package spnego

Import Path
	github.com/jcmturner/gokrb5/v8/spnego (on go.dev)

Dependency Relation
	imports 27 packages, and imported by one package

Involved Source Files

	    http.go
	    krb5Token.go
	    negotiationToken.go
	  d spnego.go
		Package spnego implements the Simple and Protected GSSAPI Negotiation Mechanism for Kerberos authentication.
Package-Level Type Names (total 8)

	/* sort by: alphabet | popularity */
	 type Client (struct)
		Client will negotiate authentication with a server using SPNEGO.

		Fields (total 5)
			Client *http.Client
			Client.CheckRedirect func(req *http.Request, via []*http.Request) error
				CheckRedirect specifies the policy for handling redirects.
				If CheckRedirect is not nil, the client calls it before
				following an HTTP redirect. The arguments req and via are
				the upcoming request and the requests made already, oldest
				first. If CheckRedirect returns an error, the Client's Get
				method returns both the previous Response (with its Body
				closed) and CheckRedirect's error (wrapped in a url.Error)
				instead of issuing the Request req.
				As a special case, if CheckRedirect returns ErrUseLastResponse,
				then the most recent response is returned with its body
				unclosed, along with a nil error.
				
				If CheckRedirect is nil, the Client uses its default policy,
				which is to stop after 10 consecutive requests.

			Client.Jar http.CookieJar
				Jar specifies the cookie jar.
				
				The Jar is used to insert relevant cookies into every
				outbound Request and is updated with the cookie values
				of every inbound Response. The Jar is consulted for every
				redirect that the Client follows.
				
				If Jar is nil, cookies are only sent if they are explicitly
				set on the Request.

			Client.Timeout time.Duration
				Timeout specifies a time limit for requests made by this
				Client. The timeout includes connection time, any
				redirects, and reading the response body. The timer remains
				running after Get, Head, Post, or Do return and will
				interrupt reading of the Response.Body.
				
				A Timeout of zero means no timeout.
				
				The Client cancels requests to the underlying Transport
				as if the Request's Context ended.
				
				For compatibility, the Client will also use the deprecated
				CancelRequest method on Transport if found. New
				RoundTripper implementations should use the Request's Context
				for cancellation instead of implementing CancelRequest.

			Client.Transport http.RoundTripper
				Transport specifies the mechanism by which individual
				HTTP requests are made.
				If nil, DefaultTransport is used.

		Methods (total 6)
			( Client) CloseIdleConnections()
				CloseIdleConnections closes any connections on its Transport which
				were previously connected from previous requests but are now
				sitting idle in a "keep-alive" state. It does not interrupt any
				connections currently in use.
				
				If the Client's Transport does not have a CloseIdleConnections method
				then this method does nothing.

			(*Client) Do(req *http.Request) (resp *http.Response, err error)
				Do is the SPNEGO enabled HTTP client's equivalent of the http.Client's Do method.

			(*Client) Get(url string) (resp *http.Response, err error)
				Get is the SPNEGO enabled HTTP client's equivalent of the http.Client's Get method.

			(*Client) Head(url string) (resp *http.Response, err error)
				Head is the SPNEGO enabled HTTP client's equivalent of the http.Client's Head method.

			(*Client) Post(url, contentType string, body io.Reader) (resp *http.Response, err error)
				Post is the SPNEGO enabled HTTP client's equivalent of the http.Client's Post method.

			(*Client) PostForm(url string, data url.Values) (resp *http.Response, err error)
				PostForm is the SPNEGO enabled HTTP client's equivalent of the http.Client's PostForm method.

		As Outputs Of (at least one exported)
			func NewClient(krb5Cl *client.Client, httpCl *http.Client, spn string) *Client

	 type KRB5Token (struct)
		KRB5Token context token implementation for GSSAPI.

		Fields (total 4)
			APRep messages.APRep
			APReq messages.APReq
			KRBError messages.KRBError
			OID asn1.ObjectIdentifier
		Methods (total 7)
			(*KRB5Token) Context() context.Context
				Context returns the KRB5 token's context which will contain any verify user identity information.

			(*KRB5Token) IsAPRep() bool
				IsAPRep tests if the MechToken contains an AP_REP.

			(*KRB5Token) IsAPReq() bool
				IsAPReq tests if the MechToken contains an AP_REQ.

			(*KRB5Token) IsKRBError() bool
				IsKRBError tests if the MechToken contains an KRB_ERROR.

