better support for application level authentication #2322
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Achim Kraus <[email protected]>
Ensure to execute tasks, after shutdown. Signed-off-by: Achim Kraus <[email protected]>
Add execute. Signed-off-by: Achim Kraus <[email protected]>
Cleanup javadoc of principals. Signed-off-by: Achim Kraus <[email protected]>
Remove obsolete casts. Signed-off-by: Achim Kraus <[email protected]>
Signed-off-by: Achim Kraus <[email protected]>
Signed-off-by: Achim Kraus <[email protected]>
Signed-off-by: Achim Kraus <[email protected]>
Use Connection ID to identify DLTS context also for outgoing messages, if available. Signed-off-by: Achim Kraus <[email protected]>
Signed-off-by: Achim Kraus <[email protected]>
boaks
changed the title
If the CertificateAuthenticationMode.WANTED is used but no common client certificate type is available, don't fail. Signed-off-by: Achim Kraus <[email protected]>
Enables better support for clients using an anonymous DTLS handshake and authorize the request then on the application level, e.g. username/password or tokens. In combination with proxies, this enables the "offload" the authentication from dtls and move it into the REST API. Signed-off-by: Achim Kraus <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For some application and proxies, it may be advantageous to use a common HTTP authentication pattern, where the client stays on TLS level anonymous and applies it's authentication then on application level, e.g. username/password or tokens.
This PR improves the support for that by adding an
ApplicationPrincipal, anApplicationAuthorizerand a new configuration "DTLS.APPLICATION_AUTHORIZATION", which enables the new anonymous client support.If enabled, anonymous clients will be removed after a short time (about 2-3 minutes), if the application doesn't authorize them using the
ApplicationAuthorizer.