gogrlx/nats-server
1
0
Fork 0
mirror of https://github.com/gogrlx/nats-server.git synced 2026-04-15 18:50:41 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add support for subjects with multi value RDN

Browse Source 
Signed-off-by: Waldemar Quevedo <wally@synadia.com>
This commit is contained in:
Waldemar Quevedo
2020-11-20 14:58:34 -08:00
parent 4029650740
commit 886ecf7f89
5 changed files with 170 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/auth.go
View File

@@ -419,7 +419,7 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) boo
} else if hasUsers {
// Check if we are tls verify and are mapping users from the client_certificate.
if tlsMap {
authorized := checkClientTLSCertSubject(c, func(u string, certRDN *ldap.DN, _ bool) (string, bool) {
authorized := checkClientTLSCertSubject(c, func(u string, certDN *ldap.DN, _ bool) (string, bool) {
// First do literal lookup using the resulting string representation
// of RDNSequence as implemented by the pkix package from Go.
if u != "" {
@@ -431,7 +431,7 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) boo
return usr.Username, ok
}
if certRDN == nil {
if certDN == nil {
return "", false
}
@@ -443,11 +443,11 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) boo
}
// TODO: Use this utility to make a full validation pass
// on start in case tlsmap feature is being used.
inputRDN, err := ldap.ParseDN(usr.Username)
inputDN, err := ldap.ParseDN(usr.Username)
if err != nil {
continue
}
if inputRDN.Equal(certRDN) {
if inputDN.Equal(certDN) {
user = usr
return usr.Username, true
}
@@ -724,8 +724,9 @@ func checkClientTLSCertSubject(c *client, fn tlsMapAuthFn) bool {
// the domain components in case there are any.
rdn := cert.Subject.ToRDNSequence().String()
// Match that follows original order from the subject takes precedence.
dn, err := ldap.FromCertSubject(cert.Subject)
// Match using the raw subject to avoid ignoring attributes.
// https://github.com/golang/go/issues/12342
dn, err := ldap.FromRawCertSubject(cert.RawSubject)
if err == nil {
if match, ok := fn("", dn, false); ok {
c.Debugf("Using DistinguishedNameMatch for auth [%q]", match)