feat: implement TLS cert-to-user mapping via X500 DN matching

2026-02-23 00:55:29 -05:00
parent 1269ae8275
commit 1f13269447
5 changed files with 211 additions and 0 deletions
--- a/src/NATS.Server/Auth/AuthService.cs
+++ b/src/NATS.Server/Auth/AuthService.cs
@@ -34,6 +34,13 @@ public sealed class AuthService
        var nonceRequired = false;
        Dictionary<string, User>? usersMap = null;

+        // TLS certificate mapping (highest priority when enabled)
+        if (options.TlsMap && options.TlsVerify && options.Users is { Count: > 0 })
+        {
+            authenticators.Add(new TlsMapAuthenticator(options.Users));
+            authRequired = true;
+        }
+
        // Priority order (matching Go): NKeys > Users > Token > SimpleUserPassword

        if (options.NKeys is { Count: > 0 })