Maxim 7e124be755 Always populate AllowedResourceIDs on decoded Identity (#66870) ...

* fix: Always populate AllowedResourceIDs on decoded Identity

- TLS and SSH cert decoders populated AllowedResourceAccessIDs but left
  AllowedResourceIDs nil. Any path decoding an identity and re-encoding
  via Subject() would result in the encoder injecting a sentinel value
  into the legacy field, and storing all resources under the new
  AllowedResourceAccessIDs field only.

  This specifically broke database access in mixed-version clusters:
  Proxy would decode user cert, build a CSR (Subject()), send it to Auth
  for signing (FromSubject() then Subject() again). This dropped
  AllowedResourceIDs, storing all under the new extension, so older
  database agents received the cert with only the sentinel in the legacy
  extension, and unaware of the new extension, denied access.

  Fix by populating AllowedResourceIDs at decode time in both decoders
  via UnwrapResourceAccessIDs, ensuring and unconstrained resources
  persist across decode-re-encode cycles.

* refac: tidy ca_test encode/decode test

2026-05-21 18:13:15 +00:00

..

encoding_helpers.go

transition ssh enforcement to sshca.Identity (#51468)

2025-02-04 18:01:53 +00:00

identity_test.go

Always populate AllowedResourceIDs on decoded Identity (#66870)

2026-05-21 18:13:15 +00:00

identity.go

Always populate AllowedResourceIDs on decoded Identity (#66870)

2026-05-21 18:13:15 +00:00

sshca.go

adding support for scoped joining of SSH nodes using dynamic tokens (#60362)

2025-10-28 22:00:18 +00:00