3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-03 16:59:22 +02:00
Code Issues Projects Releases Packages Wiki Activity

options: support multiple signing keys (#3828)

Browse source 
* options: support multiple signing keys

* fix controlplane method, errors
This commit is contained in:
Caleb Doxsey 2022-12-22 09:31:09 -07:00 • committed by GitHub
parent 753eeff12f
commit 3e892a8533
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 233 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

10
authorize/check_response_test.go
View file

@ -33,7 +33,10 @@ func TestAuthorize_handleResult(t *testing.T) {
htpkePrivateKey, err := opt.GetHPKEPrivateKey()
require.NoError(t, err)
authnSrv := httptest.NewServer(handlers.JWKSHandler(opt.SigningKey, htpkePrivateKey.PublicKey()))
signingKey, err := opt.GetSigningKey()
require.NoError(t, err)
authnSrv := httptest.NewServer(handlers.JWKSHandler(signingKey, htpkePrivateKey.PublicKey()))
t.Cleanup(authnSrv.Close)
opt.AuthenticateURLString = authnSrv.URL
@ -198,7 +201,10 @@ func TestRequireLogin(t *testing.T) {
htpkePrivateKey, err := opt.GetHPKEPrivateKey()
require.NoError(t, err)
authnSrv := httptest.NewServer(handlers.JWKSHandler(opt.SigningKey, htpkePrivateKey.PublicKey()))
signingKey, err := opt.GetSigningKey()
require.NoError(t, err)
authnSrv := httptest.NewServer(handlers.JWKSHandler(signingKey, htpkePrivateKey.PublicKey()))
t.Cleanup(authnSrv.Close)
opt.AuthenticateURLString = authnSrv.URL

4
authorize/evaluator/config.go
View file

@ -7,7 +7,7 @@ import (
type evaluatorConfig struct {
policies []config.Policy
clientCA []byte
signingKey string
signingKey []byte
authenticateURL string
googleCloudServerlessAuthenticationServiceAccount string
jwtClaimsHeaders config.JWTClaimHeaders
@ -39,7 +39,7 @@ func WithClientCA(clientCA []byte) Option {
}
// WithSigningKey sets the signing key and algorithm in the config.
func WithSigningKey(signingKey string) Option {
func WithSigningKey(signingKey []byte) Option {
return func(cfg *evaluatorConfig) {
cfg.signingKey = signingKey
}

8
authorize/evaluator/evaluator.go
View file

@ -223,7 +223,7 @@ func (e *Evaluator) updateStore(cfg *evaluatorConfig) error {
func getJWK(cfg *evaluatorConfig) (*jose.JSONWebKey, error) {
var decodedCert []byte
// if we don't have a signing key, generate one
if cfg.signingKey == "" {
if len(cfg.signingKey) == 0 {
key, err := cryptutil.NewSigningKey()
if err != nil {
return nil, fmt.Errorf("couldn't generate signing key: %w", err)
@ -233,11 +233,7 @@ func getJWK(cfg *evaluatorConfig) (*jose.JSONWebKey, error) {
return nil, fmt.Errorf("bad signing key: %w", err)
}
} else {
var err error
decodedCert, err = base64.StdEncoding.DecodeString(cfg.signingKey)
if err != nil {
return nil, fmt.Errorf("bad signing key: %w", err)
}
decodedCert = cfg.signingKey
}
jwk, err := cryptutil.PrivateJWKFromBytes(decodedCert)