awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 11:29:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add permissioning to SSH, add publicKey return for SSH CA, polish

Browse Source
This commit is contained in:
Tuan Dang
2024-12-03 17:38:23 -08:00
parent 4fc8c509ac
commit 07d9398aad
25 changed files with 397 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/ssh-certificate-authority-router.ts
+11 -4
View File
@@ -29,7 +29,9 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => {
}),
response: {
200: z.object({
ca: sanitizedSshCa
ca: sanitizedSshCa.extend({
publicKey: z.string()
})
})
}
},
@@ -74,7 +76,9 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => {
}),
response: {
200: z.object({
ca: sanitizedSshCa
ca: sanitizedSshCa.extend({
publicKey: z.string()
})
})
}
},
@@ -109,7 +113,7 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => {
method: "PATCH",
url: "/:sshCaId",
config: {
rateLimit: readLimit
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
@@ -118,6 +122,7 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => {
sshCaId: z.string().trim().describe(SSH_CERTIFICATE_AUTHORITIES.UPDATE.sshCaId)
}),
body: z.object({
friendlyName: z.string().optional().describe(SSH_CERTIFICATE_AUTHORITIES.UPDATE.friendlyName),
status: z
.enum([SshCaStatus.ACTIVE, SshCaStatus.DISABLED])
.optional()
@@ -125,7 +130,9 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => {
}),
response: {
200: z.object({
ca: sanitizedSshCa
ca: sanitizedSshCa.extend({
publicKey: z.string()
})
})
}
},
backend/src/ee/routes/v1/ssh-certificate-template-router.ts
+18 -2
View File
@@ -1,3 +1,4 @@
import slugify from "@sindresorhus/slugify";
import ms from "ms";
import { z } from "zod";
@@ -61,7 +62,14 @@ export const registerSshCertificateTemplateRouter = async (server: FastifyZodPro
schema: {
body: z.object({
sshCaId: z.string().describe(SSH_CERTIFICATE_TEMPLATES.CREATE.sshCaId),
name: z.string().min(1).describe(SSH_CERTIFICATE_TEMPLATES.CREATE.name),
name: z
.string()
.min(1)
.max(36)
.refine((v) => slugify(v) === v, {
message: "Name must be a valid slug"
})
.describe(SSH_CERTIFICATE_TEMPLATES.CREATE.name),
ttl: z
.string()
.refine((val) => ms(val) > 0, "TTL must be a positive number")
@@ -128,7 +136,15 @@ export const registerSshCertificateTemplateRouter = async (server: FastifyZodPro
},
schema: {
body: z.object({
name: z.string().min(1).optional().describe(SSH_CERTIFICATE_TEMPLATES.UPDATE.name),
name: z
.string()
.min(1)
.max(36)
.refine((v) => slugify(v) === v, {
message: "Slug must be a valid slug"
})
.optional()
.describe(SSH_CERTIFICATE_TEMPLATES.UPDATE.name),
ttl: z
.string()
.refine((val) => ms(val) > 0, "TTL must be a positive number")
backend/src/ee/routes/v1/ssh-router.ts
+34 -19
View File
@@ -3,7 +3,7 @@ import { z } from "zod";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types";
import { CERTIFICATE_AUTHORITIES, CERTIFICATE_TEMPLATES } from "@app/lib/api-docs"; // TODO: update to SSH CA
import { SSH_CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
import { writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
@@ -20,21 +20,27 @@ export const registerSshRouter = async (server: FastifyZodProvider) => {
schema: {
description: "Sign SSH public key",
body: z.object({
name: z.string(), // name of SSH certificate template
publicKey: z.string(),
certType: z.nativeEnum(SshCertType).default(SshCertType.USER),
principals: z.array(z.string().transform((val) => val.trim())).nonempty("Principals array must not be empty"),
templateName: z.string().trim().describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.templateName),
publicKey: z.string().trim().describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.publicKey),
certType: z
.nativeEnum(SshCertType)
.default(SshCertType.USER)
.describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.certType),
principals: z
.array(z.string().transform((val) => val.trim()))
.nonempty("Principals array must not be empty")
.describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.principals),
ttl: z
.string()
.refine((val) => ms(val) > 0, "TTL must be a positive number")
.optional()
.describe(CERTIFICATE_TEMPLATES.CREATE.ttl),
keyId: z.string().optional()
.describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.ttl),
keyId: z.string().trim().optional().describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.keyId)
}),
response: {
200: z.object({
serialNumber: z.string(),
signedKey: z.string()
serialNumber: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.serialNumber),
signedKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.SIGN_SSH_KEY.signedKey)
})
}
},
@@ -80,26 +86,35 @@ export const registerSshRouter = async (server: FastifyZodProvider) => {
