jwtauth

Documentation

Index

• Constants
• func GetPolicy(metadata policy.PolicyMetadata, params map[string]interface{}) (policy.Policy, error)
• type CachedJWKS
• type ClaimConstraints
• type ClaimMatcher
• type JWKSConfig
• type JWKSKey
• type JWKSKeySet
• type JwtAuthPolicy
  • func (p *JwtAuthPolicy) Mode() policy.ProcessingMode
  • func (p *JwtAuthPolicy) OnRequestHeaders(ctx context.Context, reqCtx *policy.RequestHeaderContext, ...) policy.RequestHeaderAction
• type KeyManager
• type LocalCert
• type RemoteJWKS
• type ScopeConstraints

Constants

const (
	AuthType = "jwt"
)

Functions

func GetPolicy

func GetPolicy(
	metadata policy.PolicyMetadata,
	params map[string]interface{},
) (policy.Policy, error)

GetPolicy is the v1alpha2 factory entry point (loaded by v1alpha2 kernels). It applies the global cacheMaxSize from systemParameters to the shared verdict cache. Redeploy invalidation of individual entries is handled implicitly by the cache key (see tokenConfigFingerprint); a changed cacheMaxSize additionally rebuilds the whole cache (see ensureTokenCache).

Types

type CachedJWKS

type CachedJWKS struct {
	Keys map[string]crypto.PublicKey
}

CachedJWKS stores cached JWKS data

type ClaimConstraints

type ClaimConstraints struct {
	AllOf []ClaimMatcher
	AnyOf []ClaimMatcher
}

ClaimConstraints defines required claim matchers using AllOf and/or AnyOf; empty means no constraints and supersedes deprecated requiredClaims.

type ClaimMatcher

type ClaimMatcher struct {
	Claim  string
	Values []string
	// contains filtered or unexported fields
}

ClaimMatcher matches a single claim: satisfied when the token's value for Claim is one of Values (OR within Values; for a multi-valued token claim, a non-empty intersection).

type JWKSConfig

type JWKSConfig struct {
	Remote *RemoteJWKS // Remote JWKS endpoint configuration
	Local  *LocalCert  // Local certificate configuration
}

JWKSConfig holds both remote and local key configurations

type JWKSKey

type JWKSKey struct {
	Kty string `json:"kty"` // Key type (RSA, EC, etc.)
	Use string `json:"use"` // Public key use
	Kid string `json:"kid"` // Key ID
	N   string `json:"n"`   // RSA modulus
	E   string `json:"e"`   // RSA exponent
	Alg string `json:"alg"` // Algorithm
	Crv string `json:"crv"` // EC curve name (P-256, P-384, P-521)
	X   string `json:"x"`   // EC x coordinate (base64url)
	Y   string `json:"y"`   // EC y coordinate (base64url)
}

JWKSKey represents a single key in JWKS

type JWKSKeySet

type JWKSKeySet struct {
	Keys []JWKSKey `json:"keys"`
}

JWKSKeySet represents the JWKS response from server

type JwtAuthPolicy

type JwtAuthPolicy struct {
	// contains filtered or unexported fields
}

JwtAuthPolicy implements JWT Authentication with JWKS support

func (*JwtAuthPolicy) Mode

func (p *JwtAuthPolicy) Mode() policy.ProcessingMode

func (*JwtAuthPolicy) OnRequestHeaders

func (p *JwtAuthPolicy) OnRequestHeaders(ctx context.Context, reqCtx *policy.RequestHeaderContext, params map[string]interface{}) policy.RequestHeaderAction

OnRequestHeaders performs JWT validation in the request header phase.

type KeyManager

type KeyManager struct {
	Name                string      // Unique name for this key manager
	Issuer              string      // Optional issuer value
	JWKS                *JWKSConfig // JWKS configuration (remote and/or local)
	ScopeClaim          string      // Token claim used to read scopes; if unset, falls back to the legacy "scope" and "scp" claims.
	ScopeClaimSeparator string      // Separator for string-valued ScopeClaim; defaults to a space and is ignored for array claims.
}

KeyManager represents a key manager with either remote JWKS or local certificate

type LocalCert

type LocalCert struct {
	Inline          string           // Inline PEM-encoded certificate
	CertificatePath string           // Path to certificate file
	PublicKey       crypto.PublicKey // Parsed public key (RSA or ECDSA)
}

LocalCert holds local certificate configuration

type RemoteJWKS

type RemoteJWKS struct {
	URI             string // JWKS endpoint URL
	CertificatePath string // Optional CA certificate path for self-signed endpoints
	SkipTlsVerify   bool   // Skip TLS certificate verification (use with caution)
	// contains filtered or unexported fields
}

RemoteJWKS holds remote JWKS endpoint configuration

type ScopeConstraints

type ScopeConstraints struct {
	AllOf []string
	AnyOf []string
}

ScopeConstraints defines required scopes using AllOf and/or AnyOf; empty means no constraints and supersedes deprecated requiredScopes.