Skip to content

wire SkipValidation further into SCEP provisioner #1991

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

wire SkipValidation further into SCEP provisioner #1991

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions authority/authority.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -711,8 +711,9 @@ func (a *Authority) init() error {
case a.requiresSCEP() && a.GetSCEP() == nil:
if a.scepOptions == nil {
options := &scep.Options{
Roots: a.rootX509Certs,
Intermediates: a.intermediateX509Certs,
Roots: a.rootX509Certs,
Intermediates: a.intermediateX509Certs,
SkipValidation: a.config.SkipSCEPValidation,
}

// intermediate certificates can be empty in RA mode
Expand Down
41 changes: 21 additions & 20 deletions authority/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,26 +65,27 @@ var (

// Config represents the CA configuration and it's mapped to a JSON object.
type Config struct {
Root multiString `json:"root"`
FederatedRoots []string `json:"federatedRoots"`
IntermediateCert string `json:"crt"`
IntermediateKey string `json:"key"`
Address string `json:"address"`
InsecureAddress string `json:"insecureAddress"`
DNSNames []string `json:"dnsNames"`
KMS *kms.Options `json:"kms,omitempty"`
SSH *SSHConfig `json:"ssh,omitempty"`
Logger json.RawMessage `json:"logger,omitempty"`
DB *db.Config `json:"db,omitempty"`
Monitoring json.RawMessage `json:"monitoring,omitempty"`
AuthorityConfig *AuthConfig `json:"authority,omitempty"`
TLS *TLSOptions `json:"tls,omitempty"`
Password string `json:"password,omitempty"`
Templates *templates.Templates `json:"templates,omitempty"`
CommonName string `json:"commonName,omitempty"`
CRL *CRLConfig `json:"crl,omitempty"`
MetricsAddress string `json:"metricsAddress,omitempty"`
SkipValidation bool `json:"-"`
Root multiString `json:"root"`
FederatedRoots []string `json:"federatedRoots"`
IntermediateCert string `json:"crt"`
IntermediateKey string `json:"key"`
Address string `json:"address"`
InsecureAddress string `json:"insecureAddress"`
DNSNames []string `json:"dnsNames"`
KMS *kms.Options `json:"kms,omitempty"`
SSH *SSHConfig `json:"ssh,omitempty"`
Logger json.RawMessage `json:"logger,omitempty"`
DB *db.Config `json:"db,omitempty"`
Monitoring json.RawMessage `json:"monitoring,omitempty"`
AuthorityConfig *AuthConfig `json:"authority,omitempty"`
TLS *TLSOptions `json:"tls,omitempty"`
Password string `json:"password,omitempty"`
Templates *templates.Templates `json:"templates,omitempty"`
CommonName string `json:"commonName,omitempty"`
CRL *CRLConfig `json:"crl,omitempty"`
MetricsAddress string `json:"metricsAddress,omitempty"`
SkipValidation bool `json:"-"`
SkipSCEPValidation bool `json:"-"`

// Keeps record of the filename the Config is read from
loadedFromFilepath string
Expand Down
4 changes: 4 additions & 0 deletions scep/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ type Options struct {
// are used to be able to load the provisioners when the SCEP authority is being
// validated.
SCEPProvisionerNames []string
// SkipValidation is used to skip the validation of the SCEP options.
SkipValidation bool
}

type comparablePublicKey interface {
Expand All @@ -35,6 +37,8 @@ type comparablePublicKey interface {
// Validate checks the fields in Options.
func (o *Options) Validate() error {
switch {
case o.SkipValidation:
return nil
case len(o.Intermediates) == 0:
return errors.New("no intermediate certificate available for SCEP authority")
case o.SignerCert == nil:
Expand Down