| // Code generated by protoc-gen-go. |
| // source: github.com/luci/luci-go/tokenserver/api/admin/v1/config.proto |
| // DO NOT EDIT! |
| |
| package admin |
| |
| import proto "github.com/golang/protobuf/proto" |
| import fmt "fmt" |
| import math "math" |
| |
| // Reference imports to suppress errors if they are not otherwise used. |
| var _ = proto.Marshal |
| var _ = fmt.Errorf |
| var _ = math.Inf |
| |
| // TokenServerConfig is read from tokenserver.cfg in luci-config. |
| type TokenServerConfig struct { |
| // List of CAs we trust. |
| CertificateAuthority []*CertificateAuthorityConfig `protobuf:"bytes,1,rep,name=certificate_authority,json=certificateAuthority" json:"certificate_authority,omitempty"` |
| } |
| |
| func (m *TokenServerConfig) Reset() { *m = TokenServerConfig{} } |
| func (m *TokenServerConfig) String() string { return proto.CompactTextString(m) } |
| func (*TokenServerConfig) ProtoMessage() {} |
| func (*TokenServerConfig) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{0} } |
| |
| func (m *TokenServerConfig) GetCertificateAuthority() []*CertificateAuthorityConfig { |
| if m != nil { |
| return m.CertificateAuthority |
| } |
| return nil |
| } |
| |
| // CertificateAuthorityConfig defines a single CA we trust. |
| // |
| // Such CA issues certificates for nodes that use The Token Service. Each node |
| // has a private key and certificate with Common Name set to the FQDN of this |
| // node, e.g. "CN=slave43-c1.c.chromecompute.google.com.internal". |
| // |
| // The Token Server uses this CN to derive an identity string for a machine. It |
| // splits FQDN into a hostname ("slave43-c1") and a domain name |
| // ("c.chromecompute.google.com.internal"), searches for a domain name in |
| // "known_domains" set, and, if it is present, uses parameters described there |
| // for generating a token with machine_id <hostname>@<token-server-url>. |
| type CertificateAuthorityConfig struct { |
| UniqueId int64 `protobuf:"varint,6,opt,name=unique_id,json=uniqueId" json:"unique_id,omitempty"` |
| Cn string `protobuf:"bytes,1,opt,name=cn" json:"cn,omitempty"` |
| CertPath string `protobuf:"bytes,2,opt,name=cert_path,json=certPath" json:"cert_path,omitempty"` |
| CrlUrl string `protobuf:"bytes,3,opt,name=crl_url,json=crlUrl" json:"crl_url,omitempty"` |
| UseOauth bool `protobuf:"varint,4,opt,name=use_oauth,json=useOauth" json:"use_oauth,omitempty"` |
| // KnownDomains describes parameters to use for each particular domain. |
| KnownDomains []*DomainConfig `protobuf:"bytes,5,rep,name=known_domains,json=knownDomains" json:"known_domains,omitempty"` |
| } |
| |
| func (m *CertificateAuthorityConfig) Reset() { *m = CertificateAuthorityConfig{} } |
| func (m *CertificateAuthorityConfig) String() string { return proto.CompactTextString(m) } |
| func (*CertificateAuthorityConfig) ProtoMessage() {} |
| func (*CertificateAuthorityConfig) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{1} } |
| |
| func (m *CertificateAuthorityConfig) GetUniqueId() int64 { |
| if m != nil { |
| return m.UniqueId |
| } |
