Documentation
¶
Index ¶
- Variables
- func Command() error
- func InitCertificateAccessor(db *sqlx.DB) certdb.Accessor
- func InitUserRegistry(cfg *Config) error
- func NewAuthWrapper(path string, handler http.Handler, err error) (string, http.Handler, error)
- func NewEnrollHandler() (h http.Handler, err error)
- func NewReenrollHandler() (h http.Handler, err error)
- func NewRegisterHandler() (h http.Handler, err error)
- func NewRevokeHandler() (h http.Handler, err error)
- func NewTCertHandler() (h http.Handler, err error)
- func SignerFromConfigAndDB(c cli.Config, db *sqlx.DB) (signer.Signer, error)
- func Start(dir string, cfg string)
- type Accessor
- func (d *Accessor) DeleteGroup(name string) error
- func (d *Accessor) DeleteUser(id string) error
- func (d *Accessor) GetGroup(name string) (spi.Group, error)
- func (d *Accessor) GetRootGroup() (spi.Group, error)
- func (d *Accessor) GetUser(id string, attrs []string) (spi.User, error)
- func (d *Accessor) GetUserInfo(id string) (spi.UserInfo, error)
- func (d *Accessor) InsertGroup(name string, parentID string) error
- func (d *Accessor) InsertUser(user spi.UserInfo) error
- func (d *Accessor) SetDB(db *sqlx.DB)
- func (d *Accessor) UpdateUser(user spi.UserInfo) error
- type Bootstrap
- type CertDBAccessor
- func (d *CertDBAccessor) GetCertificate(serial, aki string) (crs []certdb.CertificateRecord, err error)
- func (d *CertDBAccessor) GetCertificatesByID(id string) (crs []CertRecord, err error)
- func (d *CertDBAccessor) GetOCSP(serial, aki string) (ors []certdb.OCSPRecord, err error)
- func (d *CertDBAccessor) GetUnexpiredCertificates() (crs []certdb.CertificateRecord, err error)
- func (d *CertDBAccessor) GetUnexpiredOCSPs() (ors []certdb.OCSPRecord, err error)
- func (d *CertDBAccessor) InsertCertificate(cr certdb.CertificateRecord) error
- func (d *CertDBAccessor) InsertOCSP(rr certdb.OCSPRecord) error
- func (d *CertDBAccessor) RevokeCertificate(serial, aki string, reasonCode int) error
- func (d *CertDBAccessor) RevokeCertificatesByID(id string, reasonCode int) (crs []CertRecord, err error)
- func (d *CertDBAccessor) SetDB(db *sqlx.DB)
- func (d *CertDBAccessor) UpdateOCSP(serial, aki, body string, expiry time.Time) error
- func (d *CertDBAccessor) UpsertOCSP(serial, aki, body string, expiry time.Time) error
- type CertRecord
- type Config
- type DBUser
- type GroupRecord
- type Register
- type Server
- type TLSConfig
- type User
- type UserRecord
- type UserReg
Constants ¶
This section is empty.
Variables ¶
var InitServerCommand = &cli.Command{UsageText: initUsageText, Flags: initFlags, Main: initMain}
InitServerCommand assembles the definition of Command 'genkey -initca CSRJSON'
var StartCommand = &cli.Command{UsageText: serverUsageText, Flags: serverFlags, Main: startMain}
StartCommand assembles the definition of Command 'cop server start'
var (
// V1APIPrefix is the prefix of all CFSSL V1 API Endpoints.
V1APIPrefix = "/api/v1/cfssl/"
)
Functions ¶
func Command ¶
func Command() error
Command defines the server-related commands and calls cli.Start to process args
func InitCertificateAccessor ¶
InitCertificateAccessor extends CFSSL database APIs for Certificates table
func InitUserRegistry ¶
InitUserRegistry is the factory method for the user registry. If LDAP is configured, then LDAP is used for the user registry; otherwise, the CFSSL DB which is used for the certificates table is used.
func NewAuthWrapper ¶
NewAuthWrapper is auth wrapper constructor Only the "sign" and "enroll" URIs use basic auth for the enrollment secret The others require a token
func NewEnrollHandler ¶
NewEnrollHandler is the constructor for the enroll handler
func NewReenrollHandler ¶
NewReenrollHandler is the constructor for the reenroll handler
func NewRegisterHandler ¶
NewRegisterHandler is constructor for register handler
func NewRevokeHandler ¶
NewRevokeHandler is constructor for revoke handler
func NewTCertHandler ¶
NewTCertHandler is constructor for tcert handler
func SignerFromConfigAndDB ¶
SignerFromConfigAndDB takes the Config and creates the appropriate signer.Signer object with a specified db
Types ¶
type Accessor ¶
type Accessor struct {
// contains filtered or unexported fields
}
Accessor implements db.Accessor interface.
func NewDBAccessor ¶
func NewDBAccessor() *Accessor
NewDBAccessor is a constructor for the database API
func (*Accessor) DeleteGroup ¶
DeleteGroup deletes group from database
func (*Accessor) DeleteUser ¶
DeleteUser deletes user from database
func (*Accessor) GetRootGroup ¶
GetRootGroup gets root group from database
func (*Accessor) GetUserInfo ¶
GetUserInfo gets user information from database
func (*Accessor) InsertGroup ¶
InsertGroup inserts group into database
func (*Accessor) InsertUser ¶
InsertUser inserts user into database
type Bootstrap ¶
type Bootstrap struct {
}
Bootstrap is used for bootstrapping database
func BootstrapDB ¶
func BootstrapDB() *Bootstrap
BootstrapDB is a constructor to bootstrap the database at server startup
func (*Bootstrap) PopulateGroupsTable ¶
func (b *Bootstrap) PopulateGroupsTable()
PopulateGroupsTable populates affiliation groups table based on the groups defined in the server configuration file
func (*Bootstrap) PopulateUsersTable ¶
PopulateUsersTable populates the user table with the users defined in the server configuration file
type CertDBAccessor ¶
type CertDBAccessor struct {
// contains filtered or unexported fields
}
CertDBAccessor implements certdb.Accessor interface.
