lordwelch/sshrimp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Show current CA key on login

Browse Source
This commit is contained in:
Timmy Welch 2023-01-14 18:30:28 -08:00
parent 5d7886db40
commit 0276f52b49
No known key found for this signature in database
2 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
internal/sshrimpagent/auth.go
View File

@ -2,6 +2,7 @@ package sshrimpagent
import ( import (
"fmt" "fmt"
"golang.org/x/crypto/ssh"
"net" "net"
"net/http" "net/http"
"net/url" "net/url"
@ -22,12 +23,13 @@ var (
type OidcClient struct { type OidcClient struct {
ListenAddress string ListenAddress string
*http.Server *http.Server
oidcMux *http.ServeMux oidcMux *http.ServeMux
OIDCToken chan *oidc.Tokens OIDCToken chan *oidc.Tokens
Certificate *ssh.Certificate
*config.SSHrimp *config.SSHrimp
} }
func newOIDCClient(c *config.SSHrimp) (OidcClient, error) { func newOIDCClient(c *config.SSHrimp) (*OidcClient, error) {
if len(c.Agent.Scopes) < 1 { if len(c.Agent.Scopes) < 1 {
c.Agent.Scopes = []string{"openid", "email", "profile"} c.Agent.Scopes = []string{"openid", "email", "profile"}
} }
@ -38,7 +40,7 @@ func newOIDCClient(c *config.SSHrimp) (OidcClient, error) {
token_chan := make(chan *oidc.Tokens) token_chan := make(chan *oidc.Tokens)
oidcMux := http.NewServeMux() oidcMux := http.NewServeMux()
return OidcClient{ return &OidcClient{
oidcMux: oidcMux, oidcMux: oidcMux,
Server: &http.Server{ Server: &http.Server{
Addr: fmt.Sprintf("localhost:%d", c.Agent.Port), Addr: fmt.Sprintf("localhost:%d", c.Agent.Port),
@ -48,8 +50,9 @@ func newOIDCClient(c *config.SSHrimp) (OidcClient, error) {
WriteTimeout: time.Minute / 2, WriteTimeout: time.Minute / 2,
IdleTimeout: time.Minute / 2, IdleTimeout: time.Minute / 2,
}, },
OIDCToken: token_chan, OIDCToken: token_chan,
SSHrimp: c, Certificate: &ssh.Certificate{},
SSHrimp: c,
}, nil }, nil
} }
@ -76,7 +79,7 @@ func (o *OidcClient) setupHandlers() error {
redirectURI := o.baseURI() redirectURI := o.baseURI()
redirectURI.Path = "/auth/callback" redirectURI.Path = "/auth/callback"
successURI := o.baseURI() successURI := o.baseURI()
successURI.RawQuery = url.Values{"auth": []string{"success"}}.Encode() successURI.Path = "/success"
// failURI := o.baseURI() // failURI := o.baseURI()
// failURI.RawQuery = url.Values{"auth":[]string{"fail"}}.Encode() // failURI.RawQuery = url.Values{"auth":[]string{"fail"}}.Encode()
@ -108,9 +111,19 @@ func (o *OidcClient) setupHandlers() error {
// the AuthURLHandler creates the auth request and redirects the user to the auth server // the AuthURLHandler creates the auth request and redirects the user to the auth server
// including state handling with secure cookie and the possibility to use PKCE // including state handling with secure cookie and the possibility to use PKCE
o.oidcMux.Handle("/login", rp.AuthURLHandler(state, provider)) o.oidcMux.Handle("/login", rp.AuthURLHandler(state, provider))
// o.oidcMux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { o.oidcMux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// fmt.Fprintln(w, "Return to the CLI.") if o.Certificate != nil && o.Certificate.SignatureKey != nil {
// })) fmt.Fprintf(w, "The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
Log.Printf("The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
}
}))
o.oidcMux.Handle(successURI.Path, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintln(w, "Return to the CLI.")
if o.Certificate != nil && o.Certificate.SignatureKey != nil {
fmt.Fprintf(w, "The SSH CA currently in use is: %s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
Log.Printf("The SSH CA currently in use is:\n%s", ssh.MarshalAuthorizedKey(o.Certificate.SignatureKey))
}
}))
// for demonstration purposes the returned userinfo response is written as JSON object onto response // for demonstration purposes the returned userinfo response is written as JSON object onto response
marshalUserinfo := func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens, state string, rp rp.RelyingParty) { marshalUserinfo := func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens, state string, rp rp.RelyingParty) {

4
internal/sshrimpagent/sshrimpagent.go
View File

@ -19,7 +19,7 @@ import (
var Log *logrus.Entry var Log *logrus.Entry
type sshrimpAgent struct { type sshrimpAgent struct {
oidcClient OidcClient oidcClient *OidcClient
signer ssh.Signer signer ssh.Signer
certificate *ssh.Certificate certificate *ssh.Certificate
token *oidc.Tokens token *oidc.Tokens
@ -76,6 +76,7 @@ func (r *sshrimpAgent) authenticate() error {
func (r *sshrimpAgent) RemoveAll() error { func (r *sshrimpAgent) RemoveAll() error {
Log.Debugln("Removing identity token and certificate") Log.Debugln("Removing identity token and certificate")
r.certificate = &ssh.Certificate{} r.certificate = &ssh.Certificate{}
r.oidcClient.Certificate = r.certificate
r.token = nil r.token = nil
return nil return nil
} }
@ -117,6 +118,7 @@ func (r *sshrimpAgent) List() ([]*agent.Key, error) {
return nil, err return nil, err
} }
r.certificate = cert r.certificate = cert
r.oidcClient.Certificate = r.certificate
} }
var ids []*agent.Key var ids []*agent.Key