cleanup

Author: joevanwanzeeleKF

path_certs.go

@@ -329,12 +329,13 @@ func (b *keyfactorBackend) pathIssueSignCert(ctx context.Context, req *logical.R
 	var valid bool
 	var hasSuffix bool
 
+	// check the allowed domains for a match.
 	for _, v := range role.AllowedDomains {
 		b.Logger().Warn(v)
-		if strings.HasSuffix(cn.(string), v) {
+		if strings.HasSuffix(cn.(string), v) { // if it has the suffix..
 			hasSuffix = true
-			if cn.(string) == v || role.AllowSubdomains {
-				valid = true
+			if cn.(string) == v || role.AllowSubdomains { // and there is an exact match, or subdomains are allowed..
+				valid = true // then it is valid
 			}
 		}
 	}
@@ -350,9 +351,6 @@ func (b *keyfactorBackend) pathIssueSignCert(ctx context.Context, req *logical.R
 		return nil, err_resp
 	}
 
-	b.Logger().Warn("role.AllowedBaseDomain = " + role.AllowedBaseDomain)
-	b.Logger().Warn("domain for cert = " + cn.(string))
-
 	for u := range dns_sans {
 		if !strings.Contains(dns_sans[u], role.AllowedBaseDomain) || strings.Contains(dns_sans[u], role.AllowedBaseDomain) && !role.AllowSubdomains {
 			return nil, fmt.Errorf("Subject Alternative Name " + dns_sans[u] + " not allowed for provided role")