mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-12 08:37:38 +02:00
1187be2bf3
- authenticate/providers: add group support to azure
- authenticate/providers: add group support to google
- authenticate/providers: add group support to okta
- authenticate/providers: add group support to onelogin
- {authenticate/proxy}: change default cookie lifetime timeout to 14 hours
- proxy: sign group membership
- proxy: add group header
- deployment: add CHANGELOG
- deployment: fix where make release wasn’t including version
45 lines
1.9 KiB
Go
45 lines
1.9 KiB
Go
package authenticator // import "github.com/pomerium/pomerium/proxy/authenticator"
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/pomerium/pomerium/internal/sessions"
|
|
)
|
|
|
|
// Authenticator provides the authenticate service interface
|
|
type Authenticator interface {
|
|
// Redeem takes a code and returns a validated session or an error
|
|
Redeem(context.Context, string) (*sessions.SessionState, error)
|
|
// Refresh attempts to refresh a valid session with a refresh token. Returns a refreshed session.
|
|
Refresh(context.Context, *sessions.SessionState) (*sessions.SessionState, error)
|
|
// Validate evaluates a given oidc id_token for validity. Returns validity and any error.
|
|
Validate(context.Context, string) (bool, error)
|
|
// Close closes the authenticator connection if any.
|
|
Close() error
|
|
}
|
|
|
|
// Options contains options for connecting to an authenticate service .
|
|
type Options struct {
|
|
// Addr is the location of the authenticate service. Used if InternalAddr is not set.
|
|
Addr string
|
|
Port int
|
|
// InternalAddr is the internal (behind the ingress) address to use when making an
|
|
// authentication connection. If empty, Addr is used.
|
|
InternalAddr string
|
|
// OverrideCertificateName overrides the server name used to verify the hostname on the
|
|
// returned certificates from the server. gRPC internals also use it to override the virtual
|
|
// hosting name if it is set.
|
|
OverrideCertificateName string
|
|
// Shared secret is used to authenticate a authenticate-client with a authenticate-server.
|
|
SharedSecret string
|
|
// CA specifies the base64 encoded TLS certificate authority to use.
|
|
CA string
|
|
// CAFile specifies the TLS certificate authority file to use.
|
|
CAFile string
|
|
}
|
|
|
|
// New returns a new authenticate service client. Takes a client implementation name as an argument.
|
|
// Currently only gRPC is supported and is always returned.
|
|
func New(name string, opts *Options) (a Authenticator, err error) {
|
|
return NewGRPC(opts)
|
|
}
|