Class: Keycardai::OAuth::WorkloadIdentity

Inherits:
Object
  • Object
show all
Defined in:
lib/keycardai/oauth/workload_identity.rb

Overview

Workload-identity credential: authenticates with a platform-signed OIDC token as its client assertion (RFC 7523 over RFC 8693). One generic credential owns the exchange contract; a pluggable identity-token source supplies the platform token, fetched fresh on every request because platforms rotate these tokens. The credential never caches the token; a source may cache internally when the platform contract makes that safe.

Holds no shared secret and contributes no Basic header.

Defined Under Namespace

Classes: FunctionTokenSource

Instance Method Summary collapse

Constructor Details

#initialize(source:, client_id: nil) ⇒ WorkloadIdentity

Returns a new instance of WorkloadIdentity.

Parameters:

  • source (#identity_token, #call) —

    supplies the platform-signed OIDC token; a bare callable is accepted

  • client_id (String, nil) (defaults to: nil) —

    the Keycard application credential this workload authenticates as; sent as the client_id form parameter when set (token-federation credentials are resolved by it)

Raises:

  • (ConfigurationError) —

    when the source is missing or has neither an identity_token method nor call



21
22
23
24
 
# File 'lib/keycardai/oauth/workload_identity.rb', line 21

def initialize(source:, client_id: nil)
  @source = normalize_source(source)
  @client_id = client_id
end

Instance Method Details

#authorization_header(issuer: nil) ⇒ nil

Assertion-based authentication contributes no Basic header.

Parameters:

  • issuer (String, nil) (defaults to: nil) —

    unused; part of the Credential interface

Returns:

  • (nil) 


30
31
32
 
# File 'lib/keycardai/oauth/workload_identity.rb', line 30

def authorization_header(issuer: nil)
  nil
end

#prepare_token_exchange_request(subject_token:, resource: nil, audience: nil, scope: nil, token_endpoint: nil, issuer: nil) ⇒ Hash

Build the token-exchange form parameters, fetching a fresh platform token from the source.

Parameters:

  • subject_token (String)
  • resource (String, nil) (defaults to: nil)
  • audience (String, nil) (defaults to: nil)
  • scope (String, nil) (defaults to: nil)
  • token_endpoint (String, nil) (defaults to: nil) —

    unused; part of the interface

  • issuer (String, nil) (defaults to: nil) —

    unused; part of the Credential interface

Returns:

  • (Hash)

Raises:



45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/keycardai/oauth/workload_identity.rb', line 45

def prepare_token_exchange_request(subject_token:, resource: nil, audience: nil, scope: nil,
                                   token_endpoint: nil, issuer: nil)
  {
    "grant_type" => GrantType::TOKEN_EXCHANGE,
    "subject_token" => subject_token,
    "subject_token_type" => TokenType::ACCESS_TOKEN,
    "resource" => resource,
    "audience" => audience,
    "scope" => scope,
    "client_id" => @client_id,
    "client_assertion" => fetch_identity_token,
    "client_assertion_type" => PrivateKeyManager::ASSERTION_TYPE
  }.compact
end