Skip to content

Commit 72063bd

Browse files
javorszkyjavorszky
committed
Move SNI into JwksURI struct
1 parent bc3b54f commit 72063bd

File tree

8 files changed

+102
-102
lines changed

8 files changed

+102
-102
lines changed

‎internal/configs/version2/http.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -428,22 +428,22 @@ func (rl LimitReqOptions) String() string {
428428

429429
// JWTAuth holds JWT authentication configuration.
430430
type JWTAuth struct {
431-
Key string
432-
Secret string
433-
Realm string
434-
Token string
435-
KeyCache string
436-
JwksSNIName string
437-
JwksSNIEnabled bool
438-
JwksURI JwksURI
431+
Key string
432+
Secret string
433+
Realm string
434+
Token string
435+
KeyCache string
436+
JwksURI JwksURI
439437
}
440438

441439
// JwksURI defines the components of a JwksURI
442440
type JwksURI struct {
443-
JwksScheme string
444-
JwksHost string
445-
JwksPort string
446-
JwksPath string
441+
JwksScheme string
442+
JwksHost string
443+
JwksPort string
444+
JwksPath string
445+
JwksSNIName string
446+
JwksSNIEnabled bool
447447
}
448448

449449
// BasicAuth refers to basic HTTP authentication mechanism options

‎internal/configs/version2/nginx-plus.virtualserver.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -236,13 +236,13 @@ server {
236236
proxy_cache jwks_uri_{{ $s.VSName }};
237237
proxy_cache_valid 200 12h;
238238
{{- end }}
239+
{{- with .JwksURI }}
239240
{{- if .JwksSNIEnabled }}
240241
proxy_ssl_server_name on;
241242
{{- if .JwksSNIName }}
242243
proxy_ssl_name {{ .JwksSNIName }};
243244
{{- end }}
244245
{{- end }}
245-
{{- with .JwksURI }}
246246
proxy_set_header Host {{ .JwksHost }};
247247
set $idp_backend {{ .JwksHost }};
248248
proxy_pass {{ .JwksScheme}}://$idp_backend{{ if .JwksPort }}:{{ .JwksPort }}{{ end }}{{ .JwksPath }};

‎internal/configs/version2/templates_test.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2349,17 +2349,17 @@ var (
23492349
Server: Server{
23502350
JWTAuthList: map[string]*JWTAuth{
23512351
"default/jwt-policy": {
2352-
Key: "default/jwt-policy",
2353-
Realm: "Spec Realm API",
2354-
Token: "$http_token",
2355-
KeyCache: "1h",
2356-
JwksSNIEnabled: true,
2357-
JwksSNIName: "sni.idp.spec.example.com",
2352+
Key: "default/jwt-policy",
2353+
Realm: "Spec Realm API",
2354+
Token: "$http_token",
2355+
KeyCache: "1h",
23582356
JwksURI: JwksURI{
2359-
JwksScheme: "https",
2360-
JwksHost: "idp.spec.example.com",
2361-
JwksPort: "443",
2362-
JwksPath: "/spec-keys",
2357+
JwksScheme: "https",
2358+
JwksHost: "idp.spec.example.com",
2359+
JwksPort: "443",
2360+
JwksPath: "/spec-keys",
2361+
JwksSNIEnabled: true,
2362+
JwksSNIName: "sni.idp.spec.example.com",
23632363
},
23642364
},
23652365
"default/jwt-policy-route": {

‎internal/configs/virtualserver.go

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1169,20 +1169,20 @@ func (p *policiesCfg) addJWTAuthConfig(
11691169
uri, _ := url.Parse(jwtAuth.JwksURI)
11701170

11711171
JwksURI := &version2.JwksURI{
1172-
JwksScheme: uri.Scheme,
1173-
JwksHost: uri.Hostname(),
1174-
JwksPort: uri.Port(),
1175-
JwksPath: uri.Path,
1172+
JwksScheme: uri.Scheme,
1173+
JwksHost: uri.Hostname(),
1174+
JwksPort: uri.Port(),
1175+
JwksPath: uri.Path,
1176+
JwksSNIName: jwtAuth.SNIName,
1177+
JwksSNIEnabled: jwtAuth.SNIEnabled,
11761178
}
11771179

11781180
p.JWTAuth.Auth = &version2.JWTAuth{
1179-
Key: polKey,
1180-
JwksURI: *JwksURI,
1181-
Realm: jwtAuth.Realm,
1182-
Token: jwtAuth.Token,
1183-
KeyCache: jwtAuth.KeyCache,
1184-
JwksSNIEnabled: jwtAuth.SNIEnabled,
1185-
JwksSNIName: jwtAuth.SNIServerName,
1181+
Key: polKey,
1182+
JwksURI: *JwksURI,
1183+
Realm: jwtAuth.Realm,
1184+
Token: jwtAuth.Token,
1185+
KeyCache: jwtAuth.KeyCache,
11861186
}
11871187
p.JWTAuth.JWKSEnabled = true
11881188
return res

