pub async fn exchange_token_for_identity(
    authorization: &str,
    k8s_api_server_url: &str,
    k8s_api_ca_cert_data: &[u8],
) -> Result<Identity> {
    let is_tmc_environment: bool = env::var(DEFAULT_PINNIPED_API_SUFFIX)
        .unwrap_or(DEFAULT_API_SUFFIX.into())
        == TMC_PINNIPED_API_SUFFIX;

    // TODO(agamez): remove this duplicated branch and use a generic dynamic approach when possible.
    // see PR comments: https://github.com/kubeapps/kubeapps/pull/2515
    if is_tmc_environment {
        let credential_request_tmc =
            call_pinniped_exchange_tmc(authorization, k8s_api_server_url, k8s_api_ca_cert_data)
                .await
                .context("Failed to exchange credentials")?;
        match credential_request_tmc.status {
            Some(s) => {
                match s.credential {
                    Some(c) => return identity_for_exchange(&c),
                    None => match s.message {
                        // A returned status without a credential is unsuccessful authentication so
                        // add context to identify this.
                        Some(m) => {
                            return Err(anyhow::anyhow!(m.clone())
                                .context(PinnipedError::UnsuccessfulAuthentication(m)))
                        }
                        None => {
                            return Err(anyhow::anyhow!(
                                "response status neither an error msg or a credential: {:#?}",
                                s
                            ))
                        }
                    },
                }
            }
            None => {
                return Err(anyhow::anyhow!(
                    "pinniped credential request did not include status: {:#?}",
                    credential_request_tmc
                ))
            }
        }
    } else {
        let credential_request =
            call_pinniped_exchange(authorization, k8s_api_server_url, k8s_api_ca_cert_data)
                .await
                .context("Failed to exchange credentials")?;
        match credential_request.status {
            Some(s) => {
                match s.credential {
                    Some(c) => return identity_for_exchange(&c),
                    None => match s.message {
                        // A returned status without a credential is unsuccessful authentication so
                        // add context to identify this.
                        Some(m) => {
                            return Err(anyhow::anyhow!(m.clone())
                                .context(PinnipedError::UnsuccessfulAuthentication(m)))
                        }
                        None => {
                            return Err(anyhow::anyhow!(
                                "response status neither an error msg or a credential: {:#?}",
                                s
                            ))
                        }
                    },
                }
            }
            None => {
                return Err(anyhow::anyhow!(
                    "pinniped credential request did not include status: {:#?}",
                    credential_request
                ))
            }
        }
    }
}
/// exchange_token_for_identity accepts an authorization header and returns a client cert authentication Identity in exchange.
///
/// The token is exchanged with pinniped concierge API running on the identified kubernetes api server.
exchange_token_for_identity accepts an authorization header and returns a client cert authentication Identity in exchange.
The token is exchanged with pinniped concierge API running on the identified kubernetes api server.
exchange_token_for_identity accepts an authorization header and returns a client cert authentication Identity in exchange . The token is exchanged with pinniped concierge API running on the identified kubernetes api server .
pub async fn exchange_token_for_identity(
    authorization: &str,
    k8s_api_server_url: &str,
    k8s_api_ca_cert_data: &[u8],
) -> Result<Identity> {
    let is_tmc_environment: bool = env::var(DEFAULT_PINNIPED_API_SUFFIX)
        .unwrap_or(DEFAULT_API_SUFFIX.into())
        == TMC_PINNIPED_API_SUFFIX;
    // TODO(agamez): remove this duplicated branch and use a generic dynamic approach when possible.
    // see PR comments: https://github.com/kubeapps/kubeapps/pull/2515
    if is_tmc_environment {
        let credential_request_tmc =
            call_pinniped_exchange_tmc(authorization, k8s_api_server_url, k8s_api_ca_cert_data)
                .await
                .context("Failed to exchange credentials")?;
        match credential_request_tmc.status {
            Some(s) => {
                match s.credential {
                    Some(c) => return identity_for_exchange(&c),
                    None => match s.message {
                        // A returned status without a credential is unsuccessful authentication so
                        // add context to identify this.