| return 0 |
| } |
| |
| func (m *CertificateAuthorityConfig) GetCn() string { |
| if m != nil { |
| return m.Cn |
| } |
| return "" |
| } |
| |
| func (m *CertificateAuthorityConfig) GetCertPath() string { |
| if m != nil { |
| return m.CertPath |
| } |
| return "" |
| } |
| |
| func (m *CertificateAuthorityConfig) GetCrlUrl() string { |
| if m != nil { |
| return m.CrlUrl |
| } |
| return "" |
| } |
| |
| func (m *CertificateAuthorityConfig) GetUseOauth() bool { |
| if m != nil { |
| return m.UseOauth |
| } |
| return false |
| } |
| |
| func (m *CertificateAuthorityConfig) GetKnownDomains() []*DomainConfig { |
| if m != nil { |
| return m.KnownDomains |
| } |
| return nil |
| } |
| |
| // DomainConfig is used inside CertificateAuthorityConfig. |
| type DomainConfig struct { |
| // Domain is domain names of hosts this config applies to. |
| Domain []string `protobuf:"bytes,1,rep,name=domain" json:"domain,omitempty"` |
| // MachineTokenLifetime is how long generated machine tokens live, in seconds. |
| // |
| // If 0, machine tokens are not allowed. |
| MachineTokenLifetime int64 `protobuf:"varint,5,opt,name=machine_token_lifetime,json=machineTokenLifetime" json:"machine_token_lifetime,omitempty"` |
| } |
| |
| func (m *DomainConfig) Reset() { *m = DomainConfig{} } |
| func (m *DomainConfig) String() string { return proto.CompactTextString(m) } |
| func (*DomainConfig) ProtoMessage() {} |
| func (*DomainConfig) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{2} } |
| |
| func (m *DomainConfig) GetDomain() []string { |
| if m != nil { |
| return m.Domain |
| } |
| return nil |
| } |
| |
| func (m *DomainConfig) GetMachineTokenLifetime() int64 { |
| if m != nil { |
| return m.MachineTokenLifetime |
| } |
| return 0 |
| } |
| |
| // DelegationPermissions is read from delegation.cfg in luci-config. |
| type DelegationPermissions struct { |
| // Rules specify what calls to MintDelegationToken are allowed. |
| // |
| // Rules are evaluated independently. One and only one rule should match the |
| // request to allow the operation. If none rules or more than one rule match, |
| // the request will be denied. |
| // |
| // See DelegationRule comments for more details. |
| Rules []*DelegationRule `protobuf:"bytes,1,rep,name=rules" json:"rules,omitempty"` |
| } |
| |
| func (m *DelegationPermissions) Reset() { *m = DelegationPermissions{} } |
| func (m *DelegationPermissions) String() string { return proto.CompactTextString(m) } |
| func (*DelegationPermissions) ProtoMessage() {} |
| func (*DelegationPermissions) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{3} } |
| |
| func (m *DelegationPermissions) GetRules() []*DelegationRule { |
| if m != nil { |
| return m.Rules |
| } |
| return nil |
| } |
| |
| // DelegationRule describes a single allowed case of using delegation tokens. |
| // |
| // An incoming MintDelegationTokenRequest is basically a tuple of: |
| // * 'requestor_id' - an identity of whoever makes the request. |
| // * 'delegated_identity' - an identity to delegate. |
