3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-07 11:58:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

authorize: add "client-certificate-required" reason

Browse source 
Add a new reason "client-certificate-required" that will be returned by
the invalid_client_certificate criterion in the case that no client
certificate was provided. Determine this using the new 'presented' field
populated from the Envoy metadata.
This commit is contained in:
Kenneth Jenkins 2023-07-21 17:29:07 -07:00
parent 4698e4661a
commit f6042ce76a
8 changed files with 202 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

15
authorize/check_response_test.go
View file

@ -89,7 +89,7 @@ func TestAuthorize_handleResult(t *testing.T) {
})
})
t.Run("invalid-client-certificate", func(t *testing.T) {
// Even if the user is unauthenticated, if a client certificate was required and no valid
// Even if the user is unauthenticated, if a client certificate was required and an invalid
// certificate was provided, access should be denied (no login redirect).
res, err := a.handleResult(context.Background(),
&envoy_service_auth_v3.CheckRequest{},
@ -101,6 +101,19 @@ func TestAuthorize_handleResult(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, 495, int(res.GetDeniedResponse().GetStatus().GetCode()))
})
t.Run("client-certificate-required", func(t *testing.T) {
// Likewise, if a client certificate was required and no certificate
// was presented, access should be denied (no login redirect).
res, err := a.handleResult(context.Background(),
&envoy_service_auth_v3.CheckRequest{},
&evaluator.Request{},
&evaluator.Result{
Allow: evaluator.NewRuleResult(false, criteria.ReasonUserUnauthenticated),
Deny: evaluator.NewRuleResult(true, criteria.ReasonClientCertificateRequired),
})
assert.NoError(t, err)
assert.Equal(t, 495, int(res.GetDeniedResponse().GetStatus().GetCode()))
})
}
func TestAuthorize_okResponse(t *testing.T) {