auth2

README

auth2

An auth provider for go-micro, it get's users from a postgres database, in the future maybe from other SQL Databases supported by bun as well.

It registers itself with router, if you use it in your stack.

THIS IS WORK IN PROGRESS

Everything in here may change without backward compatiblity until we reach v1.0.0. You also might except bugs or half-implemented stuff.

JWT Token Auth

Generate keys

task keys

Developers corner

Build podman/docker image

Prerequesits

• podman
• Task

Build

task

Remove everything

task rm

Authors

• René Jochum - rene@jochum.dev

License

Its dual licensed:

• Apache-2.0
• GPL-2.0-or-later

Documentation

Index

• Constants
• Variables
• func HasRole(user *User, role string) bool
• func IntersectsRoles(user *User, roles ...string) bool
• func RegHasClientAuth(cReg *components.Registry) error
• type AuthRegistry
  • func ClientAuthComponent() *AuthRegistry[ClientPlugin]
  • func ClientAuthMustReg(cReg *components.Registry) *AuthRegistry[ClientPlugin]
  • func RouterAuthComponent() *AuthRegistry[RouterPlugin]
  • func RouterAuthMustReg(cReg *components.Registry) *AuthRegistry[RouterPlugin]
  • func (r *AuthRegistry[T]) Flags(c *components.Registry) []cli.Flag
  • func (r *AuthRegistry[T]) ForcePlugin(pName string) error
  • func (r *AuthRegistry[T]) Health(ctx context.Context) error
  • func (r *AuthRegistry[T]) Init(c *components.Registry, cli *cli.Context) error
  • func (r *AuthRegistry[T]) Initialized() bool
  • func (r *AuthRegistry[T]) Name() string
  • func (r *AuthRegistry[T]) Plugin() T
  • func (r *AuthRegistry[T]) Priority() int
  • func (r *AuthRegistry[T]) Register(plugin T)
  • func (r *AuthRegistry[T]) Stop() error
  • func (r *AuthRegistry[T]) WrapHandler() server.HandlerWrapper
• type ClientPlugin
• type ContextUserKey
• type RouterPlugin
• type User
• type VerifierPlugin

Constants

const ClientAuthName = "clientauth"

const ROLE_ADMIN = "admin"

const ROLE_ANONYMOUS = "anonymous"

const ROLE_SERVICE = "service"

const ROLE_SUPERADMIN = "superadmin"

const ROLE_USER = "user"

const RouterAuthName = "routerauth"

Variables

var AnonUser = &User{
	Id:     "00000000-0000-0000-0000-000000000000",
	Type:   "user",
	Issuer: "nobody",
	Metadata: map[string]string{
		"Subject": "service",
	},
	Scopes: []string{},
	Roles:  []string{ROLE_ANONYMOUS},
}

AnonUser will be used when theres no user

var RolesAdmin = []string{ROLE_ADMIN, ROLE_SUPERADMIN}

var RolesAllAndAnon = []string{ROLE_SERVICE, ROLE_SUPERADMIN, ROLE_ADMIN, ROLE_USER, ROLE_ANONYMOUS}

var RolesServiceAndAdmin = []string{ROLE_SERVICE, ROLE_ADMIN, ROLE_SUPERADMIN}

var RolesServiceAndSuperadmin = []string{ROLE_SERVICE, ROLE_SUPERADMIN}

var RolesServiceAndUsersAndAdmin = []string{ROLE_SERVICE, ROLE_USER, ROLE_ADMIN, ROLE_SUPERADMIN}

var RolesUsersAndAdmin = []string{ROLE_USER, ROLE_ADMIN, ROLE_SUPERADMIN}

var ServiceUser = &User{
	Id:     "00000000-0000-0000-0000-000000000001",
	Type:   "service",
	Issuer: "",
	Scopes: []string{},
	Roles:  []string{ROLE_SERVICE},
}

