Find account by certificate sub and iss in VOMS AA (indigo-iam#897)

jouvin · Feb 6, 2025 · 2b53c2b · 2b53c2b
1 parent e7068c0
commit 2b53c2b
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 13 deletions.
diff --git a/iam-voms-aa/src/main/java/it/infn/mw/voms/aa/impl/DefaultIamVomsAccountResolver.java b/iam-voms-aa/src/main/java/it/infn/mw/voms/aa/impl/DefaultIamVomsAccountResolver.java
@@ -18,24 +18,32 @@
 import java.util.Optional;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.model.IamX509Certificate;
+import it.infn.mw.iam.persistence.repository.IamX509CertificateRepository;
 import it.infn.mw.voms.aa.VOMSRequestContext;
 
 public class DefaultIamVomsAccountResolver implements IamVOMSAccountResolver {
 
-  IamAccountRepository accountRepo;
-  
-  public DefaultIamVomsAccountResolver(IamAccountRepository repo) {
-    this.accountRepo = repo;
+  IamX509CertificateRepository certificateRepo;
+
+  public DefaultIamVomsAccountResolver(IamX509CertificateRepository repo) {
+    this.certificateRepo = repo;
   }
-  
+
   @Override
   public Optional<IamAccount> resolveAccountFromRequest(VOMSRequestContext requestContext) {
-    
+
     String certificateSubject = requestContext.getRequest().getRequesterSubject();
-
-    return accountRepo.findByCertificateSubject(certificateSubject);
-
+    String certificateIssuer = requestContext.getRequest().getRequesterIssuer();
+
+    Optional<IamX509Certificate> cert =
+        certificateRepo.findBySubjectDnAndIssuerDn(certificateSubject, certificateIssuer);
+
+    if (cert.isEmpty()) {
+      return Optional.empty();
+    }
+    return Optional.ofNullable(cert.get().getAccount());
+
   }
 
 }
diff --git a/iam-voms-aa/src/main/java/it/infn/mw/voms/config/VomsConfig.java b/iam-voms-aa/src/main/java/it/infn/mw/voms/config/VomsConfig.java
@@ -32,7 +32,7 @@
 import it.infn.mw.iam.authn.x509.IamX509AuthenticationProvider;
 import it.infn.mw.iam.authn.x509.IamX509AuthenticationUserDetailService;
 import it.infn.mw.iam.authn.x509.InactiveAccountAuthenticationHander;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamX509CertificateRepository;
 import it.infn.mw.voms.aa.AttributeAuthority;
 import it.infn.mw.voms.aa.ac.ACGenerator;
 import it.infn.mw.voms.aa.ac.ThreadLocalACGenerator;
@@ -97,8 +97,8 @@ ACGenerator acGenerator(PEMCredential aaCredential) {
   }
 
   @Bean
-  IamVOMSAccountResolver iamAccountResolver(IamAccountRepository accountRepo) {
-    return new DefaultIamVomsAccountResolver(accountRepo);
+  IamVOMSAccountResolver iamAccountResolver(IamX509CertificateRepository certificateRepo) {
+    return new DefaultIamVomsAccountResolver(certificateRepo);
   }
 
   @Bean