In our organization we use a custom Certificate Authority (CA) with Subject Alternative Names (SANs) for authentication and authorization. This is combined with mutual TLS (2-way).
In the AccessControl implementation we need to have access to the certificate of the peer so that we can assign a role.
Currently the AccessControl interface only provides a couple properties of the request metadata (depending on the node).
Possible Implementation
In our fork we have modified the AccessControl interface to permit passing an optional Request object in a backwards compatible manner. This allows for accessing more properties than just the peer certificate and can also be used for a variety of other authentication strategies.
I can open a draft PR with the required changes for further discussion.
Why
AccessControl
implementation we need to have access to the certificate of the peer so that we can assign a role.AccessControl
interface only provides a couple properties of the request metadata (depending on the node).Possible Implementation
AccessControl
interface to permit passing an optionalRequest
object in a backwards compatible manner. This allows for accessing more properties than just the peer certificate and can also be used for a variety of other authentication strategies.I can open a draft PR with the required changes for further discussion.