go.chromium.org/luci@v0.0.0-20250314024836-d9a61d0730e6/tokenserver/api/machine_token.proto (about)

     1  // Copyright 2016 The LUCI Authors. All rights reserved.
     2  // Use of this source code is governed under the Apache License, Version 2.0
     3  // that can be found in the LICENSE file.
     4  
     5  syntax = "proto3";
     6  
     7  package tokenserver;
     8  
     9  option go_package = "go.chromium.org/luci/tokenserver/api;tokenserver";
    10  
    11  
    12  // The kinds of machine tokens the token server can mint.
    13  //
    14  // Passed to MintMachineToken and InspectMachineToken.
    15  //
    16  // Reserved: 1.
    17  enum MachineTokenType {
    18    UNKNOWN_TYPE       = 0; // used if the field is not initialized
    19    LUCI_MACHINE_TOKEN = 2; // matches serialized MachineTokenEnvelope
    20  }
    21  
    22  
    23  // MachineTokenBody describes internal structure of the machine token.
    24  //
    25  // The token will be put in HTTP headers and its body shouldn't be too large.
    26  // For that reason we use unix timestamps instead of google.protobuf.Timestamp
    27  // (no need for microsecond precision), and assume certificate serial numbers
    28  // are smallish uint64 integers (not random blobs).
    29  message MachineTokenBody {
    30    reserved 6;
    31  
    32    // Machine identity this token conveys (machine FQDN).
    33    //
    34    // It is extracted from a Common Name of a certificate used as a basis for
    35    // the token.
    36    string machine_fqdn = 1;
    37  
    38    // Service account email that signed this token.
    39    //
    40    // When verifying the token backends will check that the issuer is in
    41    // "auth-token-servers" group.
    42    string issued_by = 2;
    43  
    44    // Unix timestamp in seconds when this token was issued. Required.
    45    uint64 issued_at = 3;
    46  
    47    // Number of seconds the token is considered valid.
    48    //
    49    // Usually 3600. Set by the token server. Required.
    50    uint64 lifetime  = 4;
    51  
    52    // Id of a CA that issued machine certificate used to make this token.
    53    //
    54    // These IDs are defined in token server config (via unique_id field).
    55    int64 ca_id = 5;
    56  
    57    // Serial number of the machine certificate used to make this token.
    58    //
    59    // ca_id and cert_sn together uniquely identify the certificate, and can be
    60    // used to check for certificate revocation (by asking token server whether
    61    // the given certificate is in CRL). Revocation checks are optional, most
    62    // callers can rely on expiration checks only.
    63    bytes cert_sn = 7;
    64  }
    65  
    66  
    67  // MachineTokenEnvelope is what is actually being serialized and represented
    68  // as a machine token (after being encoded using base64 standard raw encoding).
    69  //
    70  // Resulting token (including base64 encoding) is usually ~500 bytes long.
    71  message MachineTokenEnvelope {
    72    bytes token_body = 1; // serialized MachineTokenBody
    73    string key_id = 2;    // id of a token server private key used for signing
    74    bytes rsa_sha256 = 3; // signature of 'token_body'
    75  }