How to use the x509 auth flow using the go-sdk

[0xArch3r]

I have some questions on what is the intended flow and how to use the sdk in regards to the sampleuser certificates that get generated.

Essentially I want to just connect to openTDF as sampleuser using the certificates generated in keycloak provisioning.

Is there anyone that can shed some light on how this is supposed to be done

[pflynn-virtru]

Have you reviewed the tests here: https://github.com/opentdf/platform/blob/main/sdk/internal/oauth/oauth_test.go

[0xArch3r]

yes, i have reviewed those... the unit tests are indicative of how a consumer would implement things since it is directly accessing all of the internal structs and functions.

A consumer such as myself would have to instantiate everythin via sdk.New()

and when doing that the certificates and TLS Config passed to sdk.WithTLSCredentials() does not ever make it keycloak in the final request that DoCertExchange makes... it uses the config.TLSConfig instead of the config.certExchange TLS Config... I created an issue #1008 and explained it more in depth

[jrschumacher]

The issue #1008 reported by @0xArch3r was fixed in #1043. The tests linked in this thread are a good resource for implementing this approach.