// NewVerifier create a request.Authenticator by verifying a client cert on the request, then delegating to the wrapped auth
976427
func NewVerifier(opts x509.VerifyOptions, auth authenticator.Request, allowedCommonNames sets.String) authenticator.Request {
	return &Verifier{opts, auth, allowedCommonNames}
}
1057202
func New(authTokenHandlers ...authenticator.Token) authenticator.Token {
	if len(authTokenHandlers) == 1 {
		return authTokenHandlers[0]
	}
	return &unionAuthTokenHandler{Handlers: authTokenHandlers, FailOnError: false}
}
242678
func NewAuthenticator(router *mux.Router, ctx *Settings, log logging.Logger) AuthenticatorAPI {
	a := &authenticator{
		router: router,
		log:    log,
		formatter: render.New(render.Options{
			IndentJSON: true,
		}),
		groupDb: make(map[string][]*access.PermissionGroup_Permissions),
		expTime: ctx.ExpTime,
	}

	// Authentication store
	if ctx.AuthStore != nil {
		a.userDb = ctx.AuthStore
	} else {
		a.userDb = CreateDefaultAuthDB()
	}

	// Set token signature
	signature = ctx.Signature
	if a.expTime == 0 {
		a.expTime = defaultExpTime
		a.log.Debugf("Token expiration time claim not set, defaulting to 1 hour")
	}

	// Hash of default admin password, hashed with cost 10
	hash := "$2a$10$q5s1LP7xbCJWJlLet1g/h.rGrsHtciILps90bNRdJ.6DRekw9b.zK"
	if err := a.userDb.AddUser(admin, hash, []string{admin}); err != nil {
		a.log.Errorf("failed to add admin user: %v", err)
	}

	for _, user := range ctx.Users {
		if user.Name == admin {
			a.log.Errorf("rejected to create user-defined account named 'admin'")
			continue
		}
		if err := a.userDb.AddUser(user.Name, user.PasswordHash, user.Permissions); err != nil {
			a.log.Errorf("failed to add user %s: %v", user.Name, err)
			continue
		}
		a.log.Debug("Registered user %s, permissions: %v", user.Name, user.Permissions)
	}

	// Admin-group, available by default and always enabled for all URLs
	a.groupDb[admin] = []*access.PermissionGroup_Permissions{}

	a.registerSecurityHandlers()

	return a
}
430233
func New(opts x509.VerifyOptions, user UserConversion) *Authenticator {
	return &Authenticator{opts, user}
}
768498
func New(auth Authenticator, opts ...Option) (*Client, error) {
	if auth == nil {
		return nil, errors.New("no authenticator provided")
	}

	client := &Client{
		authenticator: auth,
		baseURL:       apiURL,
		headers:       make(http.Header),
	}

	if err := client.parseOptions(opts...); err != nil {
		return nil, errors.Wrap(err, "options parsing failed")
	}

	// Fall back to http.DefaultClient if the user does not provide
	// their own
	if client.httpClient == nil {
		client.httpClient = &http.Client{
			Timeout: time.Second * 30,
		}
	}

	// Fall back to default log.Logger (STDOUT) if the user does not provide
	// their own
	if client.logger == nil {
		logger := &log.Logger{}
		logger.SetOutput(os.Stdout)
		client.logger = logger
	}

	return client, nil
}
710920
func (a Authenticator) NewClient(token *oauth2.Token) Client {
	client := a.config.Client(a.context, token)
	return Client{
		http:    client,
		baseURL: baseAddress,
	}
}
98665
func NewAuthenticator(statePool *state.StatePool, clock clock.Clock) (*Authenticator, error) {
	authContext, err := newAuthContext(statePool.SystemState(), clock)
	if err != nil {
		return nil, errors.Trace(err)
	}
	return &Authenticator{
		statePool:   statePool,
		authContext: authContext,
	}, nil
}
630794
func New(auth Auth) (*Client, error) {
	if err := auth.validate(); err != nil {
		return nil, err
	}

