mirror of
https://github.com/pomerium/pomerium.git
synced 2025-07-19 09:38:03 +02:00
36ba83a6b0
Configure Envoy to validate client certificates, using the union of all relevant client CA bundles (that is, a bundle of the main client CA setting together with all per-route client CAs). Pass the validation status from Envoy through to the authorize service, by configuring Envoy to use the newly-added SetClientCertificateMetadata filter, and by also adding the relevant metadata namespace to the ExtAuthz configuration. Remove the existing 'include_peer_certificate' setting from the ExtAuthz configuration, as the metadata from the Lua filter will include the full certificate chain (when it validates successfully by Envoy). Update policy evaluation to consider the validation status from Envoy, in addition to its own certificate chain validation. (Policy evaluation cannot rely solely on the Envoy validation status while we still support the per-route client CA setting.) |
||
|---|---|---|
| .. | ||
| opa | ||
| config.go | ||
| evaluator.go | ||
| evaluator_test.go | ||
| functions.go | ||
| functions_test.go | ||
| google_cloud_serverless.go | ||
| google_cloud_serverless_test.go | ||
| headers_evaluator.go | ||
| headers_evaluator_test.go | ||
| policy_evaluator.go | ||
| policy_evaluator_test.go | ||