Skip to content

Commit

Permalink
Refer to X.509 for API credentials, not (x|X)509
Browse files Browse the repository at this point in the history
- it's more technically correct, the best kind of correct
- brings API credentials in line with other (#294) around
  user credentials and account linking
- this does "break" API access for existing credentials (until
  they next get edited), so we should release it:
  - after #260
  - maybe after #294
  - at the same as #284, as users will have to edit API
    credentials anyway
  • Loading branch information
gregcorbett committed May 24, 2022
1 parent b6445ca commit b332cfc
Show file tree
Hide file tree
Showing 5 changed files with 8 additions and 8 deletions.
2 changes: 1 addition & 1 deletion config/gocdb_schema.xml
Original file line number Diff line number Diff line change
Expand Up @@ -604,7 +604,7 @@
<field>
<fname>TYPE</fname>
<length>255</length>
<regex>/^(X509|OIDC Subject)$/</regex>
<regex>/^(X.509|OIDC Subject)$/</regex>
</field>
</entity>
</schema>
2 changes: 1 addition & 1 deletion htdocs/PI/write/utils.php
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ function returnJsonWriteAPIResult ($httpResponseCode, $object) {
function getAuthenticationInfo () {
require_once __DIR__ . '/../../web_portal/components/Get_User_Principle.php';
#Check if associated cert/token is set to define identifier type
if(isset($_SERVER['SSL_CLIENT_CERT'])){$identifierType = 'X509';}
if(isset($_SERVER['SSL_CLIENT_CERT'])){$identifierType = 'X.509';}
if(isset($_SERVER['OIDC_access_token'])){$identifierType = 'OIDC Subject';}

#This will return null if no cert is presented
Expand Down
2 changes: 1 addition & 1 deletion htdocs/web_portal/controllers/site/add_api_auth.php
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ function draw(\User $user = null, \Site $site = null) {

$params['site'] = $site;
$params['authTypes'] = array();
$params['authTypes'][]='X509';
$params['authTypes'][]='X.509';
$params['authTypes'][]='OIDC Subject';

show_view("site/add_api_auth.php", $params);
Expand Down
2 changes: 1 addition & 1 deletion htdocs/web_portal/controllers/site/edit_api_auth.php
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ function draw(\User $user = null, \APIAuthentication $authEnt = null, \Site $sit
$params['site'] = $site;
$params['authEnt'] = $authEnt;
$params['authTypes'] = array();
$params['authTypes'][]='X509';
$params['authTypes'][]='X.509';
$params['authTypes'][]='OIDC Subject';

show_view("site/edit_api_auth.php", $params);
Expand Down
8 changes: 4 additions & 4 deletions lib/Gocdb_Services/Site.php
Original file line number Diff line number Diff line change
Expand Up @@ -1421,8 +1421,8 @@ public function addAPIAuthEntity(\Site $site, \User $user, $newValues) {

//If the entity is of type X509, do a more thorough check than the validate service (as we know the type)
//Note that we are allowing ':' as they can appear in robot DN's
if ($type == 'X509' && !preg_match("/^(\/[A-Za-z]+=[a-zA-Z0-9\/\-\_\s\.,'@:\/]+)*$/", $identifier)) {
throw new \Exception("Invalid x509 DN");
if ($type == 'X.509' && !preg_match("/^(\/[A-Za-z]+=[a-zA-Z0-9\/\-\_\s\.,'@:\/]+)*$/", $identifier)) {
throw new \Exception("Invalid X.509 DN");
}

//If the entity is of type OIDC subject, do a more thorough check again
Expand Down Expand Up @@ -1505,8 +1505,8 @@ public function editAPIAuthEntity(\APIAuthentication $authEntity, \User $user, $

//If the entity is of type X509, do a more thorough check than the validate service (as we know the type)
//Note that we are allowing ':' as they can appear in robot DN's
if ($type == 'X509' && !preg_match("/^(\/[A-Za-z]+=[a-zA-Z0-9\/\-\_\s\.,'@:\/]+)*$/", $identifier)) {
throw new \Exception("Invalid x509 DN");
if ($type == 'X.509' && !preg_match("/^(\/[A-Za-z]+=[a-zA-Z0-9\/\-\_\s\.,'@:\/]+)*$/", $identifier)) {
throw new \Exception("Invalid X.509 DN");
}

//If the entity is of type OIDC subject, do a more thorough check again
Expand Down

0 comments on commit b332cfc

Please sign in to comment.