aws / aws/serverless-java-container
API Gateway MTLS "clientCert" Availability?
- Lingua principale
- Java
- Stelle
- 1.6k
- Fork
- 574
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
*Serverless Java Container version*: `eg. 1.5`
1.6
*Implementations:* `Jersey / Spring / Spring Boot / Spring Boot 2 / Spark`
Spring Boot
*Framework version:* `eg SpringBoot 2.2.6.RELEASE`
2.6.6
*Frontend service:* `REST API / HTTP API / ALB`
REST API
## Scenario
I am utilizing MTLS authentication for my API Gateway: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/
In the documentation, it mentions that the `clientCert` is populated in the API GW's event payload when it is passed along to Lambda authorizers via the `requestContext`.
I want to base my authorization on the clientCert's subjectDN's CN within my java code, but I am not sure if it's possible or how I can access the `clientCert` from within my Java lambda utilizing aws-serverless-java-container. (I realize the lambda isn't a `lambda authorizer`, but I was hoping it may still be accessible) Any suggestions?
## Expected behavior
I would expect that `clientCert` is available within `AwsProxyRequest`'s `AwsProxyRequestContext`
EX:
```"requestContext": {
"authentication": {
"clientCert": {
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
"serialNumber": "1",
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
"validity": {
"notAfter": "Aug 5 00:28:21 2120 GMT",
"notBefore": "Aug 29 00:28:21 2020 GMT"
}
}
},
...
```
## Actual behavior
I don't see anything in `AwsProxyRequest` or `AwsProxyRequestContext` related to certs or authentication.
## Steps to reproduce
Set up a REST API Gateway pointing to your `aws-serverless-java-container` lambda. Add custom domain. Create certs. Enable MTLS. Make call to the REST API Gateway and attempt to find `clientCert` object from API GW event payload.
## Full log output
N/A
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.