aws / aws/serverless-java-container
API Gateway MTLS "clientCert" Availability?
- 主要語言
- Java
- 星號
- 1.6k
- 分支
- 574
- PR 合併指標
- 30 天內沒有已合併 PR
描述
*Serverless Java Container version*: `eg. 1.5`
1.6
*Implementations:* `Jersey / Spring / Spring Boot / Spring Boot 2 / Spark`
Spring Boot
*Framework version:* `eg SpringBoot 2.2.6.RELEASE`
2.6.6
*Frontend service:* `REST API / HTTP API / ALB`
REST API
## Scenario
I am utilizing MTLS authentication for my API Gateway: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/
In the documentation, it mentions that the `clientCert` is populated in the API GW's event payload when it is passed along to Lambda authorizers via the `requestContext`.
I want to base my authorization on the clientCert's subjectDN's CN within my java code, but I am not sure if it's possible or how I can access the `clientCert` from within my Java lambda utilizing aws-serverless-java-container. (I realize the lambda isn't a `lambda authorizer`, but I was hoping it may still be accessible) Any suggestions?
## Expected behavior
I would expect that `clientCert` is available within `AwsProxyRequest`'s `AwsProxyRequestContext`
EX:
```"requestContext": {
"authentication": {
"clientCert": {
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
"serialNumber": "1",
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
"validity": {
"notAfter": "Aug 5 00:28:21 2120 GMT",
"notBefore": "Aug 29 00:28:21 2020 GMT"
}
}
},
...
```
## Actual behavior
I don't see anything in `AwsProxyRequest` or `AwsProxyRequestContext` related to certs or authentication.
## Steps to reproduce
Set up a REST API Gateway pointing to your `aws-serverless-java-container` lambda. Add custom domain. Create certs. Enable MTLS. Make call to the REST API Gateway and attempt to find `clientCert` object from API GW event payload.
## Full log output
N/A
貢獻指南
研究方向
先檢查 AwsProxyRequest 和 AwsProxyRequestContext,然後將它們可用的欄位與 issue 中顯示的 API Gateway 事件 payload 進行比較。驗證 REST API Gateway 的 MTLS 請求路徑,並確認 clientCert 資料是否能到達 Java 容器。完成的標準是:受支援的請求內容會公開憑證資訊,或清楚記錄該資訊無法使用。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- aws, java
- 領域
- api
- Issue 類型
- 功能
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 活躍度
- 停滯
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100