schema: {
description: "Issue SSH credentials (certificate + key)",
body: z.object({
name: z.string(), // name of SSH certificate template
templateName: z.string().trim().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.templateName),
keyAlgorithm: z
.nativeEnum(CertKeyAlgorithm)
.default(CertKeyAlgorithm.RSA_2048)
.describe(CERTIFICATE_AUTHORITIES.CREATE.keyAlgorithm),
certType: z.nativeEnum(SshCertType).default(SshCertType.USER),
principals: z.array(z.string().transform((val) => val.trim())).nonempty("Principals array must not be empty"),
.describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.keyAlgorithm),
certType: z
.nativeEnum(SshCertType)
.default(SshCertType.USER)
.describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.certType),
principals: z
.array(z.string().transform((val) => val.trim()))
.nonempty("Principals array must not be empty")
.describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.principals),
ttl: z
.string()
.refine((val) => ms(val) > 0, "TTL must be a positive number")
.optional()
.describe(CERTIFICATE_TEMPLATES.CREATE.ttl),
keyId: z.string().optional()
.describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.ttl),
keyId: z.string().trim().optional()
}),
response: {
200: z.object({
serialNumber: z.string(),
signedKey: z.string(),
privateKey: z.string(),
keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
serialNumber: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.serialNumber),
signedKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.signedKey),
privateKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.privateKey),
publicKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.publicKey),
keyAlgorithm: z
.nativeEnum(CertKeyAlgorithm)
.describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.keyAlgorithm)
})
}
},
backend/src/ee/services/permission/org-permission.ts
+24 -6
View File
@@ -7,6 +7,15 @@ export enum OrgPermissionActions {
Delete = "delete"
}
export enum OrgPermissionSshCertificateTemplateActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
SignSshKey = "sign-ssh-key",
IssueSshCredentials = "issue-ssh-credentials"
}
export enum OrgPermissionAdminConsoleAction {
AccessAllProjects = "access-all-projects"
}
@@ -50,7 +59,7 @@ export type OrgPermissionSet =
| [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
| [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]
| [OrgPermissionActions, OrgPermissionSubjects.SshCertificateAuthorities]
| [OrgPermissionActions, OrgPermissionSubjects.SshCertificateTemplates];
| [OrgPermissionSshCertificateTemplateActions, OrgPermissionSubjects.SshCertificateTemplates];
const buildAdminPermission = () => {
const { can, rules } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -132,10 +141,17 @@ const buildAdminPermission = () => {
can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Create, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateTemplates);
can(
[
OrgPermissionSshCertificateTemplateActions.Read,
OrgPermissionSshCertificateTemplateActions.Create,
OrgPermissionSshCertificateTemplateActions.Edit,
OrgPermissionSshCertificateTemplateActions.Delete,
OrgPermissionSshCertificateTemplateActions.SignSshKey,
OrgPermissionSshCertificateTemplateActions.IssueSshCredentials
],
OrgPermissionSubjects.SshCertificateTemplates
);
can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole);
@@ -168,7 +184,9 @@ const buildMemberPermission = () => {
can(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.SignSshKey, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.IssueSshCredentials, OrgPermissionSubjects.SshCertificateTemplates);
return rules;
};
backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-dal.ts
+26 -1
View File
@@ -34,5 +34,30 @@ export const sshCertificateTemplateDALFactory = (db: TDbClient) => {
}
};
return { ...sshCertificateTemplateOrm, getById };
const getByName = async (name: string, orgId: string, tx?: Knex) => {
try {
const certTemplate = await (tx || db.replicaNode())(TableName.SshCertificateTemplate)
.join(
TableName.SshCertificateAuthority,
`${TableName.SshCertificateAuthority}.id`,
`${TableName.SshCertificateTemplate}.sshCaId`
)
.join(TableName.Organization, `${TableName.Organization}.id`, `${TableName.SshCertificateAuthority}.orgId`)
.where(`${TableName.SshCertificateTemplate}.name`, "=", name)
.where(`${TableName.Organization}.id`, "=", orgId)
.select(selectAllTableCols(TableName.SshCertificateTemplate))
.select(
db.ref("orgId").withSchema(TableName.SshCertificateAuthority),
db.ref("friendlyName").as("caName").withSchema(TableName.SshCertificateAuthority),
db.ref("status").as("caStatus").withSchema(TableName.SshCertificateAuthority)
