Connect Enhancements #833
Connect Enhancements #833
Conversation
scottf
commented
Oct 26, 2023
•
scottf
commented
- Reconnect On Connect
- Authentication Expired support
- Ensuring not failing on Authentication Or Authorization Error
- Support 2.10.3 TLS (Handshake) First
| " NKEY Seed printed below can be used to sign and prove identity.\n" + | ||
| " NKEYs are sensitive and should be treated as secrets.\n" + | ||
| "NKEY Seed printed below can be used to sign and prove identity.\n" + | ||
| "NKEYs are sensitive and should be treated as secrets.\n" + |
There was a problem hiding this comment.
Obsessive formatting done here, nothing functional, although I had to change unit tests.
| @@ -240,6 +240,46 @@ var expiredUserJwt | |||
| Assert.Equal("'Authorization Violation'", ex.Message, StringComparer.OrdinalIgnoreCase); | |||
| } | |||
| } | |||
|
|
|||
| [Fact] | |||
| public void TestRealUserAuthenticationExpired() | |||
There was a problem hiding this comment.
This test uses a JWT that will expire quickly. The user connects to the server while the jwt is valid, and then the server disconnects the connection when the jwt expires.
scottf
changed the title
| if (opts.TlsFirst) | ||
| { | ||
| processExpectedInfo(); | ||
| } |
There was a problem hiding this comment.
tls first, don't check/process the server info. checkForSecure used to be the last thing in processExpectedInfo. I moved it out so I could do it on either side. I supposed I could have done the change inside processExpectedInfo but this matches the java code
| throw new NATSSecureConnWantedException(); | ||
| } | ||
| else if (info.TlsRequired && !Opts.Secure) | ||
| if (!Opts.TlsFirst) |
There was a problem hiding this comment.
if tlsFirst, it will always be secure
| Opts.Secure = true; | ||
| // Check to see if we need to engage TLS | ||
| // Check for mismatch in setups | ||
| if (Opts.Secure && !info.TlsRequired) |
There was a problem hiding this comment.
Opts.Secure now returns true if TlsFirst is set. This explains the 2 tests later on
| @@ -1272,10 +1296,9 @@ private void checkForSecure(Srv s) | |||
| // processExpectedInfo will look for the expected first INFO message | |||
| // sent when a connection is established. The lock should be held entering. | |||
| // Caller must lock. | |||
| private void processExpectedInfo(Srv s) | |||
| private void processExpectedInfo() | |||
There was a problem hiding this comment.
don't need the Srv parameter since that work is now done outside this function
