Project

Profile

Help

Story #4666

Updated by bmbouter almost 5 years ago

It would be very useful for paths to be put into the x.509 extended attributes to see if this client is authorized to access this specific distribution's content. This way whoever is generating the certs (and their expiration dates) determines the access. 

 The existing X.509 certguard could automatically be updated to check this correctly. We also need docs with how the openssl tooling can easily make these kind of certs. 

 h3. How will One issue is we need to figure out how to ensure the certguard knows path checking is required? 

 A boolean will be added to the X.509 certguard called <code>path_check_required</code> which will default to False. If True, the certificate check must contain a matching path for the content requested. required...

Back