search

bloomberg / vault-auth-spire

vault-auth-spire is an authentication plugin for Hashicorp Vault which allows logging into Vault using a Spire provided SVID.
Apache License 2.0
41 stars 8 forks source link

Not all required X509-SVID validations are taking place #10

Closed dennisgove closed 4 years ago

dennisgove commented 4 years ago

Describe the bug

Not all required validations of X509 based SVIDs are taking place. Specifically, the following are not happening:

Per a conversation in the SPIFFE Slack workspace (#spire channel) the current thinking is that these validations should take place in the go-spiffe::VerifyPeerCertificate method. Issue https://github.com/spiffe/go-spiffe/issues/25 has been created on that project to track the addition of those validations.

This ticket will ensure one of the following occurs:

  1. Validations are added to VerifyPeerCertificates (https://github.com/spiffe/go-spiffe/issues/25) and our dependency is changed to require at least the version with those validations.
  2. The validations are added to this project (perhaps as a stopgap while waiting for closure of https://github.com/spiffe/go-spiffe/issues/25).
pawalt commented 4 years ago

Resolved: https://github.com/spiffe/go-spiffe/issues/25