			(*KRB5Token) Marshal() ([]byte, error)
				Marshal a KRB5Token into a slice of bytes.

			(*KRB5Token) Unmarshal(b []byte) error
				Unmarshal a KRB5Token.

			(*KRB5Token) Verify() (bool, gssapi.Status)
				Verify a KRB5Token.

		Implements (at least one exported)
			*KRB5Token : github.com/jcmturner/gokrb5/v8/gssapi.ContextToken
		As Outputs Of (at least one exported)
			func NewKRB5TokenAPREQ(cl *client.Client, tkt messages.Ticket, sessionKey types.EncryptionKey, GSSAPIFlags []int, APOptions []int) (KRB5Token, error)

	 type NegState int (basic type)
		NegState is a type to indicate the SPNEGO negotiation state.

		As Outputs Of (at least one exported)
			func (*NegTokenResp).State() NegState
		As Types Of (total 4)
			const NegStateAcceptCompleted
			const NegStateAcceptIncomplete
			const NegStateReject
			const NegStateRequestMIC

	 type NegTokenInit (struct)
		NegTokenInit implements Negotiation Token of type Init.

		Fields (total 4)
			MechListMIC []byte
			MechTokenBytes []byte
			MechTypes []asn1.ObjectIdentifier
			ReqFlags asn1.BitString
		Methods (total 4)
			(*NegTokenInit) Context() context.Context
				Context returns the SPNEGO context which will contain any verify user identity information.

			(*NegTokenInit) Marshal() ([]byte, error)
				Marshal an Init negotiation token

			(*NegTokenInit) Unmarshal(b []byte) error
				Unmarshal an Init negotiation token

			(*NegTokenInit) Verify() (bool, gssapi.Status)
				Verify an Init negotiation token

		Implements (at least one exported)
			*NegTokenInit : github.com/jcmturner/gokrb5/v8/gssapi.ContextToken
		As Outputs Of (at least one exported)
			func NewNegTokenInitKRB5(cl *client.Client, tkt messages.Ticket, sessionKey types.EncryptionKey) (NegTokenInit, error)

	 type NegTokenResp (struct)
		NegTokenResp implements Negotiation Token of type Resp/Targ

		Fields (total 4)
			MechListMIC []byte
			NegState asn1.Enumerated
			ResponseToken []byte
			SupportedMech asn1.ObjectIdentifier
		Methods (total 5)
			(*NegTokenResp) Context() context.Context
				Context returns the SPNEGO context which will contain any verify user identity information.

			(*NegTokenResp) Marshal() ([]byte, error)
				Marshal a Resp/Targ negotiation token

			(*NegTokenResp) State() NegState
				State returns the negotiation state of the negotiation response.

			(*NegTokenResp) Unmarshal(b []byte) error
				Unmarshal a Resp/Targ negotiation token

			(*NegTokenResp) Verify() (bool, gssapi.Status)
				Verify a Resp/Targ negotiation token

		Implements (at least one exported)
			*NegTokenResp : github.com/jcmturner/gokrb5/v8/gssapi.ContextToken

	 type NegTokenTarg NegTokenResp (struct)
		NegTokenTarg implements Negotiation Token of type Resp/Targ

		Fields (total 4)
			MechListMIC []byte
			NegState asn1.Enumerated
			ResponseToken []byte
			SupportedMech asn1.ObjectIdentifier

	 type SPNEGO (struct)
		SPNEGO implements the GSS-API mechanism for RFC 4178

		Methods (total 5)
			(*SPNEGO) AcceptSecContext(ct gssapi.ContextToken) (bool, context.Context, gssapi.Status)
				AcceptSecContext is the GSS-API method for the service to verify the context token provided by the client and
				establish a context.

			(*SPNEGO) AcquireCred() error
				AcquireCred is the GSS-API method to acquire a client credential via Kerberos for SPNEGO.

			(*SPNEGO) InitSecContext() (gssapi.ContextToken, error)
				InitSecContext is the GSS-API method for the client to a generate a context token to the service via Kerberos.

			(*SPNEGO) Log(format string, v ...interface{})
				Log will write to the service's logger if it is configured.

			(*SPNEGO) OID() asn1.ObjectIdentifier
				OID returns the GSS-API assigned OID for SPNEGO.

