Function extract_peer_identity

crates/openshell-server/src/multiplex.rs:744–777

Extract an [`Identity`] from the peer certificates presented during a TLS handshake. Returns `None` if no client certificate was presented.

(tls_stream: &tokio_rustls::server::TlsStream<S>)

/// Extract an [`Identity`] from the peer certificates presented during a TLS
/// handshake. Returns `None` if no client certificate was presented.
pub fn extract_peer_identity<S>(tls_stream: &tokio_rustls::server::TlsStream<S>) -> Option<Identity>
where
    S: AsyncRead + AsyncWrite + Unpin,
{
    use crate::auth::identity::IdentityProvider;
    use x509_parser::prelude::*;

    let (_, server_conn) = tls_stream.get_ref();
    let certs = server_conn.peer_certificates()?;
    let first = certs.first()?;

    let (_, cert) = X509Certificate::from_der(first.as_ref()).ok()?;
    let subject = cert.subject();

    let cn = subject
        .iter_common_name()
        .next()
        .and_then(|attr| attr.as_str().ok())
        .unwrap_or("unknown")
        .to_string();

    let roles: Vec<String> = subject
        .iter_organizational_unit()
        .filter_map(|attr| attr.as_str().ok().map(String::from))
        .collect();

    Some(Identity {
        subject: cn.clone(),
        display_name: Some(cn),
        roles,
        scopes: Vec::new(),
        provider: IdentityProvider::Mtls,
    })
}

/// Boxed body type for uniform handling.
pub struct BoxBody(