mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-02-14 18:10:17 +00:00
ae5aad178d
and also audit logs both the NotBefore and NotAfter of the issued cert. Implemented by changing the return type of the cert issuer helpers to make them also return the NotBefore and NotAfter values of the new cert, along with the key PEM and cert PEM.
58 lines
1.3 KiB
Go
58 lines
1.3 KiB
Go
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package clientcertissuer
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
utilerrors "k8s.io/apimachinery/pkg/util/errors"
|
|
|
|
"go.pinniped.dev/internal/cert"
|
|
"go.pinniped.dev/internal/constable"
|
|
)
|
|
|
|
const defaultCertIssuerErr = constable.Error("failed to issue cert")
|
|
|
|
type ClientCertIssuer interface {
|
|
Name() string
|
|
IssueClientCertPEM(username string, groups []string, ttl time.Duration) (pem *cert.PEM, err error)
|
|
}
|
|
|
|
var _ ClientCertIssuer = ClientCertIssuers{}
|
|
|
|
type ClientCertIssuers []ClientCertIssuer
|
|
|
|
func (c ClientCertIssuers) Name() string {
|
|
if len(c) == 0 {
|
|
return "empty-client-cert-issuers"
|
|
}
|
|
|
|
names := make([]string, 0, len(c))
|
|
for _, issuer := range c {
|
|
names = append(names, issuer.Name())
|
|
}
|
|
|
|
return strings.Join(names, ",")
|
|
}
|
|
|
|
func (c ClientCertIssuers) IssueClientCertPEM(username string, groups []string, ttl time.Duration) (*cert.PEM, error) {
|
|
errs := make([]error, 0, len(c))
|
|
|
|
for _, issuer := range c {
|
|
pem, err := issuer.IssueClientCertPEM(username, groups, ttl)
|
|
if err == nil {
|
|
return pem, nil
|
|
}
|
|
errs = append(errs, fmt.Errorf("%s failed to issue client cert: %w", issuer.Name(), err))
|
|
}
|
|
|
|
if err := utilerrors.NewAggregate(errs); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return nil, defaultCertIssuerErr
|
|
}
|