| // * 'audience' - a set of identities that will be able to use the token. |
| // * 'services' - a set of services that should accept the token. |
| // |
| // A request matches a rule iff: |
| // * 'requestor_id' is in 'requestor' set. |
| // * 'delegated_identity' is in 'allowed_to_impersonate' set. |
| // * 'audience' is a subset of 'allowed_audience' set. |
| // * 'services' is a subset of 'target_service' set. |
| // |
| // The presence of a matching rule permits to mint the token. The rule also |
| // provides an upper bound on allowed validity_duration, and the rule's name |
| // is logged in the audit trail. |
| type DelegationRule struct { |
| // A descriptive name of this rule, for the audit log. |
| Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"` |
| // Email of developers that added this rule, to know who to contact. |
| Owner []string `protobuf:"bytes,2,rep,name=owner" json:"owner,omitempty"` |
| // A set of callers to which this rule applies. |
| // |
| // Matched against verified credentials of a caller of MintDelegationToken. |
| // |
| // Each element is either: |
| // * An identity string ("user:<email>"). |
| // * A group reference ("group:<name>"). |
| // |
| // The groups specified here are expanded when MintDelegationTokenRequest is |
| // evaluated. |
| Requestor []string `protobuf:"bytes,3,rep,name=requestor" json:"requestor,omitempty"` |
| // Identities that are allowed to be delegated/impersonated by the requestor. |
| // |
| // Matched against 'delegated_identity' field of MintDelegationTokenRequest. |
| // |
| // Each element is either: |
| // * An identity string ("user:<email>"). |
| // * A group reference ("group:<name>"). |
| // * A special identifier "REQUESTOR" that is substituted by the requestor |
| // identity when evaluating the rule. |
| // |
| // "REQUESTOR" allows one to generate tokens that delegate their own identity |
| // to some target audience. |
| // |
| // The groups specified here are expanded when MintDelegationTokenRequest is |
| // evaluated. |
| AllowedToImpersonate []string `protobuf:"bytes,4,rep,name=allowed_to_impersonate,json=allowedToImpersonate" json:"allowed_to_impersonate,omitempty"` |
| // A set of identities that should be able to use the new token. |
| // |
| // Matched against 'audience' field of MintDelegationTokenRequest. |
| // |
| // Each element is either: |
| // * An identity string ("user:<email>"). |
| // * A group reference ("group:<name>"). |
| // * A special identifier "REQUESTOR" that is substituted by the requestor |
| // identity when evaluating the rule. |
| // * A special token "*" that means "any bearer can use the new token, |
| // including anonymous". |
| // |
| // "REQUESTOR" is typically used here for rules that allow requestors to |
| // impersonate someone else. The corresponding tokens have the requestor as |
| // the only allowed audience. |
| // |
| // The groups specified here are NOT expanded when MintDelegationTokenRequest |
| // is evaluated. To match the rule, MintDelegationTokenRequest must specify |
| // subset of 'allowed_audience' groups explicitly in 'audience' field. |
