packetbroker

Documentation

Index

• Constants
• Variables
• func TokenPublicKeysURL(issuer string) string
• func TokenSource(ctx context.Context, clientID, clientSecret string, opts ...TokenOption) oauth2.TokenSource
• func UnverifiedNetworkIdentifier(token string) (*ttnpb.PacketBrokerNetworkIdentifier, error)
• type IAMTokenClaims
• type PublicKeyProvider
  • func CachePublicKey(provider PublicKeyProvider, ttl time.Duration) PublicKeyProvider
  • func PublicKeyFromURL(client *http.Client, url string) PublicKeyProvider
• type PublicKeyProviderFunc
  • func (f PublicKeyProviderFunc) PublicKeys(ctx context.Context) (*jose.JSONWebKeySet, error)
• type Scope
• type TokenClaims
  • func ParseAndVerify(ctx context.Context, token *oauth2.Token, keyProvider PublicKeyProvider, ...) (TokenClaims, error)
  • func Verify(ctx context.Context, token *jwt.JSONWebToken, keyProvider PublicKeyProvider, ...) (TokenClaims, error)
• type TokenNetworkClaim
• type TokenOption
  • func WithAudienceFromAddresses(addresses ...string) TokenOption
  • func WithScope(scopes ...Scope) TokenOption
  • func WithTokenURL(tokenURL string) TokenOption

Constants

const (
	DefaultTokenIssuer       = "https://iam.packetbroker.net"
	DefaultTokenURL          = DefaultTokenIssuer + "/token"
	DefaultPublicKeyCacheTTL = 10 * time.Minute
)

Default values for Packet Broker IAM.

Variables

var GatewayIdentifiers = &ttnpb.GatewayIdentifiers{GatewayId: "packetbroker"}

GatewayIdentifiers are the proxy gateway identifier of gateways connected through Packet Broker.

Functions

func TokenPublicKeysURL

func TokenPublicKeysURL(issuer string) string

TokenPublicKeysURL returns the URL with public keys with which a token are signed.

func TokenSource

func TokenSource(ctx context.Context, clientID, clientSecret string, opts ...TokenOption) oauth2.TokenSource

TokenSource returns a new OAuth 2.0 token source using Packet Broker credentials.

func UnverifiedNetworkIdentifier

func UnverifiedNetworkIdentifier(token string) (*ttnpb.PacketBrokerNetworkIdentifier, error)

UnverifiedNetworkIdentifier returns the Packet Broker network identifier from the given token. This function does not verify the token.

Types

type IAMTokenClaims

type IAMTokenClaims struct {
	Cluster  bool                `json:"c,omitempty"`
	Networks []TokenNetworkClaim `json:"ns,omitempty"`
	Rights   []int32             `json:"rights,omitempty"`
}

IAMTokenClaims defines the claims from Packet Broker IAM.

type PublicKeyProvider

type PublicKeyProvider interface {
	PublicKeys(context.Context) (*jose.JSONWebKeySet, error)
}

PublicKeyProvider provides a set of public keys.

func CachePublicKey

func CachePublicKey(provider PublicKeyProvider, ttl time.Duration) PublicKeyProvider

CachePublicKey caches the result from the given PublicKeyProvider with the TTL.

func PublicKeyFromURL

func PublicKeyFromURL(client *http.Client, url string) PublicKeyProvider

PublicKeyFromURL loads the public keys from the given URL.

type PublicKeyProviderFunc

type PublicKeyProviderFunc func(context.Context) (*jose.JSONWebKeySet, error)

PublicKeyProviderFunc is a function that implements PublicKeyProvider.

func (PublicKeyProviderFunc) PublicKeys

func (f PublicKeyProviderFunc) PublicKeys(ctx context.Context) (*jose.JSONWebKeySet, error)

PublicKeys implements PublicKeyProvider.

type Scope

type Scope string

Scope defines a scope of claims to request in the token.

const (
	ScopeNetworks Scope = "networks"
)

type TokenClaims

type TokenClaims struct {
	jwt.Claims
	PacketBroker IAMTokenClaims `json:"https://iam.packetbroker.net/claims,omitempty"`
}

TokenClaims defines the Packet Broker JSON Web Token (JWT) claims.

func ParseAndVerify

func ParseAndVerify(ctx context.Context, token *oauth2.Token, keyProvider PublicKeyProvider, issuer, audience string) (TokenClaims, error)

ParseAndVerify parses and verifies the token and returns the claims. See Verify for the verification process.

func Verify

func Verify(ctx context.Context, token *jwt.JSONWebToken, keyProvider PublicKeyProvider, issuer, audience string) (TokenClaims, error)

Verify verifies the token and returns the claims. If issuer is non-empty, the token's issuer must match the issuer. If audience is non-empty, one of the token's audiences must match the audience. The current system timestamp is used as reference to verify not before, issued at and expiry.

type TokenNetworkClaim

type TokenNetworkClaim struct {
	NetID    uint32 `json:"nid"`
	TenantID string `json:"tid"`
}

TokenNetworkClaim defines a Packet Broker network identifier.

type TokenOption

type TokenOption func(o *tokenOptions)

TokenOption customizes fetching a Packet Broker token.

func WithAudienceFromAddresses

func WithAudienceFromAddresses(addresses ...string) TokenOption

WithAudienceFromAddresses provides the service addresses for which the token will be valid. The host parts of the addresses are used as the token audience.

func WithScope

func WithScope(scopes ...Scope) TokenOption

WithScope customizes the scope.

func WithTokenURL

func WithTokenURL(tokenURL string) TokenOption

WithTokenURL customizes the token URL.