[X.509] L7-Only Validation — Tier 3 (XFCC Forwarding)

[averevki]

Summary

Test X.509 client certificate authentication via AuthPolicy with Tier 3 XFCC forwarding — no gateway-level TLS validation, Authorino is the sole certificate validator.

Setup

• Gateway with forwardClientCertDetails: ALWAYS_FORWARD_ONLY annotation (no TLS client validation at gateway)
• CA certificate Secret(s) with labels for Authorino validation
• AuthPolicy with x509.source.header: "X-Forwarded-Client-Cert"
• HTTPRoute bound to AuthPolicy

Tests

• Client with valid certificate in XFCC header → 200 OK (validated by Authorino only)
• Client without XFCC header → 401 Unauthorized
• Client with certificate signed by wrong CA in XFCC header → 403 Forbidden (Authorino rejects)
• Verify that gateway does NOT reject invalid certificates (they pass through to Authorino)

References

• Parent issue: E2E tests for X.509 Client Certificate Authentication in AuthPolicy (XFCC header) #885
• RFC 0015