// Generates an HMAC Signature for an OAuth1.0a request.
354292
func sign(message, key string) string {
	hashfun := hmac.New(sha1.New, []byte(key))
	hashfun.Write([]byte(message))
	rawsignature := hashfun.Sum(nil)
	base64signature := make([]byte, base64.StdEncoding.EncodedLen(len(rawsignature)))
	base64.StdEncoding.Encode(base64signature, rawsignature)

	return string(base64signature)
}
1113244
func (m *SigningMethodHMAC) Sign(data []byte, key interface{}) (Signature, error) {
	keyBytes, ok := key.([]byte)
	if !ok {
		return nil, ErrInvalidKey
	}
	hasher := hmac.New(m.Hash.New, keyBytes)
	hasher.Write(data)
	return Signature(hasher.Sum(nil)), nil
}
1077453
func CreateSignatureForRequest(method string, values *url.Values, accessKeySecret string) string {

	canonicalizedQueryString := percentReplace(values.Encode())

	stringToSign := method + "&%2F&" + url.QueryEscape(canonicalizedQueryString)
	return CreateSignature(stringToSign, accessKeySecret)
}
1359460
func (a *AuthorizeTokenGenDefault) GenerateAuthorizeToken(data *AuthorizeData) (ret string, err error) {
	token := uuid.NewRandom()
	return base64.RawURLEncoding.EncodeToString([]byte(token)), nil
}
555165
func accessTokenHash(alg jose.SignatureAlgorithm, accessToken string) (string, error) {
	newHash, ok := hashForSigAlg[alg]
	if !ok {
		return "", fmt.Errorf("unsupported signature algorithm: %s", alg)
	}

	hash := newHash()
	if _, err := io.WriteString(hash, accessToken); err != nil {
		return "", fmt.Errorf("computing hash: %v", err)
	}
	sum := hash.Sum(nil)
	return base64.RawURLEncoding.EncodeToString(sum[:len(sum)/2]), nil
}
53314
func (s *S3Uploader) buildAuthHeader(md5, headerTime, fileName string) (string, error) {
	access, err := getAuthCredentials()
	if err != nil {
		return "", err
	}

	// Docs: http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
	verStr := fmt.Sprintf("PUT\n%s\napplication/x-gzip\n%s\nx-amz-acl:%s\n/%s", md5, headerTime, s.permission,
		path.Join(s.bucketName, fileName))
	encodedStr := hmac.ComputeHmacSha1(verStr, access.SecretKey)
	return fmt.Sprintf("AWS %s:%s", access.AccessKey, encodedStr), nil
}
698162
func (s *Service) Sign(authKeys Auth, r *http.Request) error {
	date := r.Header.Get("Date")
	t := time.Now().UTC()
	if date != "" {
		var err error
		t, err = time.Parse(http.TimeFormat, date)
		if err != nil {
			return err
		}
	}
	r.Header.Set("Date", t.Format(iSO8601BasicFormat))

	sk, err := authKeys.KeyForSigning(t)
	if err != nil {
		return err
	}

	k := ghmac([]byte("AWS4"+sk.SecretAccessKey), []byte(t.Format(iSO8601BasicFormatShort)))
	k = ghmac(k, []byte(s.Region))
	k = ghmac(k, []byte(s.Name))
	k = ghmac(k, []byte(AWS4_URL))

	h := hmac.New(sha256.New, k)
	s.writeStringToSign(h, t, r)

	auth := bytes.NewBufferString("AWS4-HMAC-SHA256 ")
	auth.Write([]byte("Credential=" + sk.AccessKeyId + "/" + s.creds(t)))
	auth.Write([]byte{',', ' '})
	auth.Write([]byte("SignedHeaders="))
	s.writeHeaderList(auth, r)
	auth.Write([]byte{',', ' '})
	auth.Write([]byte("Signature=" + fmt.Sprintf("%x", h.Sum(nil))))

	r.Header.Set("Authorization", auth.String())

	if sk.SessionToken != "" {
		r.Header.Add(AWSSecurityTokenHeader, sk.SessionToken)
	}

	return nil
}
250770
func (c *HMACStrategy) Validate(token string) (err error) {
	var keys [][]byte

	if len(c.GlobalSecret) > 0 {
		keys = append(keys, c.GlobalSecret)
	}

	if len(c.RotatedGlobalSecrets) > 0 {
		keys = append(keys, c.RotatedGlobalSecrets...)
	}

	for _, key := range keys {
		if err = c.validate(key, token); err == nil {
			return nil
		} else if errors.Cause(err) == fosite.ErrTokenSignatureMismatch {
		} else {
			return err
		}
	}

	if err == nil {
		return errors.New("a secret for signing HMAC-SHA256 is expected to be defined, but none were")
	}

