alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Fix authority calling wrong revoke method

Browse source
This commit is contained in:
max furman 2019-12-02 19:11:27 -05:00
parent d2b1f1547f
commit 9caadbb341
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
authority/authorize.go
View file

@ -77,7 +77,7 @@ func (a *Authority) authorizeToken(ctx context.Context, ott string) (provisioner
if reuseKey, err := p.GetTokenID(ott); err == nil { if reuseKey, err := p.GetTokenID(ott); err == nil {
ok, err := a.db.UseToken(reuseKey, ott) ok, err := a.db.UseToken(reuseKey, ott)
if err != nil { if err != nil {
return nil, &apiError{errors.Wrap(err, "authorizeToken: failed when checking if token already used"), return nil, &apiError{errors.Wrap(err, "authorizeToken: failed when attempting to store token"),
http.StatusInternalServerError, errContext} http.StatusInternalServerError, errContext}
} }
if !ok { if !ok {
@ -163,7 +163,7 @@ func (a *Authority) authorizeRevoke(ctx context.Context, token string) error {
if err != nil { if err != nil {
return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext} return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext}
} }
if err = p.AuthorizeSSHRevoke(ctx, token); err != nil { if err = p.AuthorizeRevoke(ctx, token); err != nil {
return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext} return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext}
} }
return nil return nil

3
authority/provisioner/jwk.go
View file

@ -118,7 +118,8 @@ func (p *JWK) authorizeToken(token string, audiences []string) (*jwtPayload, err
// validate audiences with the defaults // validate audiences with the defaults
if !matchesAudience(claims.Audience, audiences) { if !matchesAudience(claims.Audience, audiences) {
return nil, errors.New("invalid token: invalid audience claim (aud)") return nil, errors.Errorf("invalid token: invalid audience claim (aud); want %s, but got %s",
audiences, claims.Audience)
} }
if claims.Subject == "" { if claims.Subject == "" {