fix: proper subject when injecting cert

deployment/helm/skaha/CHANGELOG.md

@@ -1,4 +1,7 @@
-# CHANGELOG for Skaha User Session API (Chart 0.7.6)
+# CHANGELOG for Skaha User Session API (Chart 0.7.8)
+
+## 2024.10.10 (0.7.8)
+- Fix for client certificate injection
 
 ## 2024.10.07 (0.7.3)
 - Fix for security context in image caching job

deployment/helm/skaha/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.7
+version: 0.7.8
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.21.2"
+appVersion: "0.21.3"
 
 dependencies:
   - name: "redis"

deployment/helm/skaha/values.yaml

@@ -17,7 +17,7 @@ skahaWorkload:
 deployment:
   hostname: myhost.example.com  # Change this!
   skaha:
-    image: images.opencadc.org/platform/skaha:0.21.2
+    image: images.opencadc.org/platform/skaha:0.21.3
     imagePullPolicy: Always
 
     # Cron string for the image caching cron job schedule. Defaults to every minute.

skaha/VERSION

@@ -1,6 +1,6 @@
 ## deployable containers have a semantic and build tag
 # version tag: major.minor.patch
 # build version tag: timestamp
-VER=0.21.2
+VER=0.21.3
 TAGS="${VER} ${VER}-$(date -u +"%Y%m%dT%H%M%S")"
 unset VER

skaha/src/main/java/org/opencadc/skaha/session/SessionAction.java

@@ -196,8 +196,9 @@ private void injectProxyCertificate() {
 
                 if (credServiceURL != null) {
                     final CredClient credClient = new CredClient(credServiceID);
+                    final Subject currentSubject = AuthenticationUtil.getCurrentSubject();
                     final X509CertificateChain proxyCert = Subject.doAs(CredUtil.createOpsSubject(), (PrivilegedExceptionAction<X509CertificateChain>) ()
-                        -> credClient.getProxyCertificate(AuthenticationUtil.getCurrentSubject(), SessionAction.ONE_WEEK_DAYS));
+                        -> credClient.getProxyCertificate(currentSubject, SessionAction.ONE_WEEK_DAYS));
 
                     log.debug("Proxy cert: " + proxyCert);
                     // inject the proxy cert