mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
Stephan Renatus
3286c39822
* identifier: add TLSBased This is only the identifier, the server setup still has to be done. Note that it diverges a little from what was proposed in the issue: not every client cert needs to have a CN record -- so instead, we'll use whatever is the cert's subject as client identity. * Drive-by fix: identifier_test: don't use same package for TokenBased tests. * server: require and verify client cert for AuthenticationTLS * server: allow setting CA pool via --tls-ca-cert-file * server: expose new authentication via parameter * [nit] server: simplify getListenerForHTTPServer * server_test: use httptest for integration-y TLS tests * book/security: mention TLS authn with example Signed-off-by: Stephan Renatus <srenatus@chef.io>
19 lines
1.0 KiB
Plaintext
19 lines
1.0 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIC4zCCAcugAwIBAgIJAM4DQnOYNAkCMA0GCSqGSIb3DQEBCwUAMBAxDjAMBgNV
|
|
BAMMBW15LWNhMB4XDTE5MDExMTExMjI0MFoXDTIxMTAwNzExMjI0MFowFDESMBAG
|
|
A1UEAwwJbXktc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
|
|
wLsRfXAK6EfjLNl+JPoPa0dYOigjqj3MDyMRjoYoOox0PD5oYVHQZ9vgtllihTxd
|
|
q9aHnO1eW5dZungit3OiomC9dl9OTX1mVulO0U0T6wuksHC2z/SRnmKYYCO0yNqJ
|
|
VVniZ8c6J2ZwtNUQytSMFPvOGWSK9z2jcyhoUCsg88+7xXmuKFGTHWhKBlkCg0DJ
|
|
7FjN2PXJ3osQwjTSX8z2emyTvdJI/ZYBb1z64aysBLdV3QO+PIBYzhKlVuSBWNUQ
|
|
F+JR30iUyeN8bWjMCGftLJc58bZsQsIBWcLJN+os/DWt2dvv2/TFMiwxSYKOy6rA
|
|
bsOPb0vSRKjd8Th62VOlxQIDAQABozwwOjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF
|
|
4DAgBgNVHREEGTAXgg9vcGEuZXhhbXBsZS5jb22HBH8AAAEwDQYJKoZIhvcNAQEL
|
|
BQADggEBAJq6pCjj6db/48oZoRUTdIfzpqk/cqWlvWIklVNX+2wWrZ4AGAro7G1z
|
|
ppNL9nIfBp6gO62iotFCrudlrtq1M2YaiXXBGwVPZcQjThhVp/gd+1VNUL+0PB3Z
|
|
8N5wgHch9mzMgHStfOLtwR6tFDGWXfcdIMwEHehZH5M0uQbJYEkBL5xh1DEuK0/c
|
|
kTiSdb4vFCrX7C67YMzfCuoq5xGr5ZNU0NugzAmf/fZhFFmDVSr6/GfS02Ippfw8
|
|
pBt42gFcEDPpK2wFhqMfiIIIvOvgtkjvx9ctY5boRnh1sZcayDMq/QfPOrsj55Vv
|
|
Cq8Il7ESE2bJP1Bt9/rHLCKP6GKD6Jk=
|
|
-----END CERTIFICATE-----
|