		As Outputs Of (at least 2)
			func SPNEGOClient(cl *client.Client, spn string) *SPNEGO
			func SPNEGOService(kt *keytab.Keytab, options ...func(*service.Settings)) *SPNEGO

	 type SPNEGOToken (struct)
		SPNEGOToken is a GSS-API context token

		Fields (total 4)
			Init bool
			NegTokenInit NegTokenInit
			NegTokenResp NegTokenResp
			Resp bool
		Methods (total 4)
			(*SPNEGOToken) Context() context.Context
				Context returns the SPNEGO context which will contain any verify user identity information.

			(*SPNEGOToken) Marshal() ([]byte, error)
				Marshal SPNEGO context token

			(*SPNEGOToken) Unmarshal(b []byte) error
				Unmarshal SPNEGO context token

			(*SPNEGOToken) Verify() (bool, gssapi.Status)
				Verify the SPNEGOToken

		Implements (at least one exported)
			*SPNEGOToken : github.com/jcmturner/gokrb5/v8/gssapi.ContextToken


Package-Level Functions (total 8)

	 func NewClient(krb5Cl *client.Client, httpCl *http.Client, spn string) *Client
		NewClient returns a SPNEGO enabled HTTP client.
		Be careful when passing in the *http.Client if it is beginning reused in multiple calls to this function.
		Ensure reuse of the provided *http.Client is for the same user as a session cookie may have been added to
		http.Client's cookie jar.
		Incorrect reuse of the provided *http.Client could lead to access to the wrong user's session.

	 func NewKRB5TokenAPREQ(cl *client.Client, tkt messages.Ticket, sessionKey types.EncryptionKey, GSSAPIFlags []int, APOptions []int) (KRB5Token, error)
		NewKRB5TokenAPREQ creates a new KRB5 token with AP_REQ

	 func NewNegTokenInitKRB5(cl *client.Client, tkt messages.Ticket, sessionKey types.EncryptionKey) (NegTokenInit, error)
		NewNegTokenInitKRB5 creates new Init negotiation token for Kerberos 5

	 func SetSPNEGOHeader(cl *client.Client, r *http.Request, spn string) error
		SetSPNEGOHeader gets the service ticket and sets it as the SPNEGO authorization header on HTTP request object.
		To auto generate the SPN from the request object pass a null string "".

	 func SPNEGOClient(cl *client.Client, spn string) *SPNEGO
		SPNEGOClient configures the SPNEGO mechanism suitable for client side use.

	 func SPNEGOKRB5Authenticate(inner http.Handler, kt *keytab.Keytab, settings ...func(*service.Settings)) http.Handler
		SPNEGOKRB5Authenticate is a Kerberos SPNEGO authentication HTTP handler wrapper.

	 func SPNEGOService(kt *keytab.Keytab, options ...func(*service.Settings)) *SPNEGO
		SPNEGOService configures the SPNEGO mechanism suitable for service side use.

	 func UnmarshalNegToken(b []byte) (bool, interface{}, error)
		UnmarshalNegToken umarshals and returns either a NegTokenInit or a NegTokenResp.
		
		The boolean indicates if the response is a NegTokenInit.
		If error is nil and the boolean is false the response is a NegTokenResp.


Package-Level Constants (total 11)

	const HTTPHeaderAuthRequest = "Authorization"
		HTTPHeaderAuthRequest is the header that will hold authn/z information.

	const HTTPHeaderAuthResponse = "WWW-Authenticate"
		HTTPHeaderAuthResponse is the header that will hold SPNEGO data from the server.

	const HTTPHeaderAuthResponseValueKey = "Negotiate"
		HTTPHeaderAuthResponseValueKey is the key in the auth header for SPNEGO.

	const NegStateAcceptCompleted NegState = 0
		Negotiation state values.

	const NegStateAcceptIncomplete NegState = 1
		Negotiation state values.

	const NegStateReject NegState = 2
		Negotiation state values.

	const NegStateRequestMIC NegState = 3
		Negotiation state values.

	const TOK_ID_KRB_AP_REP = "0200"
		GSSAPI KRB5 MechToken IDs.

	const TOK_ID_KRB_AP_REQ = "0100"
		GSSAPI KRB5 MechToken IDs.

	const TOK_ID_KRB_ERROR = "0300"
		GSSAPI KRB5 MechToken IDs.

	const UnauthorizedMsg = "Unauthorised.\n"
		UnauthorizedMsg is the message returned in the body when authentication fails.

The pages are generated with Golds v0.6.7. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.