Documentation
¶
Index ¶
- Constants
- Variables
- func GetProvidersConfigFromEnv() (map[string]ProviderConfig, error)
- func IdentityString(pkt pktoken.PKToken) (string, error)
- func NewProviderFromConfig(config ProviderConfig, openBrowser bool) (providers.OpenIdProvider, error)
- func PrettyIdToken(pkt pktoken.PKToken) (string, error)
- func ReadHome(username string) ([]byte, error)
- type AddCmd
- type LoginCmd
- type PolicyEnforcerFunc
- type ProviderConfig
- type VerifyCmd
Constants ¶
const OPKSSH_DEFAULT_ENVVAR = "OPKSSH_DEFAULT"
const OPKSSH_PROVIDERS_ENVVAR = "OPKSSH_PROVIDERS"
const WEBCHOOSER_ALIAS = "WEBCHOOSER"
Variables ¶
var DefaultProviderList = "google,https://accounts.google.com,206584157355-7cbe4s640tvm7naoludob4ut1emii7sf.apps.googleusercontent.com,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;" +
"microsoft,https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0,096ce0a3-5e72-4da8-9c86-12924b294a01;" +
"gitlab,https://gitlab.com,8d8b7024572c7fd501f64374dec6bba37096783dfcd792b3988104be08cb6923;" +
"hello,https://issuer.hello.coop,app_xejobTKEsDNSRd5vofKB2iay_2rN"
Functions ¶
func GetProvidersConfigFromEnv ¶ added in v0.5.0
func GetProvidersConfigFromEnv() (map[string]ProviderConfig, error)
GetProvidersConfigFromEnv is a function to retrieve the config from the env variables OPKSSH_DEFAULT can be set to an alias OPKSSH_PROVIDERS is a ; separated list of providers of the format <alias>,<issuer>,<client_id>,<client_secret>,<scopes>;<alias>,<issuer>,<client_id>,<client_secret>,<scopes>
func NewProviderFromConfig ¶ added in v0.5.0
func NewProviderFromConfig(config ProviderConfig, openBrowser bool) (providers.OpenIdProvider, error)
NewProviderFromConfig is a function to create the provider from the config
func ReadHome ¶
ReadHome is used to read the home policy file for the user with the specified username. This is used when opkssh is called by AuthorizedKeysCommand as the opksshuser and needs to use sudoer access to read the home policy file (`/home/<username>/opk/auth_id`). This function is only available on Linux and Darwin because it relies on syscall.Stat_t to determine the owner of the file.
Types ¶
type AddCmd ¶
type AddCmd struct {
HomePolicyLoader *policy.HomePolicyLoader
SystemPolicyLoader *policy.SystemPolicyLoader
// Username is the username to lookup when the system policy file cannot be
// read and we fallback to the user's policy file.
//
// See AddCmd.LoadPolicy for more details.
Username string
}
AddCmd provides functionality to read and update the opkssh policy file
func (*AddCmd) GetPolicyPath ¶
func (a *AddCmd) GetPolicyPath(principal string, userEmail string, issuer string) (string, bool, error)
GetPolicyPath returns the path to the policy file that the current command will write to and a boolean to flag the path is for home policy. True means home policy, false means system policy.
func (*AddCmd) LoadPolicy ¶
LoadPolicy reads the opkssh policy at the policy.SystemDefaultPolicyPath. If there is a permission error when reading this file, then the user's local policy file (defined as ~/.opk/auth_id where ~ maps to AddCmd.Username's home directory) is read instead.
If successful, returns the parsed policy and filepath used to read the policy. Otherwise, a non-nil error is returned.
type LoginCmd ¶ added in v0.4.0
func (*LoginCmd) Login ¶ added in v0.5.0
func (l *LoginCmd) Login(ctx context.Context, provider providers.OpenIdProvider, printIdToken bool, seckeyPath string) error
Login performs the OIDC login procedure and creates the SSH certs/keys in the default SSH key location.
func (*LoginCmd) LoginWithRefresh ¶ added in v0.5.0
func (l *LoginCmd) LoginWithRefresh(ctx context.Context, provider providers.RefreshableOpenIdProvider, printIdToken bool, seckeyPath string) error
LoginWithRefresh performs the OIDC login procedure, creates the SSH certs/keys in the default SSH key location, and continues to run and refresh the PKT (and create new SSH certs) indefinitely as its token expires. This function only returns if it encounters an error or if the supplied context is cancelled.
type PolicyEnforcerFunc ¶
PolicyEnforcerFunc returns nil if the supplied PK token is permitted to login as username. Otherwise, an error is returned indicating the reason for rejection
func OpkPolicyEnforcerFunc ¶
func OpkPolicyEnforcerFunc(username string) PolicyEnforcerFunc
OpkPolicyEnforcerAuthFunc returns an opkssh policy.Enforcer that can be used in the opkssh verify command.
type ProviderConfig ¶ added in v0.5.0
type ProviderConfig struct {
Alias string
Issuer string
ClientID string
ClientSecret string
Scopes []string
}
ProviderConfig is the representation of the provider config: {alias},{provider_url},{client_id},{client_secret},{scopes} client secret is optional, as well as scopes, if not provided, the default for secret is an empty string, for scopes is "openid profile email"
func NewProviderConfigFromString ¶ added in v0.5.0
func NewProviderConfigFromString(configStr string, hasAlias bool) (ProviderConfig, error)
NewProviderConfigFromString is a function to create the provider config from a string of the format {alias},{provider_url},{client_id},{client_secret},{scopes}
type VerifyCmd ¶
type VerifyCmd struct {
// PktVerifier is responsible for verifying the PK token
// contained in the SSH certificate
PktVerifier verifier.Verifier
// CheckPolicy determines whether the verified PK token is permitted to SSH as a
// specific user
CheckPolicy PolicyEnforcerFunc
}
VerifyCmd provides functionality to verify OPK tokens contained in SSH certificates and authorize requests to SSH as a specific username using a configurable authorization system. It is designed to be used in conjunction with sshd's AuthorizedKeysCommand feature.
func (*VerifyCmd) AuthorizedKeysCommand ¶
func (v *VerifyCmd) AuthorizedKeysCommand(ctx context.Context, userArg string, typArg string, certB64Arg string) (string, error)
This function is called by the SSH server as the AuthorizedKeysCommand:
The following lines are added to /etc/ssh/sshd_config:
AuthorizedKeysCommand /usr/local/bin/opkssh ver %u %k %t AuthorizedKeysCommandUser opksshuser
The parameters specified in the config map the parameters sent to the function below. We prepend "Arg" to specify which ones are arguments sent by sshd. They are:
%u The username (requested principal) - userArg %k The base64-encoded public key for authentication - certB64Arg - the public key is also a certificate %t The public key type - typArg - in this case a certificate being used as a public key
AuthorizedKeysCommand verifies the OPK PK token contained in the base64-encoded SSH pubkey; the pubkey is expected to be an SSH certificate. pubkeyType is used to determine how to parse the pubkey as one of the SSH certificate types.
This function: 1. Verifying the PK token with the OP (OpenID Provider) 2. Enforcing policy by checking if the identity is allowed to assume the username (principal) requested.
If all steps of verification succeed, then the expected authorized_keys file format string is returned (i.e. the expected line to produce on standard output when using sshd's AuthorizedKeysCommand feature). Otherwise, a non-nil error is returned.
Source Files