awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-18 17:41:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated frontend to have the tls cert auth login

Browse Source
This commit is contained in:
=
2025-06-25 14:26:55 +05:30
parent b80b77ec36
commit 4bd62aa462
18 changed files with 777 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
+7 -1
View File
@@ -11,6 +11,7 @@ import {
validatePrivilegeChangeOperation
} from "@app/ee/services/permission/permission-fns";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -81,7 +82,12 @@ export const identityTlsCertAuthServiceFactory = ({
cipherTextBlob: identityTlsCertAuth.encryptedCaCertificate
}).toString();
const clientCertificateX509 = new crypto.X509Certificate(Buffer.from(clientCertificate));
const leafCertificate = extractX509CertFromChain(decodeURIComponent(clientCertificate))?.[0];
if (!leafCertificate) {
throw new BadRequestError({ message: "Missing client certificate" });
}
const clientCertificateX509 = new crypto.X509Certificate(leafCertificate);
const caCertificateX509 = new crypto.X509Certificate(caCertificate);
const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey);
backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-types.ts
+2 -2
View File
@@ -9,7 +9,7 @@ export type TLoginTlsCertAuthDTO = {
export type TAttachTlsCertAuthDTO = {
identityId: string;
caCertificate: string;
allowedCommonNames?: string;
allowedCommonNames?: string | null;
accessTokenTTL: number;
accessTokenMaxTTL: number;
accessTokenNumUsesLimit: number;
@@ -20,7 +20,7 @@ export type TAttachTlsCertAuthDTO = {
export type TUpdateTlsCertAuthDTO = {
identityId: string;
caCertificate?: string;
allowedCommonNames?: string;
allowedCommonNames?: string | null;
accessTokenTTL?: number;
accessTokenMaxTTL?: number;
accessTokenNumUsesLimit?: number;