Fix certificate check in node
We changed the way requests are processed, we no longer have different pipelines for requests with and without client certs (WebIDs), so the certificate extracting filter must tolerate not finding a certificate
@@ -68,19 +68,17 @@ public class ReverseProxyCompatibleX509AuthenticationFilter extends AbstractPreA
private X509Certificate extractClientCertificate(HttpServletRequest request) {
X509Certificate[] certificateChainObj = null;
if (behindProxy) {
+ String certificateHeader = request.getHeader(WON.CLIENT_CERTIFICATE_HEADER);
+ if (certificateHeader == null) {
+ warnAboutMissingClientCertificate();
+ return null;
+ }
CertificateFactory certificateFactory = null;
try {
certificateFactory = CertificateFactory.getInstance("X.509");
} catch (CertificateException e) {
throw new InternalAuthenticationServiceException("could not extract certificate from request", e);
}
- String certificateHeader = request.getHeader(WON.CLIENT_CERTIFICATE_HEADER);
- if (certificateHeader == null) {
- throw new AuthenticationCredentialsNotFoundException(
- "No HTTP header 'X-Client-Certificate' set that contains client authentication certificate! If property "
- + "'client.authentication.behind.proxy' is set to true, this header must be "
- + "set by the reverse proxy!");
- }
String certificateContent = URLDecoder.decode(certificateHeader, StandardCharsets.UTF_8);
if (logger.isDebugEnabled()) {
logger.debug("found this certificate in the " + WON.CLIENT_CERTIFICATE_HEADER + " header: "
@@ -102,6 +100,14 @@ public class ReverseProxyCompatibleX509AuthenticationFilter extends AbstractPreA
} else {
certificateChainObj = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
if (certificateChainObj == null) {
+ warnAboutMissingClientCertificate();
+ return null;
+ }
+ }
+ return certificateChainObj[0];
+ }
+
+ private void warnAboutMissingClientCertificate() {
if (lastWarning == null || lastWarning
.isBefore(Instant.from(warningInterval.subtractFrom(Instant.now())))) {
logger.warn(
@@ -110,10 +116,6 @@ public class ReverseProxyCompatibleX509AuthenticationFilter extends AbstractPreA
+ "make sure the proxy sets the HTTP header 'X-Client-Certificate' appropriately, passing the client certificate on to you. This warning is not generated more than once per hour.");
lastWarning = Instant.now();
}
- return null;
- }
- }
- return certificateChainObj[0];
}
public void setPrincipalExtractor(X509PrincipalExtractor principalExtractor) {
