38802c2184
- Setting a Secret in the supervisor's namespace with a special name will cause it to get picked up and served as the supervisor's TLS cert for any request which does not have a matching SNI cert. - This is especially useful for when there is no DNS record for an issuer and the user will be accessing it via IP address. This is not how we would expect it to be used in production, but it might be useful for other cases. - Includes a new integration test - Also suppress all of the warnings about ignoring the error returned by Close() in lines like `defer x.Close()` to make GoLand happier
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
// Copyright 2020 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package provider
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"sync"
|
|
)
|
|
|
|
type DynamicTLSCertProvider interface {
|
|
SetIssuerHostToTLSCertMap(issuerToJWKSMap map[string]*tls.Certificate)
|
|
SetDefaultTLSCert(certificate *tls.Certificate)
|
|
GetTLSCert(lowercaseIssuerHostName string) *tls.Certificate
|
|
GetDefaultTLSCert() *tls.Certificate
|
|
}
|
|
|
|
type dynamicTLSCertProvider struct {
|
|
issuerHostToTLSCertMap map[string]*tls.Certificate
|
|
defaultCert *tls.Certificate
|
|
mutex sync.RWMutex
|
|
}
|
|
|
|
func NewDynamicTLSCertProvider() DynamicTLSCertProvider {
|
|
return &dynamicTLSCertProvider{
|
|
issuerHostToTLSCertMap: map[string]*tls.Certificate{},
|
|
}
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) SetIssuerHostToTLSCertMap(issuerHostToTLSCertMap map[string]*tls.Certificate) {
|
|
p.mutex.Lock() // acquire a write lock
|
|
defer p.mutex.Unlock()
|
|
p.issuerHostToTLSCertMap = issuerHostToTLSCertMap
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) SetDefaultTLSCert(certificate *tls.Certificate) {
|
|
p.mutex.Lock() // acquire a write lock
|
|
defer p.mutex.Unlock()
|
|
p.defaultCert = certificate
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) GetTLSCert(issuerHostName string) *tls.Certificate {
|
|
p.mutex.RLock() // acquire a read lock
|
|
defer p.mutex.RUnlock()
|
|
return p.issuerHostToTLSCertMap[issuerHostName]
|
|
}
|
|
|
|
func (p *dynamicTLSCertProvider) GetDefaultTLSCert() *tls.Certificate {
|
|
p.mutex.RLock() // acquire a read lock
|
|
defer p.mutex.RUnlock()
|
|
return p.defaultCert
|
|
}
|