| #include "peer_identity_grpc.h" |
| |
| #include <string_view> |
| |
| #include "absl/strings/match.h" |
| #include "peer_identity.h" |
| #include "g3/grpc_headers.h" |
| |
| namespace milotic::authz { |
| |
| grpc::Status ExtractPeerIdentityFromAuthContext( |
| const grpc::AuthContext& context, PeerSpiffeIdentity& peer_identity) { |
| if (!context.IsPeerAuthenticated()) { |
| return grpc::Status(grpc::StatusCode::UNAUTHENTICATED, |
| "Peer is unauthenticated"); |
| } |
| if (context.GetPeerIdentityPropertyName() != GRPC_X509_SAN_PROPERTY_NAME) { |
| return grpc::Status(grpc::StatusCode::PERMISSION_DENIED, |
| "Peer identity isn't X.509 SAN"); |
| } |
| for (const grpc::string_ref& val : context.GetPeerIdentity()) { |
| std::string_view str(val.data(), val.size()); |
| // As per SPIFFE specification, SPIFFE schema and trust domain are case |
| // insensitive. |
| // https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md#24-spiffe-id-parsing |
| if (absl::StartsWithIgnoreCase(str, "spiffe://")) { |
| peer_identity.spiffe_id = str; |
| } else if (absl::EndsWith(str, ".prod.google.com")) { |
| // BMC peers are expected to have only one FQDN. |
| peer_identity.fqdn = str; |
| } |
| } |
| return grpc::Status::OK; |
| } |
| |
| } // namespace milotic::authz |
