Tyler King
a58d548518
- Network-policy SPIRE plugin extension - Governance event notification with merkle anchoring - Shellstream specs for consent channels + HFL embedded ABI - All 17 audit findings from AUDIT.md remediated - SSH credential composer + substrate key manager updates - Test coverage for config + sshcert packages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
1.1 KiB
Go
46 lines
1.1 KiB
Go
// OIDC Attestor — SPIRE WorkloadAttestor plugin.
|
|
//
|
|
// Runs in SPIRE Agent. Verifies OIDC tokens presented by workloads
|
|
// and maps their claims to SPIRE selectors for registration matching.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
|
|
"github.com/hashicorp/go-plugin"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
var handshakeConfig = plugin.HandshakeConfig{
|
|
ProtocolVersion: 1,
|
|
MagicCookieKey: "ServerAgent",
|
|
MagicCookieValue: "GuildhouseSpire",
|
|
}
|
|
|
|
// OIDCAttestorPlugin implements plugin.GRPCPlugin for the OIDC attestor.
|
|
type OIDCAttestorPlugin struct {
|
|
plugin.Plugin
|
|
Impl *OIDCAttestor
|
|
}
|
|
|
|
func (p *OIDCAttestorPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
|
|
log.Println("oidc-attestor: gRPC server registered")
|
|
return nil
|
|
}
|
|
|
|
func (p *OIDCAttestorPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func main() {
|
|
attestor := &OIDCAttestor{}
|
|
|
|
plugin.Serve(&plugin.ServeConfig{
|
|
HandshakeConfig: handshakeConfig,
|
|
Plugins: map[string]plugin.Plugin{
|
|
"workload_attestor": &OIDCAttestorPlugin{Impl: attestor},
|
|
},
|
|
GRPCServer: plugin.DefaultGRPCServer,
|
|
})
|
|
}
|