Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance httpBasicPassTicket authentication scheme to support client certificates #2071

Closed
yelyzavetachebanova opened this issue Feb 4, 2022 · 2 comments
Assignees
Labels
enhancement New feature or request

Comments

@yelyzavetachebanova
Copy link
Contributor

yelyzavetachebanova commented Feb 4, 2022

Describe the solution you'd like
Enhance httpBasicPassTicket authentication scheme to be able to generate passticket based on client certificate.

Additional context
Current implementation for Zowe JWT token generates passticket based on userId from token. Desired implementation should be able to generate passticket for a user authenticated with client certificate.

@yelyzavetachebanova yelyzavetachebanova added enhancement New feature or request new New issue that has not been worked on yet 22PI1 labels Feb 4, 2022
@yelyzavetachebanova
Copy link
Contributor Author

Part of the implementation is a validation whether a client certificate belong to a MF user (user mapping)

@anton-brezina anton-brezina removed the new New issue that has not been worked on yet label Feb 9, 2022
@yelyzavetachebanova
Copy link
Contributor Author

Note: current implementation of HttpBasicPassTicketScheme.createCommand(...) performs parsing of the authentication source and uses userID from parsed source to generate PassTicket.

One of the parsing steps is a validation whether X509 certificate can be used for client client authentication. If not (extended key usage does not have clientAuth specified) commonName (and userId) is set to null.

Make sure to handle possible NPE during pass ticket generation.

Possible solution is to perform validation of the authentication source before parsing, so that InvalidCertificateException is throws by AbstractX509AuthSourceService and processed by ServiceAuthenticationFilter.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants