alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Disable revoke for GCP.

Browse source
This commit is contained in:
Mariano Cano 2019-04-23 14:20:14 -07:00
parent 7727fa5665
commit 7e53b28320
2 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
authority/provisioner/gcp.go
View file

@ -63,7 +63,7 @@ func (p *GCP) GetID() string {
} }
// GetTokenID returns the identifier of the token. For GCP this is the sha256 of // GetTokenID returns the identifier of the token. For GCP this is the sha256 of
// "instance_id.iat.exp". // "provisioner_id.instance_id.iat.exp".
func (p *GCP) GetTokenID(token string) (string, error) { func (p *GCP) GetTokenID(token string) (string, error) {
jwt, err := jose.ParseSigned(token) jwt, err := jose.ParseSigned(token)
if err != nil { if err != nil {
@ -130,7 +130,7 @@ func (p *GCP) GetIdentityToken() (string, error) {
return string(bytes.TrimSpace(b)), nil return string(bytes.TrimSpace(b)), nil
} }
// Init validates and initializes the GCP provider. // Init validates and initializes the GCP provisioner.
func (p *GCP) Init(config Config) error { func (p *GCP) Init(config Config) error {
var err error var err error
switch { switch {
@ -169,7 +169,7 @@ func (p *GCP) AuthorizeSign(token string) ([]SignOption, error) {
commonNameValidator(ce.InstanceName), commonNameValidator(ce.InstanceName),
dnsNamesValidator(dnsNames), dnsNamesValidator(dnsNames),
profileDefaultDuration(p.claimer.DefaultTLSCertDuration()), profileDefaultDuration(p.claimer.DefaultTLSCertDuration()),
newProvisionerExtensionOption(TypeGCP, p.Name, claims.AuthorizedParty), newProvisionerExtensionOption(TypeGCP, p.Name, claims.Subject),
newValidityValidator(p.claimer.MinTLSCertDuration(), p.claimer.MaxTLSCertDuration()), newValidityValidator(p.claimer.MinTLSCertDuration(), p.claimer.MaxTLSCertDuration()),
}, nil }, nil
} }
@ -185,8 +185,7 @@ func (p *GCP) AuthorizeRenewal(cert *x509.Certificate) error {
// AuthorizeRevoke returns an error if the provisioner does not have rights to // AuthorizeRevoke returns an error if the provisioner does not have rights to
// revoke a certificate. // revoke a certificate.
func (p *GCP) AuthorizeRevoke(token string) error { func (p *GCP) AuthorizeRevoke(token string) error {
_, err := p.authorizeToken(token) return errors.New("revoke is not supported on a GCP provisioner")
return err
} }
// authorizeToken performs common jwt authorization actions and returns the // authorizeToken performs common jwt authorization actions and returns the

2
authority/provisioner/gcp_test.go
View file

@ -340,7 +340,7 @@ func TestGCP_AuthorizeRevoke(t *testing.T) {
args args args args
wantErr bool wantErr bool
}{ }{
{"ok", p1, args{t1}, false}, {"ok", p1, args{t1}, true}, // revoke is disabled
{"fail", p1, args{"token"}, true}, {"fail", p1, args{"token"}, true},
} }
for _, tt := range tests { for _, tt := range tests {