pantheon-systems/go-certauth

Go handlers and middleware to do client cert authentication.

go-certauth's Issues

implement public TLS server config recommendations in certutils.NewTLSServer

There is some good information from cloudflare in this article for configuring go https services for public consumption, we should consider adopting them as defaults in the certutils package

https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/

support authenticating on OU or CN

i'm thinking about adding an 'evaluator' (or better name?) to go-certauth. Use case is "allow any cert with OU=foo or CN=blah".

eg:

auth := certauth.NewAuth(certauth.Options{
                AllowedOUs: []string{"endpoint", "WWW"},
                AllowedCNs: []string{"client1"},
        })

^^ current code, requires both OU and CN to match.

maybe something like:

auth := certauth.NewAuth(certauth.Options{
                AllowedOUs: []string{"endpoint", "WWW"},
                AllowedCNs: []string{"client1"},
                Eval: "Or",
        })

"Or", "And" ..