Versions Compared

Old Version 31

changes.mady.by.user Jacob Qvortrup

Saved on

compared with

New Version 32

changes.mady.by.user Jacob Qvortrup

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

docker run --rm -it -v "$PWD":/workspace -w /workspace -e revision="snapshot" registry.nspop.dk/tools/nspbuilder:4.0.5 ./setup_keycloak_trust.sh
docker run --rm -it -v "$PWD":/workspace -w /workspace -e revision="snapshot" registry.nspop.dk/tools/nspbuilder:4.0.5 ./setup_client_certificate.sh


Ingress

Udover at TLS terminerer, forwarder den hhv. klientcertifikatet og JWT token mod EAS kerneservicen.
Derved opnåes, at selve kompleksiteten med mTLS er håndteret i ingress laget, mens applikationen selv kan håndtere authentication og validere Proof of Possession af JWT token.
Dette gøres i applikationen ved at sammenholde SHA256 thumbprint af det forwarded klientcertifikat mod cnf claim i JWT token.

...