client

Documentation

Index

• Constants
• Variables
• func CopyTo(src, dst *http.Request)
• func PersistUserCtx(ctx context.Context, chain *ChainClaim, user *UserClaim) context.Context
• type BaseVerifier
• type ChainClaim
  • func GetClaim(r *http.Request) (*ChainClaim, error)
  • func GetContextChain(ctx context.Context) (*ChainClaim, bool)
  • func GetRequestingChain(r *http.Request) (*ChainClaim, bool)
  • func (uc *ChainClaim) GetOriginalClaim(ctx context.Context) (*UserClaim, error)
• type Client
  • func NewClient(v BaseVerifier) *Client
  • func (c *Client) WithOptionalUser(h http.Handler) http.Handler
  • func (c *Client) WithOptionalUserFunc(f http.HandlerFunc) http.HandlerFunc
  • func (c *Client) WithUser(h http.Handler) http.Handler
  • func (c *Client) WithUserFunc(f http.HandlerFunc) http.HandlerFunc
• type UserClaim
  • func GetContextUser(ctx context.Context) (*UserClaim, bool)
  • func GetRequestingUser(r *http.Request) (*UserClaim, bool)
  • func (uc *UserClaim) AsUsername() string
• type Verifier
  • func NewVerifier(ctx context.Context, url string) (*Verifier, error)
  • func (v *Verifier) IsValid(ctx context.Context, msg, sig, sigHash string) bool

Constants

const (
	UserContextKey  key = iota
	ChainContextKey key = iota
)

Variables

var (
	DefaultSubjectHeader    = http.CanonicalHeaderKey("X-Auth-User")
	DefaultIssuerHeader     = http.CanonicalHeaderKey("X-Auth-Source")
	DefaultVerifyHeader     = http.CanonicalHeaderKey("X-Auth-Verify")
	DefaultVerifyHashHeader = http.CanonicalHeaderKey("X-Auth-Hash-Verify")
	DefaultClaimPrefix      = "X-Auth-"
)

var (
	ErrMissingUser = errors.New("sub or iss has 0 segments")
)

Functions

func CopyTo

func CopyTo(src, dst *http.Request)

CopyTo copies user information from a source http.Request to a destination one this function is useful when proxying requests from one service to another and retaining user information

func PersistUserCtx

func PersistUserCtx(ctx context.Context, chain *ChainClaim, user *UserClaim) context.Context

PersistUserCtx injects the user/chain claims into a given context.Context.

`chain` or `user` can be nil if only one is required. Nil parameters will not overwrite existing values.

Types

type BaseVerifier

type BaseVerifier interface {
	IsValid(ctx context.Context, msg, sig, sigHash string) bool
}

type ChainClaim

type ChainClaim struct {
	Subjects  []string          `json:"subjects"`
	Issuers   []string          `json:"issuers"`
	Token     string            `json:"token"`
	TokenHash string            `json:"token_hash"` // hash of key used to sign authenticity token
	RawClaim  string            `json:"raw_claim"`
	Claims    map[string]string `json:"claims"`
}

func GetClaim

func GetClaim(r *http.Request) (*ChainClaim, error)

GetClaim creates a UserClaim from a given http.Request

func GetContextChain

func GetContextChain(ctx context.Context) (*ChainClaim, bool)

GetContextChain returns the user-chain saved into the given context.Context.

May return nil if not processed by a Client.

func GetRequestingChain

func GetRequestingChain(r *http.Request) (*ChainClaim, bool)

GetRequestingChain returns the user-chain saved into the given http.Request.

May return nil if not processed by a Client.

func (*ChainClaim) GetOriginalClaim

func (uc *ChainClaim) GetOriginalClaim(ctx context.Context) (*UserClaim, error)

GetOriginalClaim returns the 1st user within a chain as a new UserClaim

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client provides simple utilities for extracting a user from an incoming request

func NewClient

func NewClient(v BaseVerifier) *Client

NewClient creates a new instance of Client

func (*Client) WithOptionalUser

func (c *Client) WithOptionalUser(h http.Handler) http.Handler

WithOptionalUser provides a http.Handler for injecting user information into the request context.Context if it is given.

func (*Client) WithOptionalUserFunc

func (c *Client) WithOptionalUserFunc(f http.HandlerFunc) http.HandlerFunc

WithOptionalUserFunc provides a http handler function for injecting user information into the request context.Context if it is given.

func (*Client) WithUser

func (c *Client) WithUser(h http.Handler) http.Handler

WithUser provides a http.Handler for injecting user information into the request Context

func (*Client) WithUserFunc

func (c *Client) WithUserFunc(f http.HandlerFunc) http.HandlerFunc

WithUserFunc provides a http handler function for injecting user information into the request Context

type UserClaim

type UserClaim struct {
	Sub       string            `json:"sub"`        // unique id or DN
	Iss       string            `json:"iss"`        // id of issuer (e.g. OIDC url) or DN of CA
	Token     string            `json:"token"`      // authenticity token
	TokenHash string            `json:"token_hash"` // hash of key used to sign authenticity token
	Claims    map[string]string `json:"claims"`
}

func GetContextUser

func GetContextUser(ctx context.Context) (*UserClaim, bool)

GetContextUser returns the user saved into the given context.Context.

May return nil if not processed by a Client.

func GetRequestingUser

func GetRequestingUser(r *http.Request) (*UserClaim, bool)

GetRequestingUser returns the user saved into the given http.Request.

May return nil if not processed by a Client.

func (*UserClaim) AsUsername

func (uc *UserClaim) AsUsername() string

type Verifier

type Verifier struct {
	BaseVerifier
	// contains filtered or unexported fields
}

func NewVerifier

func NewVerifier(ctx context.Context, url string) (*Verifier, error)

NewVerifier creates a Verifier and attempts to load the CAP10 public key

func (*Verifier) IsValid

func (v *Verifier) IsValid(ctx context.Context, msg, sig, sigHash string) bool

IsValid checks whether sig is a signed version of msg