| AllowedAudience []string `protobuf:"bytes,5,rep,name=allowed_audience,json=allowedAudience" json:"allowed_audience,omitempty"` |
| // A set of services that should be able to accept the new token. |
| // |
| // Matched against 'services' field of MintDelegationTokenRequest. |
| // |
| // Each element is either: |
| // * A service identity string ("service:<id>"). |
| // * A special token "*" that mean "any LUCI service should accept the |
| // token". |
| TargetService []string `protobuf:"bytes,6,rep,name=target_service,json=targetService" json:"target_service,omitempty"` |
| // Maximum allowed validity duration (sec) of minted delegation tokens. |
| // |
| // Default is 12 hours. |
| MaxValidityDuration int64 `protobuf:"varint,7,opt,name=max_validity_duration,json=maxValidityDuration" json:"max_validity_duration,omitempty"` |
| } |
| |
| func (m *DelegationRule) Reset() { *m = DelegationRule{} } |
| func (m *DelegationRule) String() string { return proto.CompactTextString(m) } |
| func (*DelegationRule) ProtoMessage() {} |
| func (*DelegationRule) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{4} } |
| |
| func (m *DelegationRule) GetName() string { |
| if m != nil { |
| return m.Name |
| } |
| return "" |
| } |
| |
| func (m *DelegationRule) GetOwner() []string { |
| if m != nil { |
| return m.Owner |
| } |
| return nil |
| } |
| |
| func (m *DelegationRule) GetRequestor() []string { |
| if m != nil { |
| return m.Requestor |
| } |
| return nil |
| } |
| |
| func (m *DelegationRule) GetAllowedToImpersonate() []string { |
| if m != nil { |
| return m.AllowedToImpersonate |
| } |
| return nil |
| } |
| |
| func (m *DelegationRule) GetAllowedAudience() []string { |
| if m != nil { |
| return m.AllowedAudience |
| } |
| return nil |
| } |
| |
| func (m *DelegationRule) GetTargetService() []string { |
| if m != nil { |
| return m.TargetService |
| } |
| return nil |
| } |
| |
| func (m *DelegationRule) GetMaxValidityDuration() int64 { |
| if m != nil { |
| return m.MaxValidityDuration |
| } |
| return 0 |
| } |
| |
| func init() { |
| proto.RegisterType((*TokenServerConfig)(nil), "tokenserver.admin.TokenServerConfig") |
| proto.RegisterType((*CertificateAuthorityConfig)(nil), "tokenserver.admin.CertificateAuthorityConfig") |
| proto.RegisterType((*DomainConfig)(nil), "tokenserver.admin.DomainConfig") |
| proto.RegisterType((*DelegationPermissions)(nil), "tokenserver.admin.DelegationPermissions") |
| proto.RegisterType((*DelegationRule)(nil), "tokenserver.admin.DelegationRule") |
| } |
| |
| func init() { |
| proto.RegisterFile("github.com/luci/luci-go/tokenserver/api/admin/v1/config.proto", fileDescriptor2) |
| } |
| |
| var fileDescriptor2 = []byte{ |
| // 539 bytes of a gzipped FileDescriptorProto |
| 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x74, 0x93, 0x5f, 0x6f, 0xd3, 0x3c, |
| 0x18, 0xc5, 0x95, 0x3f, 0xcd, 0x52, 0xbf, 0xdb, 0xde, 0xce, 0x74, 0xc3, 0x02, 0x24, 0x4a, 0x25, |
| 0xa4, 0x72, 0xb1, 0x46, 0x0c, 0x24, 0xae, 0xb8, 0x98, 0xd6, 0x9b, 0x55, 0x48, 0x4c, 0xd9, 0xe0, |