Functions

func HasRole

func HasRole(user *User, role string) bool

func IntersectsRoles

func IntersectsRoles(user *User, roles ...string) bool

func RegHasClientAuth

func RegHasClientAuth(cReg *components.Registry) error

Types

type AuthRegistry

type AuthRegistry[T any] struct {
	// contains filtered or unexported fields
}

func ClientAuthComponent

func ClientAuthComponent() *AuthRegistry[ClientPlugin]

func ClientAuthMustReg

func ClientAuthMustReg(cReg *components.Registry) *AuthRegistry[ClientPlugin]

func RouterAuthComponent

func RouterAuthComponent() *AuthRegistry[RouterPlugin]

func RouterAuthMustReg

func RouterAuthMustReg(cReg *components.Registry) *AuthRegistry[RouterPlugin]

func (*AuthRegistry[T]) Flags

func (r *AuthRegistry[T]) Flags(c *components.Registry) []cli.Flag

Flags returns a list of cli.Flag's for micro.Service

func (*AuthRegistry[T]) ForcePlugin

func (r *AuthRegistry[T]) ForcePlugin(pName string) error

func (*AuthRegistry[T]) Health

func (r *AuthRegistry[T]) Health(ctx context.Context) error

Health returns the health of the plugin

func (*AuthRegistry[T]) Init

func (r *AuthRegistry[T]) Init(c *components.Registry, cli *cli.Context) error

Init should be executed in micro.Init

func (*AuthRegistry[T]) Initialized

func (r *AuthRegistry[T]) Initialized() bool

func (*AuthRegistry[T]) Name

func (r *AuthRegistry[T]) Name() string

func (*AuthRegistry[T]) Plugin

func (r *AuthRegistry[T]) Plugin() T

Plugin returns the current active Plugin

func (*AuthRegistry[T]) Priority

func (r *AuthRegistry[T]) Priority() int

func (*AuthRegistry[T]) Register

func (r *AuthRegistry[T]) Register(plugin T)

Register registers a plugin within AuthRegistry

func (*AuthRegistry[T]) Stop

func (r *AuthRegistry[T]) Stop() error

Stop should be executed after service.Run()

func (*AuthRegistry[T]) WrapHandler

func (r *AuthRegistry[T]) WrapHandler() server.HandlerWrapper

WrapHandler returns a server.HandleWrapper, this works only for ClientPlugin

type ClientPlugin

type ClientPlugin interface {

	// Set the Verifier for this Client
	AddVerifier(v VerifierPlugin)

	// ServiceContext adds the ServiceUser to the context (when using JWT's it will overwrite the Authorization Header)
	ServiceContext(ctx context.Context) (context.Context, error)

	// Inspect a context
	Inspect(ctx context.Context) (*User, error)

	// WrapHandlerFunc runs the authentication
	WrapHandlerFunc(ctx context.Context, req server.Request, rsp interface{}) error
	// contains filtered or unexported methods
}

ClientPlugin is for services that act as client's behind GinRouter

type ContextUserKey

type ContextUserKey struct{}

ContextUserKey is the key in the context for the User value.

type RouterPlugin

type RouterPlugin interface {

	// Inspect a http.Request
	Inspect(r *http.Request) (*User, error)

	// ForwardContext should forward all required informations from http.Request to the resulting context.
	ForwardContext(u *User, r *http.Request, ctx context.Context) (context.Context, error)
	// contains filtered or unexported methods
}

RouterPlugin is for routers that forward the token or do other stuff required by ClientPlugin

type User

type User struct {
	Id       string            `json:"id,omitempty"`
	Type     string            `json:"type,omitempty"`
	Issuer   string            `json:"issuer,omitempty"`
	Metadata map[string]string `json:"metadata,omitempty"`
	Scopes   []string          `json:"scopes,omitempty"`
	Roles    []string          `json:"roles,omitempty"`
}

type VerifierPlugin

type VerifierPlugin interface {
	// Verify verifies that the user is allowed to access the request, it MUST handle AnonUser
	// @return
	// 		error 	nil if its allowed, else an error
	//		bool	if the error given is a default error
	Verify(ctx context.Context, u *User, req server.Request) (error, bool)
}