                        Some(m) => {
                            return Err(anyhow::anyhow!(m.clone())
                                .context(PinnipedError::UnsuccessfulAuthentication(m)))
                        }
                        None => {
                            return Err(anyhow::anyhow!(
                                "response status neither an error msg or a credential: {:#?}",
                                s
                            ))
                        }
                    },
                }
            }
            None => {
                return Err(anyhow::anyhow!(
                    "pinniped credential request did not include status: {:#?}",
                    credential_request_tmc
                ))
            }
        }
    } else {
        let credential_request =
            call_pinniped_exchange(authorization, k8s_api_server_url, k8s_api_ca_cert_data)
                .await
                .context("Failed to exchange credentials")?;
        match credential_request.status {
            Some(s) => {
                match s.credential {
                    Some(c) => return identity_for_exchange(&c),
                    None => match s.message {
                        // A returned status without a credential is unsuccessful authentication so
                        // add context to identify this.
                        Some(m) => {
                            return Err(anyhow::anyhow!(m.clone())
                                .context(PinnipedError::UnsuccessfulAuthentication(m)))
                        }
                        None => {
                            return Err(anyhow::anyhow!(
                                "response status neither an error msg or a credential: {:#?}",
                                s
                            ))
                        }
                    },
                }
            }
            None => {
                return Err(anyhow::anyhow!(
                    "pinniped credential request did not include status: {:#?}",
                    credential_request
                ))
            }
        }
    }
}
pub async fn exchange_token_for_identity ( authorization : & str , k8s_api_server_url : & str , k8s_api_ca_cert_data : & [ u8 ] , ) -> Result < Identity > { let is_tmc_environment : bool = env :: var ( DEFAULT_PINNIPED_API_SUFFIX ) . unwrap_or ( DEFAULT_API_SUFFIX . into ( ) ) == TMC_PINNIPED_API_SUFFIX ; // TODO(agamez): remove this duplicated branch and use a generic dynamic approach when possible. // see PR comments: https://github.com/kubeapps/kubeapps/pull/2515 if is_tmc_environment { let credential_request_tmc = call_pinniped_exchange_tmc ( authorization , k8s_api_server_url , k8s_api_ca_cert_data ) . await . context ( " " ) ? ; match credential_request_tmc . status { Some ( s ) => { match s . credential { Some ( c ) => return identity_for_exchange ( & c ) , None => match s . message { // A returned status without a credential is unsuccessful authentication so // add context to identify this. Some ( m ) => { return Err ( anyhow :: anyhow ! ( m clone ( ) ) . context ( PinnipedError :: UnsuccessfulAuthentication ( m ) ) ) } None => { return Err ( anyhow :: anyhow ! ( " " s ) ) } } , } } None => { return Err ( anyhow :: anyhow ! ( " " credential_request_tmc ) ) } } } else { let credential_request = call_pinniped_exchange ( authorization , k8s_api_server_url , k8s_api_ca_cert_data ) . await . context ( " " ) ? ; match credential_request . status { Some ( s ) => { match s . credential { Some ( c ) => return identity_for_exchange ( & c ) , None => match s . message { // A returned status without a credential is unsuccessful authentication so // add context to identify this. Some ( m ) => { return Err ( anyhow :: anyhow ! ( m clone ( ) ) . context ( PinnipedError :: UnsuccessfulAuthentication ( m ) ) ) } None => { return Err ( anyhow :: anyhow ! ( " " s ) ) } } , } } None => { return Err ( anyhow :: anyhow ! ( " " credential_request ) ) } } } }
exchange_token_for_identity accepts an authorization header and returns a client cert authentication Identity in exchange.
exchange_token_for_identity accepts an authorization header and returns a client cert authentication Identity in exchange .
authorization
&str
k8s_api_server_url
&str
k8s_api_ca_cert_data
&[u8]