search

akka / akka-http

The Streaming-first HTTP server/module of Akka
https://doc.akka.io/docs/akka-http
Other
1.34k stars 594 forks source link

feat: Client TLS identity extraction and assertion directives #4360

Closed johanandren closed 6 months ago

johanandren commented 7 months ago

@jroper would be great if you could take a peek at the directives and see if this is something that you envisioned, or tell me if I'm completely off.

johanandren commented 7 months ago

After thinking about it a bit: I guess a single "require" directive that matches on CN and SAN would maybe make more sense than the separate ones I've created now. And maybe also extractors the values for arbitrary logic, and pulling those back to utilities that we can use from Akka gRPC as well.

jroper commented 6 months ago

It looks good to me. It's really hard to say what we should provide in terms of matching the CN vs SAN. Common Names have been deprecated for HTTPS server certificates for almost 25 years. But for client certificates, there's just no standard out there as to what a client certificate should use to identify itself. I think most common would be some sort of DNS value, but should that be in the CN or the SAN?

I think a simple API that matches both CN and SAN may satisfy 95+% of use cases, and a lower level power API will deal with the rest - the directive to extract the certificate is probably enough.

johanandren commented 6 months ago

Ready for final review