‎internal/configs/virtualserver_test.go

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -5641,11 +5641,11 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
56415641
},
56425642
Spec: conf_v1.PolicySpec{
56435643
JWTAuth: &conf_v1.JWTAuth{
5644-
Realm: "Spec Realm API",
5645-
JwksURI: "https://idp.spec.example.com:443/spec-keys",
5646-
KeyCache: "1h",
5647-
SNIEnabled: true,
5648-
SNIServerName: "idp.spec.example.com",
5644+
Realm: "Spec Realm API",
5645+
JwksURI: "https://idp.spec.example.com:443/spec-keys",
5646+
KeyCache: "1h",
5647+
SNIEnabled: true,
5648+
SNIName: "idp.spec.example.com",
56495649
},
56505650
},
56515651
},
@@ -5711,16 +5711,16 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
57115711
Server: version2.Server{
57125712
JWTAuthList: map[string]*version2.JWTAuth{
57135713
"default/jwt-policy": {
5714-
Key: "default/jwt-policy",
5715-
Realm: "Spec Realm API",
5716-
KeyCache: "1h",
5717-
JwksSNIEnabled: true,
5718-
JwksSNIName: "idp.spec.example.com",
5714+
Key: "default/jwt-policy",
5715+
Realm: "Spec Realm API",
5716+
KeyCache: "1h",
57195717
JwksURI: version2.JwksURI{
5720-
JwksScheme: "https",
5721-
JwksHost: "idp.spec.example.com",
5722-
JwksPort: "443",
5723-
JwksPath: "/spec-keys",
5718+
JwksScheme: "https",
5719+
JwksHost: "idp.spec.example.com",
5720+
JwksPort: "443",
5721+
JwksPath: "/spec-keys",
5722+
JwksSNIEnabled: true,
5723+
JwksSNIName: "idp.spec.example.com",
57245724
},
57255725
},
57265726
"default/jwt-policy-route": {
@@ -5736,16 +5736,16 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
57365736
},
57375737
},
57385738
JWTAuth: &version2.JWTAuth{
5739-
Key: "default/jwt-policy",
5740-
Realm: "Spec Realm API",
5741-
KeyCache: "1h",
5742-
JwksSNIName: "idp.spec.example.com",
5743-
JwksSNIEnabled: true,
5739+
Key: "default/jwt-policy",
5740+
Realm: "Spec Realm API",
5741+
KeyCache: "1h",
57445742
JwksURI: version2.JwksURI{
5745-
JwksScheme: "https",
5746-
JwksHost: "idp.spec.example.com",
5747-
JwksPort: "443",
5748-
JwksPath: "/spec-keys",
5743+
JwksScheme: "https",
5744+
JwksHost: "idp.spec.example.com",
5745+
JwksPort: "443",
5746+
JwksPath: "/spec-keys",
5747+
JwksSNIName: "idp.spec.example.com",
5748+
JwksSNIEnabled: true,
57495749
},
57505750
},
57515751
JWKSAuthEnabled: true,

‎pkg/apis/configuration/v1/types.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -652,13 +652,13 @@ type VariableCondition struct {
652652

653653
// JWTAuth holds JWT authentication configuration.
654654
type JWTAuth struct {
655-
Realm string `json:"realm"`
656-
Secret string `json:"secret"`
657-
Token string `json:"token"`
658-
JwksURI string `json:"jwksURI"`
659-
KeyCache string `json:"keyCache"`
660-
SNIEnabled bool `json:"sniEnabled"`
661-
SNIServerName string `json:"sniName"`
655+
Realm string `json:"realm"`
656+
Secret string `json:"secret"`
657+
Token string `json:"token"`
658+
JwksURI string `json:"jwksURI"`
659+
KeyCache string `json:"keyCache"`
660+
SNIEnabled bool `json:"sniEnabled"`
661+
SNIName string `json:"sniName"`
662662
}
663663

664664
// BasicAuth holds HTTP Basic authentication configuration

‎pkg/apis/configuration/validation/policy.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -216,18 +216,18 @@ func validateJWT(jwt *v1.JWTAuth, fieldPath *field.Path) field.ErrorList {
216216
}
217217

218218
// if SNI server name is provided, but SNI is not enabled, return an error
219-
if jwt.SNIServerName != "" && !jwt.SNIEnabled {
219+
if jwt.SNIName != "" && !jwt.SNIEnabled {
220220
allErrs = append(allErrs, field.Forbidden(fieldPath.Child("sniServerName"), "sniServerName can only be set when sniEnabled is true"))
221221
}
222222

223223
// if SNI is enabled and SNI server name is provided, make sure it's a valid URI
224-
if jwt.SNIEnabled && jwt.SNIServerName != "" {
225-
err := validation2.ValidateURI(jwt.SNIServerName,
224+
if jwt.SNIEnabled && jwt.SNIName != "" {
225+
err := validation2.ValidateURI(jwt.SNIName,
226226
validation2.WithAllowedSchemes("https"),
227227
validation2.WithUserAllowed(false),
228228
validation2.WithDefaultScheme("https"))
229229
if err != nil {
230-
allErrs = append(allErrs, field.Invalid(fieldPath.Child("sniServerName"), jwt.SNIServerName, "sniServerName is not a valid URI"))
230+
allErrs = append(allErrs, field.Invalid(fieldPath.Child("sniServerName"), jwt.SNIName, "sniServerName is not a valid URI"))
231231
}
232232
}
233233
}

