Examples with XfccSourceConfig keywhiz.service.config.XfccSourceConfig used on opensource projects

Example 1 with XfccSourceConfig

use of keywhiz.service.config.XfccSourceConfig in project keywhiz by square.

the class ClientAuthFactory method doProvide.

private Client doProvide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) {
    // Check whether this port is configured to be used by a proxy.
    // If this configuration is present, traffic on this port _must_
    // identify its clients using the x-forwarded-client-cert header or
    // caller ID header.
    // If the configuration is not present, traffic _must_ identify its
    // clients using the request's security context.
    int requestPort = httpServletRequest.getLocalPort();
    Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort);
    List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of());
    // the callerSpiffeIdHeader identifies the client.)
    if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) {
        throw new NotAuthorizedException(format("Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME));
    }
    // Extract information about the entity that connected directly to Keywhiz.
    // This must be identified from the request's security context, rather than
    // easily modified information like a header.
    // 
    // This entity may be a Keywhiz client, or it may be a proxy
    // forwarding the real Keywhiz client information.
    Principal connectedPrincipal = getPrincipal(containerRequest).orElseThrow(() -> new NotAuthorizedException("Not authorized as Keywhiz client"));
    setTag("principal", connectedPrincipal.getName());
    // on the security context of this request
    if (possibleXfccConfig.isEmpty()) {
        // identify the client
        return authenticateClientFromPrincipal(connectedPrincipal);
    } else {
        // Use either the XFCC header or a caller-ID header to identify the client.
        return authenticateClientFromForwardedData(possibleXfccConfig.get(), xfccHeaderValues, connectedPrincipal, containerRequest);
    }
}