allow outways based on domain name #53
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
TheBonheurs
reviewed
Nov 3, 2025
Member
TheBonheurs
left a comment
TheBonheurs
left a comment
There was a problem hiding this comment.
Should we also add relevant test cases for this functionality (in the test-suite)?
specifications.md
Outdated
| 1. The Manager is provided by a Peer who has an Inway which is offering the Service specified in `grant.data.service.name`. | ||
| 1. The Peer ID specified by the X.509 certificate of the client requesting the access token matches the value of the field `grant.data.outway.peer_id`. | ||
| 1. The X.509 certificate provided by the client contains the same public key as specified in `grant.data.outway.public_key_fingerprint` | ||
| 1. The X.509 certificate provided by the client contains a public key with the same public key thumbprint as specified in `grant.data.outway.public_key_thumbprint`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_PUBLIC_KEY_THUMBPRINT` |
Member
There was a problem hiding this comment.
Suggested change
| 1. The X.509 certificate provided by the client contains a public key with the same public key thumbprint as specified in `grant.data.outway.public_key_thumbprint`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_PUBLIC_KEY_THUMBPRINT` | |
| 1. The X.509 certificate provided by the client contains a public key with the same public key thumbprint as specified in `grant.data.outway.public_key_thumbprint`. This validation should only be performed when the value of `grant.outway.type` equals `OUTWAY_TYPE_PUBLIC_KEY_THUMBPRINT` |
specifications.md
Outdated
| 1. The Peer ID specified by the X.509 certificate of the client requesting the access token matches the value of the field `grant.data.outway.peer_id`. | ||
| 1. The X.509 certificate provided by the client contains the same public key as specified in `grant.data.outway.public_key_fingerprint` | ||
| 1. The X.509 certificate provided by the client contains a public key with the same public key thumbprint as specified in `grant.data.outway.public_key_thumbprint`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_PUBLIC_KEY_THUMBPRINT` | ||
| 1. The X.509 certificate provided by the client has a Subject Alternative Name(SAN) that matches the domain name specified in `grant.data.outway.domain_name`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_DOMAIN_NAME` |
Member
There was a problem hiding this comment.
Suggested change
| 1. The X.509 certificate provided by the client has a Subject Alternative Name(SAN) that matches the domain name specified in `grant.data.outway.domain_name`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_DOMAIN_NAME` | |
| 1. The X.509 certificate provided by the client has a Subject Alternative Name (SAN) that matches the domain name specified in `grant.data.outway.domain_name`. This validation should only be preformed when the value of `grant.outway.type` equals `OUTWAY_TYPE_DOMAIN_NAME` |
media/specs/manager.yaml
Outdated
| - peer_id | ||
| - public_key_thumbprint | ||
| outwayDomainName: | ||
| description: The details of the Outway based on a domain name for which a connection authorization was granted |
Member
There was a problem hiding this comment.
Suggested change
| description: The details of the Outway based on a domain name for which a connection authorization was granted | |
| description: The details of the Outway based on a domain name for which a connection was authorized |
I think this flows better but only if 'connection authorization' is not a defined term already.
ronaldkoster
force-pushed
the
outway-domain-name
branch
2 times, most recently
from
377e21d to
e5fb932
Compare
In a (Delegated) Service Connection Grant an Outway can be specified based on domain name. Previously only a public key thumbprint was allowed. An Outway must have the domain name specified as a Subject Alternative Name in its certificate to be allowed to request an access token. By allowing domain names Contracts won't have to be renewed when the Outway renews its certificate and rotates its keypair.
ronaldkoster
force-pushed
the
outway-domain-name
branch
from
e5fb932 to
6363e56
Compare
TheBonheurs
added
Status: Ter goedkeuring
Voles
reviewed
Dec 11, 2025
Voles
reviewed
Dec 11, 2025
Collaborator
There was a problem hiding this comment.
An example using a domain name is missing
Member
There was a problem hiding this comment.
Discussed this with @ronaldkoster and concluded that adding an example is not needed. The referenced lines already show a Contract with a ServiceConnectionGrant, and there are no defined examples for OutwayIdentificationType in the standard beyond descriptive guidance. Adding such examples would also raise the question of adding examples for other types (e.g., ServiceTypes).
We'll have to discuss this in a future release.
Co-authored-by: Niels Dequeker <niels@dqkr.be>
github-actions
bot
added
Status: In bewerking
github-actions
bot
added
Status: Klaar voor release
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In a (Delegated) Service Connection Grant an Outway can be specified based on domain name. Previously only a public key thumbprint was allowed. An Outway must have the domain name specified as a Subject Alternative Name in its certificate to be allowed to request an access token. By allowing domain names Contracts won't have to be renewed when the Outway renews its certificate and rotates its keypair.