‎pkg/apis/configuration/validation/policy_test.go

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,10 @@ func TestValidatePolicy_JWTIsNotValidOn(t *testing.T) {
100100
policy: &v1.Policy{
101101
Spec: v1.PolicySpec{
102102
JWTAuth: &v1.JWTAuth{
103-
Realm: "My Product API",
104-
JwksURI: "https://myjwksuri.com",
105-
KeyCache: "1h",
106-
SNIServerName: "ipd.org",
103+
Realm: "My Product API",
104+
JwksURI: "https://myjwksuri.com",
105+
KeyCache: "1h",
106+
SNIName: "ipd.org",
107107
},
108108
},
109109
},
@@ -113,11 +113,11 @@ func TestValidatePolicy_JWTIsNotValidOn(t *testing.T) {
113113
policy: &v1.Policy{
114114
Spec: v1.PolicySpec{
115115
JWTAuth: &v1.JWTAuth{
116-
Realm: "My Product API",
117-
JwksURI: "https://myjwksuri.com",
118-
KeyCache: "1h",
119-
SNIEnabled: true,
120-
SNIServerName: "msql://ipd.org",
116+
Realm: "My Product API",
117+
JwksURI: "https://myjwksuri.com",
118+
KeyCache: "1h",
119+
SNIEnabled: true,
120+
SNIName: "msql://ipd.org",
121121
},
122122
},
123123
},
@@ -209,11 +209,11 @@ func TestValidatePolicy_IsValidOnJWTPolicy(t *testing.T) {
209209
policy: &v1.Policy{
210210
Spec: v1.PolicySpec{
211211
JWTAuth: &v1.JWTAuth{
212-
Realm: "My Product API",
213-
KeyCache: "1h",
214-
JwksURI: "https://login.mydomain.com/keys",
215-
SNIEnabled: true,
216-
SNIServerName: "https://example.org",
212+
Realm: "My Product API",
213+
KeyCache: "1h",
214+
JwksURI: "https://login.mydomain.com/keys",
215+
SNIEnabled: true,
216+
SNIName: "https://example.org",
217217
},
218218
},
219219
},
@@ -843,12 +843,12 @@ func TestValidateJWT_PassesOnValidInput(t *testing.T) {
843843
},
844844
{
845845
jwt: &v1.JWTAuth{
846-
Realm: "My Product API",
847-
Token: "$cookie_auth_token",
848-
JwksURI: "https://idp.com/token",
849-
KeyCache: "1h",
850-
SNIEnabled: true,
851-
SNIServerName: "https://ipd.com:9999",
846+
Realm: "My Product API",
847+
Token: "$cookie_auth_token",
848+
JwksURI: "https://idp.com/token",
849+
KeyCache: "1h",
850+
SNIEnabled: true,
851+
SNIName: "https://ipd.com:9999",
852852
},
853853
msg: "SNI enabled and valid SNI server name",
854854
},
@@ -967,30 +967,30 @@ func TestValidateJWT_FailsOnInvalidInput(t *testing.T) {
967967
},
968968
{
969969
jwt: &v1.JWTAuth{
970-
Realm: "My Product api",
971-
JwksURI: "https://idp.com/token",
972-
KeyCache: "1h",
973-
SNIEnabled: true,
974-
SNIServerName: "msql://not-\\\\a-valid-sni",
970+
Realm: "My Product api",
971+
JwksURI: "https://idp.com/token",
972+
KeyCache: "1h",
973+
SNIEnabled: true,
974+
SNIName: "msql://not-\\\\a-valid-sni",
975975
},
976976
msg: "invalid SNI server name",
977977
},
978978
{
979979
jwt: &v1.JWTAuth{
980-
Realm: "My Product api",
981-
JwksURI: "https://idp.com/token",
982-
KeyCache: "1h",
983-
SNIEnabled: false,
984-
SNIServerName: "https://idp.com",
980+
Realm: "My Product api",
981+
JwksURI: "https://idp.com/token",
982+
KeyCache: "1h",
983+
SNIEnabled: false,
984+
SNIName: "https://idp.com",
985985
},
986986
msg: "SNI server name passed, SNI not enabled",
987987
},
988988
{
989989
jwt: &v1.JWTAuth{
990-
Realm: "My Product api",
991-
JwksURI: "https://idp.com/token",
992-
KeyCache: "1h",
993-
SNIServerName: "https://idp.com",
990+
Realm: "My Product api",
991+
JwksURI: "https://idp.com/token",
992+
KeyCache: "1h",
993+
SNIName: "https://idp.com",
994994
},
995995
msg: "SNI server name passed, SNI not passed",
996996
},

0 commit comments

Comments
 (0)