As a user I have path checking features for to the X.509 certguard

[pulpbot]

Author: @bmbouter (bmbouter)

Redmine Issue: 4666, https://pulp.plan.io/issues/4666

---

Motivation

It would be very useful for paths to be put into the x.509 extended attributes to see if this client is authorized to access this specific distribution's content. This way whoever is generating the certs (and their expiration dates) determines the access.

Solution

The existing X.509 certguard could automatically be updated to check this correctly. We also need docs with how the openssl tooling can easily make these kind of certs.

How will we ensure path checking is required?

A boolean will be added to the X.509 certguard called path_check_required which will default to False. If True, the certificate check must contain a matching path for the content requested.

[pulpbot]

From: @bmbouter (bmbouter)
Date: 2019-04-11T16:07:23Z

---

revising with details about how users can configure that path checking is required

[pulpbot]

From: @bmbouter (bmbouter)
Date: 2019-05-31T00:45:03Z

---

We should add this to the sprint.

[pulpbot]

From: @bmbouter (bmbouter)
Date: 2019-06-07T16:03:35Z

---

These weren't added to Sprint 54, but they were OK'd at sprint planning.

[pulpbot]

From: @RCMariko (rchan)
Date: 2019-09-13T18:59:27Z

---

Not moving forward to next Sprint to make room for highest priority Katello blockers.

[pulpbot]

From: dustball (dustball)
Date: 2020-10-12T15:36:09Z

---

I'm interested in this feature as well, we're serving a large amount of customers with all different kinds of systems.

We want to offer our customers staging for licensed products via a central pulpserver as well and individually allow or deny access to those repositories.