider

type KMSProvider struct {
	// contains filtered or unexported fields
}

func NewKMSProvider

func NewKMSProvider(opts *KMSProviderConfig) KMSProvider

func (KMSProvider) Decrypt

func (k KMSProvider) Decrypt(ctx context.Context, input []byte) ([]byte, error)

func (KMSProvider) Encrypt

func (k KMSProvider) Encrypt(ctx context.Context, input []byte) ([]byte, error)

type KMSProviderConfig

type KMSProviderConfig struct {
	KMSKeyID string
	Session  *session.Session
}

type PassThroughProvider

type PassThroughProvider struct{}

PassThroughProvider is a CryptoProvider that performs no operations on its input

func (*PassThroughProvider) Decrypt

func (*PassThroughProvider) Decrypt(_ context.Context, input []byte) ([]byte, error)

func (*PassThroughProvider) Encrypt

func (*PassThroughProvider) Encrypt(_ context.Context, input []byte) ([]byte, error)

type Role

type Role struct {
	ID          string
	RoleName    string
	AccountName string
}

A Role is something a user can 'assume' when accessing an application.

This stems from AWS terminology with their AssumeRolePolicy; it's possible this concept does not translate well with alternative cloud providers.

type SAMLResponse

type SAMLResponse struct {
	saml.Response
	// contains filtered or unexported fields
}

SAMLResponse contains a raw SAML Response from an IdP. This is used to provide access to the original, signed SAML response from the IdP as parsing it into XML and then attempting to encode it again loses this information.

func ParseEncodedResponse

func ParseEncodedResponse(b64EncodedXML string) (*SAMLResponse, error)

ParseEncodedResponse parses the base64-encoded SAML assertion provided and returns a SAMLResponse object

func (*SAMLResponse) GetBase64Encoded

func (s *SAMLResponse) GetBase64Encoded() *string

GetBase64Encoded returns the base64 encoded SAML response from the IdP.

type User

type User struct {
	ID string
}

A User represents a user from an Authentication Provider. This struct is used to guarantee that the user has originated from an authenticator, rather than being a POGO