NewAuthenticator returns an Auth0Authenticator that checks for a JWT signed by a key referenced in the JWKS file, has the required audience and issuer claims, and contains claims for a brim tenant and user id.
(ctx context.Context, logger *zap.Logger, registerer prometheus.Registerer, config AuthConfig)
| 43 | // by a key referenced in the JWKS file, has the required audience and issuer |
| 44 | // claims, and contains claims for a brim tenant and user id. |
| 45 | func NewAuthenticator(ctx context.Context, logger *zap.Logger, registerer prometheus.Registerer, config AuthConfig) (*Auth0Authenticator, error) { |
| 46 | if config.Audience == "" || config.ClientID == "" || config.Domain == "" || config.JWKSPath == "" { |
| 47 | return nil, errors.New("auth.audience, auth.clientid, auth.domain, and auth.jwkspath must be set when auth enabled") |
| 48 | } |
| 49 | validator, err := auth.NewTokenValidator(config.Audience, config.Domain, config.JWKSPath) |
| 50 | if err != nil { |
| 51 | return nil, err |
| 52 | } |
| 53 | unauthorized := promauto.With(registerer).NewCounter(prometheus.CounterOpts{ |
| 54 | Name: "request_errors_unauthorized_total", |
| 55 | Help: "Number of request errors due to bad or missing authorization.", |
| 56 | }) |
| 57 | return &Auth0Authenticator{ |
| 58 | logger: logger.Named("auth"), |
| 59 | methodResponse: api.AuthMethodResponse{ |
| 60 | Kind: api.AuthMethodAuth0, |
| 61 | Auth0: &api.AuthMethodAuth0Details{ |
| 62 | Audience: config.Audience, |
| 63 | Domain: config.Domain, |
| 64 | ClientID: config.ClientID, |
| 65 | }, |
| 66 | }, |
| 67 | unauthorized: unauthorized, |
| 68 | validator: validator, |
| 69 | }, nil |
| 70 | } |
| 71 | |
| 72 | func (a *Auth0Authenticator) Middleware(next func(*Core, *ResponseWriter, *Request)) func(*Core, *ResponseWriter, *Request) { |
| 73 | return func(c *Core, w *ResponseWriter, r *Request) { |
no test coverage detected