lordwelch/sshrimp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Show current CA key on login

Browse Source
This commit is contained in:
Timmy Welch 2023-01-14 18:30:28 -08:00
parent 5d7886db40
commit 0276f52b49
No known key found for this signature in database
2 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
internal/sshrimpagent/auth.go
View File

@ -2,6 +2,7 @@ package sshrimpagent
import (
"fmt"
"golang.org/x/crypto/ssh"
"net"
"net/http"
"net/url"
@ -22,12 +23,13 @@ var (
type OidcClient struct {
ListenAddress string
*http.Server
oidcMux *http.ServeMux
OIDCToken chan *oidc.Tokens
oidcMux *http.ServeMux
OIDCToken chan *oidc.Tokens
Certificate *ssh.Certificate
*config.SSHrimp
}
func newOIDCClient(c *config.SSHrimp) (OidcClient, error) {
func newOIDCClient(c *config.SSHrimp) (*OidcClient, error) {
if len(c.Agent.Scopes) < 1 {
c.Agent.Scopes = []string{"openid", "email", "profile"}
}
@ -38,7 +40,7 @@ func newOIDCClient(c *config.SSHrimp) (OidcClient, error) {
token_chan := make(chan *oidc.Tokens)
oidcMux := http.NewServeMux()
return OidcClient{
return &OidcClient{
oidcMux: oidcMux,
Server: &http.Server{
Addr: fmt.Sprintf("localhost:%d", c.Agent.Port),
@ -48,8 +50,9 @@ func newOIDCClient(c *config.SSHrimp) (OidcClient, error) {
WriteTimeout: time.Minute / 2,
IdleTimeout: time.Minute / 2,
},
OIDCToken: token_chan,
SSHrimp: c,
OIDCToken: token_chan,
Certificate: &ssh.Certificate{},
SSHrimp: c,
}, nil
}
@ -76,7 +79,7 @@ func (o *OidcClient) setupHandlers() error {
redirectURI := o.baseURI()
redirectURI.Path = "/auth/callback"
successURI := o.baseURI()
successURI.RawQuery = url.Values{"auth": []string{"success"}}.Encode()
successURI.Path = "/success"
// failURI := o.baseURI()
// failURI.RawQuery = url.Values{"auth":[]string{"fail"}}.Encode()
@ -108,9 +111,19 @@ func (o *OidcClient) setupHandlers() error {
// the AuthURLHandler creates the auth request and redirects the user to the auth server
// including state handling with secure cookie and the possibility to use PKCE
o.oidcMux.Handle("/login", rp.AuthURLHandler(state, provider))
// o.oidcMux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// fmt.Fprintln(w, "Return to the CLI.")
// }))
o.oidcMux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if o.Certificate != nil && o.Certificate.SignatureKey != nil {
fmt.Fprintf(w, "The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
Log.Printf("The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
}
}))
o.oidcMux.Handle(successURI.Path, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintln(w, "Return to the CLI.")
if o.Certificate != nil && o.Certificate.SignatureKey != nil {
fmt.Fprintf(w, "The SSH CA currently in use is: %s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
Log.Printf("The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
}
}))
// for demonstration purposes the returned userinfo response is written as JSON object onto response
marshalUserinfo := func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens, state string, rp rp.RelyingParty) {

4
internal/sshrimpagent/sshrimpagent.go
View File

@ -19,7 +19,7 @@ import (
var Log *logrus.Entry
type sshrimpAgent struct {
oidcClient OidcClient
oidcClient *OidcClient
signer ssh.Signer
certificate *ssh.Certificate
token *oidc.Tokens
@ -76,6 +76,7 @@ func (r *sshrimpAgent) authenticate() error {
func (r *sshrimpAgent) RemoveAll() error {
Log.Debugln("Removing identity token and certificate")
r.certificate = &ssh.Certificate{}
r.oidcClient.Certificate = r.certificate
r.token = nil
return nil
}
@ -117,6 +118,7 @@ func (r *sshrimpAgent) List() ([]*agent.Key, error) {
return nil, err
}
r.certificate = cert
r.oidcClient.Certificate = r.certificate
}
var ids []*agent.Key