// AuthAlways returns an authentication function that always returns true iff it is passed a valid tag.
180647
func AuthAlways() GetAuthFunc {
	return func() (AuthFunc, error) {
		return func(tag names.Tag) bool {
			return true
		}, nil
	}
}
1163075
func (p *Provider) SessionAuthenticated() bool {
	p.sessionLock.RLock()
	defer p.sessionLock.RUnlock()
	return p.sessionAuth
}
1149050
func (m *GoogleOAuth2Method) authenticateAgainstGoogle(c context.Context, cfg *Config, accessToken string) (
	*User, time.Duration, error) {

	// Use the anonymous transport client for OAuth2 verification.
	client := cfg.anonymousClient(c)

	// Fetch an info dict associated with the token.
	logging.Infof(c, "oauth: Querying tokeninfo endpoint")
	tokenInfo, err := googleoauth.GetTokenInfo(c, googleoauth.TokenInfoParams{
		AccessToken: accessToken,
		Client:      client,
		Endpoint:    m.tokenInfoEndpoint,
	})
	if err != nil {
		if err == googleoauth.ErrBadToken {
			return nil, 0, err
		}
		return nil, 0, errors.Annotate(err, "oauth: transient error when validating token").
			Tag(transient.Tag).Err()
	}

	// Verify the token contains a validated email.
	switch {
	case tokenInfo.Email == "":
		return nil, 0, fmt.Errorf("oauth: token is not associated with an email")
	case !tokenInfo.EmailVerified:
		return nil, 0, fmt.Errorf("oauth: email %s is not verified", tokenInfo.Email)
	}
	if tokenInfo.ExpiresIn <= 0 {
		return nil, 0, fmt.Errorf("oauth: 'expires_in' field is not a positive integer")
	}

	// Verify `scopes` is subset of tokenInfo.Scope.
	tokenScopes := map[string]bool{}
	for _, s := range strings.Split(tokenInfo.Scope, " ") {
		tokenScopes[s] = true
	}
	for _, s := range m.Scopes {
		if !tokenScopes[s] {
			return nil, 0, fmt.Errorf("oauth: token doesn't have scope %q", s)
		}
	}

	// Good enough.
	id, err := identity.MakeIdentity("user:" + tokenInfo.Email)
	if err != nil {
		return nil, 0, err
	}

	exp := time.Duration(tokenInfo.ExpiresIn) * time.Second
	u := &User{
		Identity: id,
		Email:    tokenInfo.Email,
		ClientID: tokenInfo.Aud,
	}

	return u, exp, nil
}
791479
func (f TokenFunc) AuthenticateToken(ctx context.Context, token string) (*Response, bool, error) {
	return f(ctx, token)
}
577045
func (s *Server) isGatewayAuthorized(c *client) bool {
	// Snapshot server options.
	opts := s.getOpts()
	if opts.Gateway.Username == "" {
		return true
	}

	// Check whether TLS map is enabled, otherwise use single user/pass.
	if opts.Gateway.TLSMap {
		return checkClientTLSCertSubject(c, func(user string) bool {
			return opts.Gateway.Username == user
		})
	}

	if opts.Gateway.Username != c.opts.Username {
		return false
	}
	return comparePasswords(opts.Gateway.Password, c.opts.Password)
}
602626
func IsAlwaysTrust(ctx context.Context) bool {
	bv, ok := ctx.Value(ctxKeyAlwaysTrust).(bool)
	if !ok {
		return false
	}
	return bv
}
82016
func isTagsIdentical(originalTags, checkedTags map[string]string) bool {
	if len(originalTags) != len(checkedTags) {
		return false
	}

	for tagName, tagValue := range originalTags {
		if tagValue != checkedTags[tagName] {
			return false
		}
	}

	return true
}
1177663
func (c *Client) AuthToken() (string, error) {
	var authToken string
	err := c.doGet("auth-token", func(r io.Reader) error {
		authTokenraw, err := ioutil.ReadAll(r)
		authToken = string(authTokenraw)
		return err
	})
	return authToken, err
}
1369027
func (a alwaysAcceptPasswordAuthenticator) AuthenticatePassword(ctx context.Context, username, password string) (*authenticator.Response, bool, error) {
	// Since this IDP doesn't validate usernames or passwords, disallow usernames consisting entirely of spaces
	// Normalize usernames by removing leading/trailing spaces
	username = strings.TrimSpace(username)

	if username == "" || password == "" {
		return nil, false, nil
	}

	identity := authapi.NewDefaultUserIdentityInfo(a.providerName, username)

	return identitymapper.ResponseFor(a.identityMapper, identity)
}
164900
func (g *gcm) auth(out, ciphertext, additionalData []byte, tagMask *[gcmBlockSize]byte) {
	var y gcmFieldElement
	g.update(&y, additionalData)
	g.update(&y, ciphertext)

	y.low ^= uint64(len(additionalData)) * 8
	y.high ^= uint64(len(ciphertext)) * 8

	g.mul(&y)

	putUint64(out, y.low)
	putUint64(out[8:], y.high)

	xorWords(out, out, tagMask[:])
}
1009629
func UrlEquals(tab *Tab, equalsUrl string) ConditionalFunc {
	return func(tab *Tab) bool {
		if url, err := tab.GetCurrentUrl(); err == nil && url == equalsUrl {
			return true
		}
		return false
	}
}
471908
func (cm *CasbinModule) AuthzFilter(c *revel.Controller, fc []revel.Filter) {
	if !CheckPermission(cm.enforcer, c.Request) {
		c.Result = c.Forbidden("Access denied by the Authz plugin.")
		return
	} else {
		fc[0](c, fc[1:])
	}
}
672501
func (ctx *Context) Auth() *Auth {
	if ctx.auth == nil {
		ctx.auth = &Auth{
			ctx: ctx,
		}
	}
	return ctx.auth
}
1190362
func AuthFuncForTag(valid names.Tag) GetAuthFunc {
	return func() (AuthFunc, error) {
		return func(tag names.Tag) bool {
			return tag == valid
		}, nil
	}
}
1054926
func AuthTLS(t *tls.Config) client.Option {
	return func(o *client.Options) {
		if o.Context == nil {
			o.Context = context.Background()
		}
		o.Context = context.WithValue(o.Context, tlsAuth{}, t)
	}
}
1168487
func (r *apiHandler) AuthApplicationAgent() bool {
	_, isApp := r.GetAuthTag().(names.ApplicationTag)
	return isApp
}
926425
func AuthCurveRemove(domain string, pubkeys ...string) {
	if p, ok := auth_pubkeys[domain]; ok {
		for _, pubkey := range pubkeys {
			delete(p, pubkey)
		}
	}
}