	return err
}
1339033
func (client *Client) Sign(params url.Values) (string, error) {
	query := encodeValues(params)
	query = strings.ToLower(query)
	mac := hmac.New(sha1.New, []byte(client.apiSecret))
	_, err := mac.Write([]byte(query))
	if err != nil {
		return "", err
	}

	signature := base64.StdEncoding.EncodeToString(mac.Sum(nil))
	return signature, nil
}
1049988
func (s *HmacSha1Signer) GetSignature(consumerSecret string, tokenSecret string, signatureBase string) string {
	signingKey := consumerSecret + "&" + tokenSecret
	signer := hmac.New(sha1.New, []byte(signingKey))
	signer.Write([]byte(signatureBase))
	oauthSignature := base64.StdEncoding.EncodeToString(signer.Sum(nil))
	return oauthSignature
}
613732
func (a *AuthCommand) GenerateAndSignKeys(clusterApi auth.ClientI) error {
	switch {
	case a.genUser != "" && a.genHost == "":
		return a.generateUserKeys(clusterApi)
	case a.genUser == "" && a.genHost != "":
		return a.generateHostKeys(clusterApi)
	default:
		return trace.BadParameter("--user or --host must be specified")
	}
}
1232492
func Convert_v1_OAuthAccessToken_To_oauth_OAuthAccessToken(in *v1.OAuthAccessToken, out *oauth.OAuthAccessToken, s conversion.Scope) error {
	return autoConvert_v1_OAuthAccessToken_To_oauth_OAuthAccessToken(in, out, s)
}
1132446
func (si SignerInfo) X509SignatureAlgorithm() x509.SignatureAlgorithm {
	var (
		sigOID    = si.SignatureAlgorithm.Algorithm.String()
		digestOID = si.DigestAlgorithm.Algorithm.String()
	)

	if sa := oid.SignatureAlgorithmToX509SignatureAlgorithm[sigOID]; sa != x509.UnknownSignatureAlgorithm {
		return sa
	}

	return oid.PublicKeyAndDigestAlgorithmToX509SignatureAlgorithm[sigOID][digestOID]
}
497740
func (m *tokenManager) GenerateTransientUserAccessTokenForIdentity(ctx context.Context, identity repository.Identity) (*string, error) {
	token, err := m.GenerateUnsignedUserAccessTokenForIdentity(ctx, identity)
	if err != nil {
		return nil, err
	}

	claims := token.Claims.(jwt.MapClaims)
	iat := time.Now().Unix()
	claims["exp"] = iat + m.config.GetTransientTokenExpiresIn()
	claims["transient"] = "true"

	accessToken, err := token.SignedString(m.userAccountPrivateKey.Key)
	if err != nil {
		return nil, errors.WithStack(err)
	}

	return &accessToken, nil
}
740182
func signingKey(clientSecret string, timestamp string) []byte {
	h := hmac.New(sha256.New, []byte(clientSecret))
	h.Write([]byte(timestamp))
	key := make([]byte, base64.StdEncoding.EncodedLen(32))
	base64.StdEncoding.Encode(key, h.Sum(nil))
	return key
}
345780
func NewHmacAuth(hash crypto.Hash, key []byte, header string,
	headers []string) HmacAuth {
	if hash.Available() == false {
		var name string
		var supported bool
		if name, supported = algorithmName[hash]; !supported {
			name = "#" + strconv.Itoa(int(hash))
		}
		panic("hmacauth: hash algorithm " + name + " is unavailable")
	}
	canonicalHeaders := make([]string, len(headers))
	for i, h := range headers {
		canonicalHeaders[i] = http.CanonicalHeaderKey(h)
	}
	return &hmacAuth{hash, key, header, canonicalHeaders}
}
952518
func (pcc *PubControlClient) generateAuthHeader() (string, error) {
	if pcc.authBasicUser != "" {
		encodedCredentials := base64.StdEncoding.EncodeToString([]byte(
			strings.Join([]string{pcc.authBasicUser, ":",
				pcc.authBasicPass}, "")))
		return strings.Join([]string{"Basic ", encodedCredentials}, ""), nil
	} else if pcc.authJwtClaim != nil {
		token := jwt.New(jwt.SigningMethodHS256)
		token.Valid = true
		claims := token.Claims.(jwt.MapClaims)
		for k, v := range pcc.authJwtClaim {
			claims[k] = v
		}
		if _, ok := pcc.authJwtClaim["exp"]; !ok {
			claims["exp"] = time.Now().Add(time.Second * 3600).Unix()
		}
		tokenString, err := token.SignedString(pcc.authJwtKey)
		if err != nil {
			return "", err
		}
		return strings.Join([]string{"Bearer ", tokenString}, ""), nil
	} else {
		return "", nil
	}
}