Joseph Doherty
60 lines
1.9 KiB
C#
60 lines
1.9 KiB
C#
namespace NATS.Server.Auth;
|
|
|
|
public interface IExternalAuthClient
|
|
{
|
|
/// <summary>
|
|
/// Requests an allow/deny decision from an external authentication provider.
|
|
/// </summary>
|
|
/// <param name="request">Credential material and identity hints from the client connection.</param>
|
|
/// <param name="ct">Cancellation token bound to auth timeout and connection lifecycle.</param>
|
|
Task<ExternalAuthDecision> AuthorizeAsync(ExternalAuthRequest request, CancellationToken ct);
|
|
}
|
|
|
|
public sealed record ExternalAuthRequest(
|
|
string? Username,
|
|
string? Password,
|
|
string? Token,
|
|
string? Jwt);
|
|
|
|
public record ExternalAuthDecision(
|
|
bool Allowed,
|
|
string? Identity = null,
|
|
string? Account = null,
|
|
string? Reason = null);
|
|
|
|
public sealed class ExternalAuthOptions
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether external auth callouts are enabled.
|
|
/// </summary>
|
|
public bool Enabled { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets the timeout budget for each external auth decision request.
|
|
/// </summary>
|
|
public TimeSpan Timeout { get; set; } = TimeSpan.FromSeconds(2);
|
|
|
|
/// <summary>
|
|
/// Gets or sets the client implementation responsible for external auth decisions.
|
|
/// </summary>
|
|
public IExternalAuthClient? Client { get; set; }
|
|
}
|
|
|
|
public sealed class ProxyAuthOptions
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether trusted-proxy authentication mode is enabled.
|
|
/// </summary>
|
|
public bool Enabled { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets the required username prefix marking identities provided by a trusted proxy.
|
|
/// </summary>
|
|
public string UsernamePrefix { get; set; } = "proxy:";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the default account to assign when proxy-authenticated users omit one.
|
|
/// </summary>
|
|
public string? Account { get; set; }
|
|
}
|