Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wire SkipValidation further into SCEP provisioner #1991

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

wire SkipValidation further into SCEP provisioner #1991

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c13b180
wire SkipValidation further into SCEP provisioner
mishaslavin Sep 10, 2024
6d9fa64
Changing to SkipSCEPValidation & addressing code
mishaslavin Sep 23, 2024
58bc8aa
formatting
mishaslavin Sep 23, 2024
4888a60
formatting
mishaslavin Sep 23, 2024
97aeb8d
fix errant deletion
mishaslavin Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions authority/authority.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -707,8 +707,9 @@ func (a *Authority) init() error {
case a.requiresSCEP() && a.GetSCEP() == nil:
if a.scepOptions == nil {
options := &scep.Options{
Roots: a.rootX509Certs,
Intermediates: a.intermediateX509Certs,
Roots: a.rootX509Certs,
Intermediates: a.intermediateX509Certs,
SkipValidation: a.config.SkipSCEPValidation,
}

// intermediate certificates can be empty in RA mode
Expand Down
41 changes: 21 additions & 20 deletions authority/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,26 +65,27 @@ var (

// Config represents the CA configuration and it's mapped to a JSON object.
type Config struct {
Root multiString `json:"root"`
FederatedRoots []string `json:"federatedRoots"`
IntermediateCert string `json:"crt"`
IntermediateKey string `json:"key"`
Address string `json:"address"`
InsecureAddress string `json:"insecureAddress"`
DNSNames []string `json:"dnsNames"`
KMS *kms.Options `json:"kms,omitempty"`
SSH *SSHConfig `json:"ssh,omitempty"`
Logger json.RawMessage `json:"logger,omitempty"`
DB *db.Config `json:"db,omitempty"`
Monitoring json.RawMessage `json:"monitoring,omitempty"`
AuthorityConfig *AuthConfig `json:"authority,omitempty"`
TLS *TLSOptions `json:"tls,omitempty"`
Password string `json:"password,omitempty"`
Templates *templates.Templates `json:"templates,omitempty"`
CommonName string `json:"commonName,omitempty"`
CRL *CRLConfig `json:"crl,omitempty"`
MetricsAddress string `json:"metricsAddress,omitempty"`
SkipValidation bool `json:"-"`
Root multiString `json:"root"`
FederatedRoots []string `json:"federatedRoots"`
IntermediateCert string `json:"crt"`
IntermediateKey string `json:"key"`
Address string `json:"address"`
InsecureAddress string `json:"insecureAddress"`
DNSNames []string `json:"dnsNames"`
KMS *kms.Options `json:"kms,omitempty"`
SSH *SSHConfig `json:"ssh,omitempty"`
Logger json.RawMessage `json:"logger,omitempty"`
DB *db.Config `json:"db,omitempty"`
Monitoring json.RawMessage `json:"monitoring,omitempty"`
AuthorityConfig *AuthConfig `json:"authority,omitempty"`
TLS *TLSOptions `json:"tls,omitempty"`
Password string `json:"password,omitempty"`
Templates *templates.Templates `json:"templates,omitempty"`
CommonName string `json:"commonName,omitempty"`
CRL *CRLConfig `json:"crl,omitempty"`
MetricsAddress string `json:"metricsAddress,omitempty"`
SkipValidation bool `json:"-"`
SkipSCEPValidation bool `json:"-"`

// Keeps record of the filename the Config is read from
loadedFromFilepath string
Expand Down
5 changes: 4 additions & 1 deletion scep/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ type Options struct {
// are used to be able to load the provisioners when the SCEP authority is being
// validated.
SCEPProvisionerNames []string
// SkipValidation is used to skip the validation of the SCEP options.
SkipValidation bool
}

type comparablePublicKey interface {
Expand All @@ -35,8 +37,9 @@ type comparablePublicKey interface {
// Validate checks the fields in Options.
func (o *Options) Validate() error {
switch {
case o.SkipValidation:
return nil
case len(o.Intermediates) == 0:
return errors.New("no intermediate certificate available for SCEP authority")
mishaslavin marked this conversation as resolved.
Show resolved Hide resolved
case o.SignerCert == nil:
return errors.New("no signer certificate available for SCEP authority")
}
Expand Down