You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
haoming29
changed the title
Rotate/revoke issuer.jwk throws error when origin auto-register at registry
Rotate/revoke issuer.jwk throws error when origin auto-registers at registry
Nov 16, 2023
That's the expected / desired behavior: if you try to register with a different key, it should be an error (otherwise someone could pretty trivially steal your namespace).
Separately, I would like to have a mechanism to rotate (add / delete) keys that are registered -- for example, if there are multiple origins under a single part of the namespace -- but you still need to have access to the old key to rotate.
Steps to reproduce:
issuer.jwk
under/etc/pelican
, and have an origin prefix registered at registry, say/origin1
rm issuer.jwk
director
,registry
, andorigin
Error: Namespace /origin1 already registered under a different key
I'm not sure what's the fix for this, which can initiate to some security policy discussions. @bbockelm What's your thoughts on this?
The text was updated successfully, but these errors were encountered: