Skip to content

Add provisionerName to webhook request for x509 and SSH#2618

Merged
maraino merged 2 commits intosmallstep:masterfrom
Yannik:fix-missing-provisioner-name-in-webhook
Mar 31, 2026
Merged

Add provisionerName to webhook request for x509 and SSH#2618
maraino merged 2 commits intosmallstep:masterfrom
Yannik:fix-missing-provisioner-name-in-webhook

Conversation

@Yannik
Copy link
Copy Markdown
Contributor

@Yannik Yannik commented Mar 23, 2026

Name of feature:

Add provisionerName to webhook request for x509 and SSH

Pain or issue this feature alleviates:

The provisionerName field in RequestBody (webhook/types.go:86) is only populated for SCEP webhooks (authority/provisioner/scep.go:160). For X509 and SSH webhooks, the field is always empty despite the provisioner being available as a parameter in all four call sites (callEnrichingWebhooksX509, callAuthorizingWebhooksX509, callEnrichingWebhooksSSH, callAuthorizingWebhooksSSH). This makes it impossible for webhook servers to implement per-provisioner logic (e.g., enforcing different key policies for different ACME provisioners).

Why is this important to the project (if not answered above):

The field already exists in the struct and is documented as part of the webhook request body. Not populating it for X509/SSH breaks the reasonable expectation that all webhook types provide the same base context to webhook servers.

Is there documentation on how to use this feature? If so, where?

The webhook request body is documented at https://smallstep.com/docs/step-ca/webhooks/ but does not currently mention provisionerName. The field exists in the RequestBody struct (webhook/types.go:86) and is already populated for SCEP webhooks, but is undocumented.

In what environments or workflows is this feature supported?

All provisioner types that trigger X509 or SSH enriching/authorizing webhooks (ACME, JWK, OIDC, x5c, etc.). SCEP already works and is unchanged.

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Mar 23, 2026

CLA assistant check
All committers have signed the CLA.

@github-actions github-actions bot added the needs triage Waiting for discussion / prioritization by team label Mar 23, 2026
@maraino maraino merged commit 63590f0 into smallstep:master Mar 31, 2026
1 check passed
@maraino
Copy link
Copy Markdown
Contributor

maraino commented Mar 31, 2026

Thanks @Yannik, in PR #2631 I've changed the way to add the provisioner name is added using a new method RequestBodyOption, webhook.WithProvisionerName(prov). And merge that version, it also includes your commits.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs triage Waiting for discussion / prioritization by team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants