package jsso

Get desktop application:
View/edit binary Protocol Buffers messages

Service Enrollment manages the WebAuthn enrollment ceremony.

• rpc Finish (FinishEnrollmentRequest, FinishEnrollmentReply)

  jsso.proto:49

  message FinishEnrollmentRequest

  jsso.proto:95

  • optional webauthn.PublicKeyCredential credential = 1

  • string name = 2

  message FinishEnrollmentReply

  jsso.proto:100

  • string login_url = 1

• rpc Start (StartEnrollmentRequest, StartEnrollmentReply)

  jsso.proto:47

  message StartEnrollmentRequest

  jsso.proto:87

  (message has no fields)

  message StartEnrollmentReply

  jsso.proto:90

  • optional types.User user = 1

  • optional webauthn.PublicKeyCredentialCreationOptions credential_creation_options = 2

Service Login manages the WebAuthn login ceremony.

• rpc Finish (FinishLoginRequest, FinishLoginReply)

  jsso.proto:41

  message FinishLoginRequest

  jsso.proto:78

  • optional webauthn.PublicKeyCredential credential = 1

  • string error = 2

  • string redirect_token = 3

  message FinishLoginReply

  jsso.proto:83

  • string redirect_url = 1

• rpc Start (StartLoginRequest, StartLoginReply)

  jsso.proto:39

  message StartLoginRequest

  jsso.proto:70

  • string username = 1

  message StartLoginReply

  jsso.proto:73

  • optional webauthn.PublicKeyCredentialRequestOptions credential_request_options = 1

  • string token = 2

Service session manages sessions.

• rpc AuthorizeHTTP (AuthorizeHTTPRequest, AuthorizeHTTPReply)

  jsso.proto:33

  AuthorizeHTTP authorizes an incoming HTTP request, returning a request-scoped bearer token to authenticate the request to upstream systems. A "deny" authorization decision will not be transmitted as a gRPC error; a gRPC error like PermissionDenied means that the caller is not authorized to call AuthorizeHTTP, not that the HTTP request is unauthorized. (Corollary: an OK response code does not mean the request is authorized.)

  message AuthorizeHTTPRequest

  jsso.proto:112

  AuthorizeHTTPRequest is a request from an authenticating proxy to authorize one HTTP request.

  • string request_method = 1

    The method of this request.

  • string request_uri = 2

    The URI that this request is attempting to access.

  • string request_id = 3

    The x-request-id header for this request.

  • repeated string authorization_headers = 4

    The value of the "Authorization" HTTP header.

  • repeated string cookies = 5

    Any cookies included with this request.

  • string ip_address = 6

    The IP address of the user making this request.

  message AuthorizeHTTPReply

  jsso.proto:162

  AuthorizeHTTPReply contains the authorization decision.

  • oneof decision

    • Allow allow = 1

    • Deny deny = 2

Service User manages user accounts.

• rpc Edit (EditUserRequest, EditUserReply)

  jsso.proto:11

  Edit adds a new user if the ID is 0, or updates an existing user.

  message EditUserRequest

  jsso.proto:53

  • optional types.User user = 1

  message EditUserReply

  jsso.proto:57

  • optional types.User user = 1

• rpc GenerateEnrollmentLink (GenerateEnrollmentLinkRequest, GenerateEnrollmentLinkReply)

  jsso.proto:14

  GenerateEnrollmentLink generates an enrollment token for the user.

  message GenerateEnrollmentLinkRequest

  jsso.proto:61

  • optional types.User target = 1

  message GenerateEnrollmentLinkReply

  jsso.proto:65

  • string url = 1

  • string token = 2

• rpc WhoAmI (WhoAmIRequest, WhoAmIReply)

  jsso.proto:20

  WhoAmI returns the user object associated with the current session. When called without a session, a null current user is returned rather than an error.

  message WhoAmIRequest

  jsso.proto:104

  (message has no fields)

  message WhoAmIReply

  jsso.proto:106

  • optional types.User user = 1

Allow allows a request through the proxy.

Used in: AuthorizeHTTPReply

• string username = 1

• repeated string groups = 2

• string bearer_token = 3

  A signed and encrypted token allowing the upstream application to authorize this request without contacting an external system. It is scoped to this request and has a short duration, so capturing this token only provides limited authenticated access. This token is included here for non-proxying API clients; the actual authorization header to pass upstream is included in add_headers or append_headers fields below.

• repeated types.Header add_headers = 4

  Headers to replace when sending the request upstream. If Authorization or Cookie are unset, they should be cleared.

Deny denies a request through the proxy. An HTTP response can be included to inform the end-user as to what went wrong. (More likely, it will be a temporary redirect to a login page.)

Used in: AuthorizeHTTPReply

• string reason = 1

• oneof destination

  • Deny.Redirect redirect = 2

  • Deny.Response response = 3

Used in: Deny

• string redirect_url = 1

Used in: Deny

• string content_type = 1

• string body = 2