Module enroll_authz 

Enrollment authorization: bind the authenticated requester to the CSR and enforce per-label name-authorization policy (NIAP CA PP FDP_ACF.1).

RFC 7030 authenticates the requester (via mTLS, OTP, or GSSAPI) but says little about what that requester may ask for. Without an explicit binding an OTP holder provisioned for device-a.example.com can submit a CSR whose subject/SAN names device-b.example.com and receive a valid certificate for an identity it was never authorized to hold. This module closes that gap.

Two independent controls, both driven by the per-label configuration:

1. Identity binding (require_cn_match, require_san_match) — the authenticated identity MUST appear in the CSR, either as the subject Common Name or as a Subject Alternative Name entry.
2. Name authorization (permitted_dns_names, permitted_ip_addresses, permitted_emails) — an allowlist applied to the requested SANs. When a list is non-empty, every SAN of that type in the CSR MUST match at least one entry, so a label can be constrained to a bounded namespace.

The matching primitives are the RFC 6125 matchers in super::name_match, shared with mTLS POP linking so identity comparison is consistent across the server (wildcards, case folding, IP binary compare, email local/domain case rules).

When no control is configured (all fields false/empty), authorize_csr is a no-op — existing deployments keep their current behavior until an operator opts in. NIAP-evaluated deployments set require_cn_match or require_san_match to satisfy FDP_ACF.1.

Structs

EnrollAuthzPolicy

Per-label enrollment authorization policy.

Functions

authorize_csr

Authorize a parsed CSR against the authenticated identity and label policy.

authorize_csr_der

Authorize a DER-encoded CSR against the authenticated identity and label policy. Convenience wrapper over authorize_csr for callers that hold raw CSR bytes rather than a parsed [CertificationRequest].