| 0xd6, 0x72, 0x9d, 0xa7, 0xad, 0x35, 0xc7, 0xee, 0x1c, 0xbb, 0xdd, 0xbe, 0x07, 0x9f, 0x90, 0x4f, |
| 0x82, 0xe2, 0x64, 0x74, 0x88, 0x72, 0x13, 0xc5, 0xe7, 0x77, 0x9e, 0xc7, 0x3a, 0x39, 0x0a, 0xfa, |
| 0xbc, 0x10, 0x76, 0xe9, 0x66, 0x63, 0xae, 0xcb, 0x4c, 0x3a, 0x2e, 0xfc, 0xe3, 0x74, 0xa1, 0x33, |
| 0xab, 0x6f, 0x41, 0x55, 0x60, 0xd6, 0x60, 0x32, 0xb6, 0x12, 0x19, 0x2b, 0x4a, 0xa1, 0xb2, 0xf5, |
| 0xfb, 0x8c, 0x6b, 0x35, 0x17, 0x8b, 0xf1, 0xca, 0x68, 0xab, 0xf1, 0xd1, 0x13, 0xdb, 0xd8, 0x5b, |
| 0x86, 0x1b, 0x74, 0x74, 0x53, 0x8b, 0xd7, 0x5e, 0xbc, 0xf0, 0x6e, 0x3c, 0x43, 0xc7, 0x1c, 0x8c, |
| 0x15, 0x73, 0xc1, 0x99, 0x05, 0xca, 0x9c, 0x5d, 0x6a, 0x23, 0xec, 0x03, 0x09, 0x06, 0xd1, 0xe8, |
| 0xbf, 0xb3, 0xd3, 0xf1, 0x5f, 0x7b, 0xc6, 0x17, 0x5b, 0xff, 0xf9, 0xa3, 0xbd, 0xd9, 0x96, 0xf7, |
| 0xf9, 0x0e, 0x36, 0xfc, 0x19, 0xa0, 0x17, 0xff, 0x1e, 0xc2, 0x2f, 0x51, 0xd7, 0x29, 0x71, 0xe7, |
| 0x80, 0x8a, 0x82, 0x24, 0x83, 0x60, 0x14, 0xe5, 0x69, 0x23, 0x5c, 0x16, 0xf8, 0x10, 0x85, 0x5c, |
| 0x91, 0x60, 0x10, 0x8c, 0xba, 0x79, 0xc8, 0x55, 0x6d, 0xae, 0xef, 0xa0, 0x2b, 0x66, 0x97, 0x24, |
| 0xf4, 0x72, 0x5a, 0x0b, 0x57, 0xcc, 0x2e, 0xf1, 0x73, 0xb4, 0xc7, 0x8d, 0xa4, 0xce, 0x48, 0x12, |
| 0x79, 0x94, 0x70, 0x23, 0xbf, 0x19, 0xe9, 0xaf, 0xa8, 0x80, 0xea, 0x3a, 0x1e, 0x89, 0x07, 0xc1, |
| 0x28, 0xcd, 0x53, 0x57, 0xc1, 0xd7, 0xfa, 0x8c, 0x27, 0xe8, 0xe0, 0x56, 0xe9, 0x8d, 0xa2, 0x85, |
| 0x2e, 0x99, 0x50, 0x15, 0xe9, 0xf8, 0xe8, 0xaf, 0x77, 0x44, 0x9f, 0x78, 0x47, 0x1b, 0x76, 0xdf, |
| 0x4f, 0x35, 0x52, 0x35, 0xb4, 0x68, 0xff, 0x29, 0xc5, 0x27, 0x28, 0x69, 0xf6, 0xf9, 0x2f, 0xd9, |
| 0xcd, 0xdb, 0x13, 0xfe, 0x88, 0x4e, 0x4a, 0xc6, 0x97, 0x42, 0x01, 0xf5, 0xfb, 0xa9, 0x14, 0x73, |
| 0xb0, 0xa2, 0x04, 0xd2, 0xf1, 0xd1, 0xfb, 0x2d, 0xf5, 0x55, 0x7d, 0x69, 0xd9, 0x34, 0x4e, 0xc3, |
| 0x5e, 0x34, 0x8d, 0xd3, 0xa8, 0x17, 0x4f, 0xe3, 0x34, 0xee, 0x75, 0xa6, 0x71, 0x9a, 0xf4, 0xf6, |
| 0x86, 0x57, 0xe8, 0x78, 0x02, 0x12, 0x16, 0xcc, 0x0a, 0xad, 0xae, 0xc0, 0x94, 0xa2, 0xaa, 0x84, |
| 0x56, 0x15, 0xfe, 0x84, 0x3a, 0xc6, 0x49, 0xa8, 0xda, 0x1e, 0xdf, 0xec, 0x0a, 0xf3, 0x7b, 0x30, |
| 0x77, 0x12, 0xf2, 0xc6, 0x3f, 0xfc, 0x11, 0xa2, 0xc3, 0x3f, 0x09, 0xc6, 0x28, 0x56, 0xac, 0x84, |
| 0xb6, 0x05, 0xff, 0x8e, 0xfb, 0xa8, 0xa3, 0x37, 0x0a, 0x0c, 0x09, 0x7d, 0xba, 0xe6, 0x80, 0x5f, |
| 0xa1, 0xae, 0x81, 0x3b, 0x07, 0x95, 0xd5, 0x86, 0x44, 0x9e, 0x6c, 0x85, 0x3a, 0x3a, 0x93, 0x52, |
| 0x6f, 0xa0, 0xa0, 0x56, 0x53, 0x51, 0xae, 0xc0, 0x54, 0x5a, 0x31, 0x0b, 0x24, 0xf6, 0xd6, 0x7e, |
| 0x4b, 0x6f, 0xf4, 0xe5, 0x96, 0xe1, 0x77, 0xa8, 0xf7, 0x38, 0xc5, 0x5c, 0x21, 0x40, 0x71, 0xf0, |
| 0x0d, 0x75, 0xf3, 0xff, 0x5b, 0xfd, 0xbc, 0x95, 0xf1, 0x5b, 0x74, 0x68, 0x99, 0x59, 0x80, 0xa5, |
| 0x75, 0x50, 0xc1, 0x81, 0x24, 0xde, 0x78, 0xd0, 0xa8, 0xd7, 0x8d, 0x88, 0xcf, 0xd0, 0x71, 0xc9, |
| 0xee, 0xe9, 0x9a, 0x49, 0x51, 0x08, 0xfb, 0x40, 0x0b, 0x67, 0x7c, 0x58, 0xb2, 0xe7, 0x1b, 0x78, |
| 0x56, 0xb2, 0xfb, 0xef, 0x2d, 0x9b, 0xb4, 0x68, 0x96, 0xf8, 0xdf, 0xea, 0xc3, 0xaf, 0x00, 0x00, |
| 0x00, 0xff, 0xff, 0x68, 0x96, 0x3b, 0x9b, 0x97, 0x03, 0x00, 0x00, |
| } |
