Reference¶
Everything authn exports, what each value defaults to, and what happens when it is
wrong. Pages here describe the behaviour of
gitlab.com/phpboyscout/go/authn
as implemented; pkg.go.dev
carries the generated signatures.
| Page | Covers |
|---|---|
| Verifiers | NewAPIKeyVerifier, NewJWTVerifier, NewMTLSVerifier, and their options |
| JWTConfig fields | Every field of JWTConfig, its default and its failure mode |
| Identity & authorization | Identity, AuthorizeFunc, RequireScopes, RequireClaim, RequestMetadata, the context helpers |
| Defaults and hard limits | Every default value and every non-configurable limit |
| Errors | Every error string the package produces, its cause and its fix |
What the package exports¶
authn has no configuration file, no environment variables and no CLI. Everything is
set through Go values passed to a constructor, so this reference is a reference to
types and functions.
| Symbol | Kind | Purpose |
|---|---|---|
Verifier |
interface | Verify(ctx, credential string) (*Identity, error) |
CertVerifier |
interface | VerifyCert(ctx, verifiedChains [][]*x509.Certificate) (*Identity, error) |
Identity |
struct | The verified outcome: Subject, Method, Claims, Scopes |
ErrUnauthenticated |
sentinel error | Wrapped by every credential rejection |
KeyEntry |
struct | One {Key, Subject} pair for the API-key verifier |
NewAPIKeyVerifier |
constructor | API-key Verifier |
JWTConfig |
struct | Configuration for the JWT verifier |
JWTOption / WithOIDCDiscovery |
option | JWKS endpoint discovery from an OIDC issuer |
NewJWTVerifier |
constructor | JWT/OIDC Verifier |
MTLSOption / WithCertSubject |
option | Subject derivation for the mTLS verifier |
NewMTLSVerifier |
constructor | mTLS CertVerifier |
AuthorizeFunc |
func type | func(ctx, *Identity) bool — the whole authorization surface |
RequireScopes / RequireClaim |
combinators | Built-in AuthorizeFunc values |
RequestMetadata |
struct | Method and Path, for route-aware predicates |
ContextWithIdentity / IdentityFromContext |
funcs | Carry the identity down the stack |
ContextWithRequestMetadata / RequestMetadataFromContext |
funcs | Carry request metadata to a predicate |
What is not here¶
There is no reference page for configuration keys, flags or commands because the
package has none — it is a library consumed from Go code. If you are looking for the
things authn deliberately does not provide, that is
What authn does not do.