Repository navigation
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| public Collection<ASN1ObjectIdentifier> getAllowedSubjectCertificatePolicies() { | ||
| return allowedSubjectCertificatePolicies; |
| subjectCertificatePolicyValidator = new SubjectCertificatePolicyValidator(configuration.getDisallowedSubjectCertificatePolicies()); | ||
| subjectCertificatePolicyValidator = new SubjectCertificatePolicyValidator( | ||
| this.configuration.getAllowedSubjectCertificatePolicies(), | ||
| this.configuration.getDisallowedSubjectCertificatePolicies() |
mrts
changed the title
svenzik
force-pushed
the
WE2-1308
branch
3 times, most recently
from
October 20, 2026 05:47
d88babe to
4acbc6d
Compare
mrts
reviewed
Oct 20, 2026
svenzik
force-pushed
the
WE2-1308
branch
3 times, most recently
from
November 2, 2026 11:57
c4b2263 to
b9ca483
Compare
…onian production policies as default, add to example test card policies WE2-1308 Signed-off-by: Sven Mitt <svenzik@users.noreply.github.com>
|
mrts
requested changes
Nov 6, 2026
| Use `withDisallowedCertificatePolicies(ASN1ObjectIdentifier... policies)` to add disallowed certificate policies. Estonian Mobile-ID policies are disallowed by default because smart-card authentication must not accept Mobile-ID certificates. | ||
| Certificate policy allow-lists are selected by the subject certificate's exact issuer `X500Principal`. At build time, production Estonian identity-document policies from `ESTEID_PRODUCTION_DOCUMENT_POLICIES` are used when the configured allow-list is empty. When one or more issuer entries are configured, only those entries are used. A matching issuer must contain one of its configured policy OIDs; other issuers fall back to the deprecated deny-list, which is empty by default. Calling `withAllowedCertificatePolicies(issuer)` without policy OIDs removes that issuer's entry. If no entries remain, the Estonian defaults are used. | ||
|
|
||
| Use `withAllowedCertificatePolicies(X500Principal issuer, ASN1ObjectIdentifier... policies)` to define a custom allow-list. Repeated calls configure all supported issuers on the same validator. The following example explicitly configures both Estonian ID-card generations in one builder chain. |
Member
There was a problem hiding this comment.
Add example where only Identity card of Estonian citizens is allowed or only Zetes CA is allowed.
| final Collection<ASN1ObjectIdentifier> issuerAllowedPolicies = allowedSubjectCertificatePolicies.getOrDefault(issuer, Set.of()); | ||
|
|
||
| if (extensionValue == null) { | ||
| if (!issuerAllowedPolicies.isEmpty()) { |
Member
There was a problem hiding this comment.
Either allowlist or denylist should be allowed, but not both.
| configuration.validate(); | ||
| return new AuthTokenValidatorImpl(configuration); | ||
| final AuthTokenValidationConfiguration configurationSnapshot = configuration.copy(); | ||
| if (configurationSnapshot.getAllowedSubjectCertificatePolicies().isEmpty()) { |
Member
There was a problem hiding this comment.
Either allowlist or denylist should be allowed, but not both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat: add allowlisting to subject certificate policies and collect known Estonian production policies
Signed-off-by: Sven Mitt svenzik@users.noreply.github.com