[jboss-jira] [JBoss JIRA] (WFLY-12133) Enhanced mapping of X509Certificate to the underlying identity
[
https://issues.jboss.org/browse/WFLY-12133?page=com.atlassian.jira.plugin...
]
Farah Juma moved EAP7-1267 to WFLY-12133:
-----------------------------------------
Project: WildFly (was: EAP 7 Planning Pilot)
Key: WFLY-12133 (was: EAP7-1267)
Issue Type: Feature Request (was: Requirement)
Workflow: GIT Pull Request workflow (was: EAP Agile Workflow
2.0)
Component/s: Security
(was: Security)
Analysis Document: (was:
https://github.com/wildfly/wildfly-proposals/pull/203)
EAP Testing By: (was: QE)
EAP PT Pre-Checked (PC): (was: TODO)
Target Release: (was: 7.3.0.GA)
EAP PT Community Docs (CD): (was: TODO)
EAP PT Product Docs (PD): (was: New)
EAP PT Test Dev (TD): (was: TODO)
EAP PT Docs Analysis (DA): (was: TODO)
EAP PT Test Plan (TP): (was: In Progress)
EAP PT Analysis Document (AD): (was: Approved)
Writer: (was: Chuck Copello)
Enhanced mapping of X509Certificate to the underlying identity
--------------------------------------------------------------
Key: WFLY-12133
URL: https://issues.jboss.org/browse/WFLY-12133
Project: WildFly
Issue Type: Feature Request
Components: Security
Reporter: Farah Juma
Assignee: Farah Juma
Priority: Major
Labels: CD17-Deferred, EAP-CD18, Previous_RFE
Where authentication is using a Principal we have a lot of opportunities to map / rewrite
the principal name - where using 'X509PeerCertificateChainEvidence' we have no
such opportunity and pass this directly to the SecurityRealm.
We have a customer example where the id to resolve the identity can come from a portion
of the certificates common name or alternatively a subject alternative name.
The customer example is using LDAP so we could handle the decoding within the LDAP realm
only - or we could add a more generic evidence decoder support.
A single installation could use multiple formats so we may want to consider how to handle
multiple formats.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)