func NewCertDBAccessor ¶
func NewCertDBAccessor(db *sqlx.DB) *CertDBAccessor
NewCertDBAccessor returns a new Accessor.
func (*CertDBAccessor) GetCertificate ¶
func (d *CertDBAccessor) GetCertificate(serial, aki string) (crs []certdb.CertificateRecord, err error)
GetCertificate gets a CertificateRecord indexed by serial.
func (*CertDBAccessor) GetCertificatesByID ¶
func (d *CertDBAccessor) GetCertificatesByID(id string) (crs []CertRecord, err error)
GetCertificatesByID gets a CertificateRecord indexed by id.
func (*CertDBAccessor) GetOCSP ¶
func (d *CertDBAccessor) GetOCSP(serial, aki string) (ors []certdb.OCSPRecord, err error)
GetOCSP retrieves a certdb.OCSPRecord from db by serial.
func (*CertDBAccessor) GetUnexpiredCertificates ¶
func (d *CertDBAccessor) GetUnexpiredCertificates() (crs []certdb.CertificateRecord, err error)
GetUnexpiredCertificates gets all unexpired certificate from db.
func (*CertDBAccessor) GetUnexpiredOCSPs ¶
func (d *CertDBAccessor) GetUnexpiredOCSPs() (ors []certdb.OCSPRecord, err error)
GetUnexpiredOCSPs retrieves all unexpired certdb.OCSPRecord from db.
func (*CertDBAccessor) InsertCertificate ¶
func (d *CertDBAccessor) InsertCertificate(cr certdb.CertificateRecord) error
InsertCertificate puts a CertificateRecord into db.
func (*CertDBAccessor) InsertOCSP ¶
func (d *CertDBAccessor) InsertOCSP(rr certdb.OCSPRecord) error
InsertOCSP puts a new certdb.OCSPRecord into the db.
func (*CertDBAccessor) RevokeCertificate ¶
func (d *CertDBAccessor) RevokeCertificate(serial, aki string, reasonCode int) error
RevokeCertificate updates a certificate with a given serial number and marks it revoked.
func (*CertDBAccessor) RevokeCertificatesByID ¶
func (d *CertDBAccessor) RevokeCertificatesByID(id string, reasonCode int) (crs []CertRecord, err error)
RevokeCertificatesByID updates all certificates for a given ID and marks them revoked.
func (*CertDBAccessor) SetDB ¶
func (d *CertDBAccessor) SetDB(db *sqlx.DB)
SetDB changes the underlying sql.DB object Accessor is manipulating.
func (*CertDBAccessor) UpdateOCSP ¶
func (d *CertDBAccessor) UpdateOCSP(serial, aki, body string, expiry time.Time) error
UpdateOCSP updates a ocsp response record with a given serial number.
func (*CertDBAccessor) UpsertOCSP ¶
func (d *CertDBAccessor) UpsertOCSP(serial, aki, body string, expiry time.Time) error
UpsertOCSP update a ocsp response record with a given serial number, or insert the record if it doesn't yet exist in the db
type CertRecord ¶
type CertRecord struct {
ID string `db:"id"`
certdb.CertificateRecord
}
CertRecord extends CFSSL CertificateRecord by adding an enrollment ID to the record
type Config ¶
type Config struct {
Debug bool `json:"debug,omitempty"`
Authentication bool `json:"authentication,omitempty"`
Users map[string]*User `json:"users,omitempty"`
DBdriver string `json:"driver"`
DataSource string `json:"data_source"`
UsrReg UserReg `json:"user_registry"`
LDAP *ldap.Config `json:"ldap,omitempty"`
CAFile string `json:"ca_cert"`
KeyFile string `json:"ca_key"`
TLSConf TLSConfig `json:"tls,omitempty"`
TLSDisable bool `json:"tls_disable,omitempty"`
}
Config is COP config structure
var CFG *Config
CFG is the COP-specific config
type DBUser ¶
DBUser is the databases representation of a user
func (*DBUser) GetAffiliationPath ¶
GetAffiliationPath returns the complete path for the user's affiliation.
func (*DBUser) GetAttribute ¶
GetAttribute returns the value for an attribute name
type GroupRecord ¶
type GroupRecord struct {
Name string `db:"name"`
ParentID string `db:"parent_id"`
Prekey string `db:"prekey"`
}
GroupRecord defines the properties of a group
type Register ¶
type Register struct {
// contains filtered or unexported fields
}
Register for registering a user
type Server ¶
type Server struct {
}
Server ...
func (*Server) CreateHome ¶
CreateHome will create a home directory if it does not exist
type TLSConfig ¶
type TLSConfig struct {
TLSCertFile string `json:"tls_cert,omitempty"`
TLSKeyFile string `json:"tls_key,omitempty"`
MutualTLSCAFile string `json:"mutual_tls_ca,omitempty"`
DBClient tls.ClientTLSConfig `json:"db_client,omitempty"`
}
TLSConfig defines the files needed for a TLS connection
type User ¶
type User struct {
Pass string `json:"pass"` // enrollment secret
Type string `json:"type"`
Group string `json:"group"`
Attributes []api.Attribute `json:"attrs,omitempty"`
}
User information