	return &Client{
		c:        &http.Client{},
		username: auth.Username,
		apiKey:   auth.Apikey,
	}, nil
}
434285
func NewAuthenticationProviderService(ctx servicecontext.ServiceContext, config AuthenticationProviderServiceConfig) service.AuthenticationProviderService {
	return &authenticationProviderServiceImpl{
		BaseService: base.NewBaseService(ctx),
		config:      config,
	}
}
1163954
func newBypassAuthorizer(auth kauthorizer.Authorizer, paths ...string) kauthorizer.Authorizer {
	return bypassAuthorizer{paths: sets.NewString(paths...), authorizer: auth}
}
968671
func NewRSAVerifier() Verifier {
	return verifyFn(func(checksum, signature []byte, hash crypto.Hash, publicKey crypto.PublicKey) error {
		key, ok := publicKey.(*rsa.PublicKey)
		if !ok {
			return errors.New("not a valid RSA public key")
		}
		return rsa.VerifyPKCS1v15(key, hash, checksum, signature)
	})
}
1310043
func NewVerifierFromFile(jwtcertPath string, redirectURI string, redirectOnFail, redirectOnNoToken bool) (*PKIJWTVerifier, error) {
	jwtCertPEM, err := ioutil.ReadFile(jwtcertPath)
	if err != nil {
		return nil, fmt.Errorf("failed to read JWT signing certificates or public keys from file: %s", err)
	}
	return NewVerifierFromPEM(jwtCertPEM, redirectURI, redirectOnFail, redirectOnNoToken)
}
749682
func (m *manager) GetAuthenticator() (auth.Authenticator, error) {
	return auth.NewJwtAuth(&auth.JwtAuthConfig{
		SharedSecret: []byte(m.config.SharedSecret),
	})
}
792822
func NewAPIAuthenticator(st *apiprovisioner.State) (AuthenticationProvider, error) {
	stateAddresses, err := st.StateAddresses()
	if err != nil {
		return nil, errors.Trace(err)
	}
	apiAddresses, err := st.APIAddresses()
	if err != nil {
		return nil, errors.Trace(err)
	}
	caCert, err := st.CACert()
	if err != nil {
		return nil, errors.Trace(err)
	}
	modelUUID, err := st.ModelUUID()
	if err != nil {
		return nil, errors.Trace(err)
	}
	stateInfo := &mongo.MongoInfo{
		Info: mongo.Info{
			Addrs:  stateAddresses,
			CACert: caCert,
		},
	}
	apiInfo := &api.Info{
		Addrs:    apiAddresses,
		CACert:   caCert,
		ModelTag: names.NewModelTag(modelUUID),
	}
	return &simpleAuth{stateInfo, apiInfo}, nil
}
607171
func New(authenticator authenticator.Token, cacheErrs bool, successTTL, failureTTL time.Duration) authenticator.Token {
	return newWithClock(authenticator, cacheErrs, successTTL, failureTTL, utilclock.RealClock{})
}
1153888
func New(authRequestHandlers ...authenticator.Request) authenticator.Request {
	if len(authRequestHandlers) == 1 {
		return authRequestHandlers[0]
	}
	return &unionAuthRequestHandler{Handlers: authRequestHandlers, FailOnError: false}
}
154026
func (c *Client) newRequest(method, urlStr string, auth Authenticator, body interface{}) (*http.Request, error) {
	rel, err := url.Parse(urlStr)
	if err != nil {
		return nil, err
	}

	url := c.BaseURL.ResolveReference(rel)

	buf := &bytes.Buffer{}
	if body != nil {
		if reader, ok := body.(io.Reader); ok {
			io.Copy(buf, reader)
		} else {
			err = json.NewEncoder(buf).Encode(body)
			if err != nil {
				return nil, err
			}
		}
	}

	req, err := http.NewRequest(method, url.String(), buf)
	if err != nil {
		return nil, err
	}

	auth.ApplyAuthentication(req)

	return req, nil
}