mirror of
https://github.com/openziti/ziti.git
synced 2026-09-24 19:32:22 +00:00
Andrew Martinez
9470c1f126
* fixes #3952 reject invalid externalIdClaim and stop enrollment panic - moves the error check before the locator assignment in Ca.GetExternalId so an unsupported matcher/parser no longer nil-derefs and returns HTTP 500 - guards the claim index against negative and out-of-range values and errors when a matched claim resolves to an empty string, so an empty externalId is never silently accepted nor mapped to an identity - adds validateExternalIdClaim, rejecting unsupported locations, unsupported matcher/parser combos, missing matcher/parser criteria, and negative indexes with HTTP 400 at CA create and update time - applies the validation to both CA create and update, which previously had no externalIdClaim validation on the update path - tests GetExternalId across the matcher/parser matrix for no-panic and correct error/value behavior - tests CA create and update reject invalid externalIdClaim configurations - tests that an externalIdClaim resolving to empty fails enrollment cleanly * address pr review - treats an externalIdClaim with no location as no claim in GetExternalId so an empty stored claim (e.g. the empty bucket older CLIs leave behind) falls back to fingerprint enrollment instead of erroring - validates the merged result on CA update rather than the raw request: a partial patch overlays only its supplied subfields onto the stored claim, an empty {} object preserves the stored claim, and a full replace validates as-is - skips externalIdClaim validation on update when no claim is supplied, fixing a spurious rejection of updates to CAs that have no claim - reports the offending location/matcher/parser in the externalIdClaim validation error instead of the raw struct - adds a --clear-external-id-claim flag to update ca and only sends the claim object when a claim flag changed, so existing updates preserve the claim and clearing is explicit - tests externalIdClaim patch merge, preserve, and clear behavior, and that an unconfigured claim reads as no claim