3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-19 09:38:03 +02:00
Code Issues Projects Releases Packages Wiki Activity

options: support multiple signing keys

Browse source
This commit is contained in:
Caleb Doxsey 2022-12-20 11:11:52 -07:00
parent c048af7523
commit 41b51d04ef
12 changed files with 223 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

15
internal/handlers/jwks.go
View file

@ -2,7 +2,6 @@ package handlers
import (
"bytes"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
@ -19,23 +18,21 @@ import (
// JWKSHandler returns the /.well-known/pomerium/jwks.json handler.
func JWKSHandler(
rawSigningKey string,
signingKey []byte,
additionalKeys ...any,
) http.Handler {
return cors.AllowAll().Handler(httputil.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
var jwks struct {
Keys []any `json:"keys"`
}
if rawSigningKey != "" {
decodedCert, err := base64.StdEncoding.DecodeString(rawSigningKey)
if err != nil {
return httputil.NewError(http.StatusInternalServerError, errors.New("bad base64 encoding for signing key"))
}
jwk, err := cryptutil.PublicJWKFromBytes(decodedCert)
if len(signingKey) > 0 {
ks, err := cryptutil.PublicJWKsFromBytes(signingKey)
if err != nil {
return httputil.NewError(http.StatusInternalServerError, errors.New("bad signing key"))
}
jwks.Keys = append(jwks.Keys, *jwk)
for _, k := range ks {
jwks.Keys = append(jwks.Keys, *k)
}
}
jwks.Keys = append(jwks.Keys, additionalKeys...)