[SERVER-74989] Create configuration file option for custom X.509 subject name matching Created: 17/Mar/23  Updated: 29/Oct/23  Resolved: 04/Apr/23

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 7.0.0-rc0

Type: Task Priority: Major - P3
Reporter: Varun Ravichandran Assignee: Varun Ravichandran
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Documented
is documented by DOCS-16006 [Server] Investigate changes in SERVE... Closed
Duplicate
is duplicated by SERVER-14655 x.509 certificate authentication requ... Closed
Backwards Compatibility: Fully Compatible
Sprint: Security 2023-03-20, Security 2023-04-03, Security 2023-04-17
Participants:

 Description   

Today, servers determine whether a connecting client is a peer server node either via keyfile authentication or X.509. If X.509 authentication is enabled on the server and the connecting client's certificate has a subject name DN sharing the same O, OU, and DC attributes as the server's certificate, then the connecting client is considered as a peer server node.

In an effort to make this more customizable, we will add a configuration file option that will take priority over this default policy. The option will specify a set of subject name DN attributes and values that the server will check for in the connecting client's certificate. If they match, then the client will be treated as a peer server node.



 Comments   
Comment by Githook User [ 04/Apr/23 ]

Author:

{'name': 'Varun Ravichandran', 'email': 'varun.ravichandran@mongodb.com', 'username': 'varunravi98'}

Message: SERVER-74989: Create configuration option to specify X.509 subject DN attributes for intracluster auth
Branch: master
https://github.com/mongodb/mongo/commit/39f7c9035ab26b15b95625e016da51be946374a2

Generated at Thu Feb 08 06:29:03 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.