awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-20 12:38:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated frontend to have the tls cert auth login

Browse Source
This commit is contained in:
=
2025-06-25 14:26:55 +05:30
parent b80b77ec36
commit 4bd62aa462
18 changed files with 777 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
+7 -1
View File
@@ -11,6 +11,7 @@ import {
validatePrivilegeChangeOperation
} from "@app/ee/services/permission/permission-fns";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -81,7 +82,12 @@ export const identityTlsCertAuthServiceFactory = ({
cipherTextBlob: identityTlsCertAuth.encryptedCaCertificate
}).toString();
const clientCertificateX509 = new crypto.X509Certificate(Buffer.from(clientCertificate));
const leafCertificate = extractX509CertFromChain(decodeURIComponent(clientCertificate))?.[0];
if (!leafCertificate) {
throw new BadRequestError({ message: "Missing client certificate" });
}
const clientCertificateX509 = new crypto.X509Certificate(leafCertificate);
const caCertificateX509 = new crypto.X509Certificate(caCertificate);
const isValidCertificate = clientCertificateX509.verify(caCertificateX509.publicKey);