smolnar82 commented on code in PR #1451:
URL: https://github.com/apache/knox/pull/1451#discussion_r4268510964
##########
gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResource.java:
##########
@@ -225,9 +231,40 @@ private Map<String, Object> issuerToMap(TrustedOidcIssuer
issuer) {
map.put("registeredAt",
issuer.getRegisteredAt() != null ? issuer.getRegisteredAt().toString()
: null);
map.put("registeredBy", issuer.getRegisteredBy());
+ // CA certificates are public; the value is returned as registered so
callers can detect drift.
+ map.put("jwksCa", issuer.getJwksCa());
return map;
}
+ /**
+ * Validates an optional {@code jwksCa}. A Secret reference is checked for
syntax only, since the
+ * Secret may be created after the issuer is registered.
+ *
+ * @return the error description, or null if the value is valid or absent
+ */
+ private static String validateJwksCa(String jwksCa, boolean dynamicJwks) {
+ if (jwksCa == null) {
+ return null;
+ }
+ if (!dynamicJwks) {
+ return "jwksCa requires dynamicJwks=true; it only applies to OIDC
discovery and JWKS fetches";
+ }
+ if (jwksCa.length() > JwksCa.MAX_LENGTH) {
+ return "jwksCa must not exceed " + JwksCa.MAX_LENGTH + " characters";
+ }
+ try {
+ if (JwksCa.isSecretReference(jwksCa)) {
+ JwksCa.parseSecretReference(jwksCa);
+ } else {
+ JwksCa.parsePemBundle(jwksCa);
+ }
+ } catch (IllegalArgumentException e) {
+ // the secret reference errors already name the field; the PEM errors do
not
+ return JwksCa.isSecretReference(jwksCa) ? e.getMessage() : "Invalid
jwksCa: " + e.getMessage();
Review Comment:
Updated the error messages in JwksCa and simply return the message in the
catch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
