Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

envoy: add a filter to store client cert info #4372

Merged
merged 2 commits into from
Jul 19, 2023
Merged

envoy: add a filter to store client cert info #4372

merged 2 commits into from
Jul 19, 2023

Commits on Jul 19, 2023

  1. envoy: add a filter to store client cert info 

    Add a new Lua filter that will store client certificate info as dynamic
metadata. This will allow us to configure client certificate validation
at the Envoy listener level, and then pass the results of that
validation into our ExtAuthz service.

This also allows us to pass the entire client certificate chain (and not
just the leaf certificate, which is how the 'include_peer_certificate'
ExtAuthz setting behaves). This will allow us to add support for
intermediate CA certificates supplied by the client.

However, if a client certificate does not validate successfully by
Envoy, we will not store the certificate chain. (This should help guard
against any possibility of making policy decisions based on unvalidated
client certificate data.)
    @kenjenkins
    kenjenkins committed Jul 19, 2023
    Configuration menu
    Copy the full SHA
    46817c6 View commit details
    Browse the repository at this point in the history

  2. remove trailing whitespace

    @kenjenkins
    kenjenkins committed Jul 19, 2023
    Configuration menu
    Copy the full SHA
    8f0fe64 View commit details
    Browse the repository at this point in the history