)
.first();
return certTemplate;
} catch (error) {
throw new DatabaseError({ error, name: "Get SSH certificate template by name" });
}
};
return { ...sshCertificateTemplateOrm, getById, getByName };
};
backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts
+27 -8
View File
@@ -1,7 +1,10 @@
import { ForbiddenError } from "@casl/ability";
import ms from "ms";
import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
import {
OrgPermissionSshCertificateTemplateActions,
OrgPermissionSubjects
} from "@app/ee/services/permission/org-permission";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -58,10 +61,17 @@ export const sshCertificateTemplateServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Create,
OrgPermissionSshCertificateTemplateActions.Create,
OrgPermissionSubjects.SshCertificateTemplates
);
const existingTemplate = await sshCertificateTemplateDAL.getByName(name, ca.orgId);
if (existingTemplate) {
throw new BadRequestError({
message: `SSH certificate template with name ${name} already exists`
});
}
if (ms(ttl) > ms(maxTTL)) {
throw new BadRequestError({
message: "TTL cannot be greater than max TTL"
@@ -114,10 +124,19 @@ export const sshCertificateTemplateServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Edit,
OrgPermissionSubjects.SshCertificateAuthorities
OrgPermissionSshCertificateTemplateActions.Edit,
OrgPermissionSubjects.SshCertificateTemplates
);
if (name) {
const existingTemplate = await sshCertificateTemplateDAL.getByName(name, actorOrgId);
if (existingTemplate) {
throw new BadRequestError({
message: `SSH certificate template with name ${name} already exists`
});
}
}
if (ms(ttl || certTemplate.ttl) > ms(maxTTL || certTemplate.maxTTL)) {
throw new BadRequestError({
message: "TTL cannot be greater than max TTL"
@@ -164,8 +183,8 @@ export const sshCertificateTemplateServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Delete,
OrgPermissionSubjects.SshCertificateAuthorities
OrgPermissionSshCertificateTemplateActions.Delete,
OrgPermissionSubjects.SshCertificateTemplates
);
await sshCertificateTemplateDAL.deleteById(certificateTemplate.id);
@@ -190,8 +209,8 @@ export const sshCertificateTemplateServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Read,
OrgPermissionSubjects.SshCertificateAuthorities
OrgPermissionSshCertificateTemplateActions.Read,
OrgPermissionSubjects.SshCertificateTemplates
);
return certTemplate;
backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts
+30 -2
View File
@@ -67,6 +67,32 @@ export const createSshKeyPair = (keyAlgorithm: CertKeyAlgorithm, comment: string
return { publicKey, privateKey };
};
/**
* Return the SSH public key for the given SSH private key.
* @param privateKey - The SSH private key to get the public key for
*/
export const getSshPublicKey = (privateKey: string) => {
const uniqueId = crypto.randomBytes(8).toString("hex");
const privateKeyFile = `ssh_key_${uniqueId}`;
const publicKeyFile = `${privateKeyFile}.pub`;
if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
fs.writeFileSync(privateKeyFile, privateKey);
fs.chmodSync(privateKeyFile, 0o600);
const command = `ssh-keygen -y -f ${privateKeyFile} > ${publicKeyFile}`;
execSync(command);
const publicKey = fs.readFileSync(publicKeyFile, "utf8");
fs.unlinkSync(privateKeyFile);
fs.unlinkSync(publicKeyFile);
return publicKey;
};
/**
* Validate the requested SSH certificate type based on the SSH certificate template configuration.
* @param template - The SSH certificate template configuration
@@ -160,9 +186,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
const uniqueId = crypto.randomBytes(8).toString("hex");
const publicKeyFile = `user_key_${uniqueId}.pub`;
const privateKeyFile = `ssh_ca_key_${uniqueId}`;
const signedPublicKeyFile = `user_key_${uniqueId}-cert.pub`;
if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
if (fs.existsSync(signedPublicKeyFile)) fs.unlinkSync(signedPublicKeyFile);
// write public and private keys to temp files
fs.writeFileSync(publicKeyFile, userPublicKey);
@@ -170,7 +198,6 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
fs.chmodSync(privateKeyFile, 0o600);
const serialNumber = createSshCertSerialNumber();
console.log("signSshKey serialNumber: ", serialNumber);
const certOptions = [
`-s ${privateKeyFile}`, // path to SSH CA private key
@@ -189,10 +216,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
// Execute the signing process
execSync(command);
const signedPublicKey = fs.readFileSync(publicKeyFile, "utf8");
const signedPublicKey = fs.readFileSync(signedPublicKeyFile, "utf8");
fs.unlinkSync(publicKeyFile);
fs.unlinkSync(privateKeyFile);
fs.unlinkSync(signedPublicKeyFile);
return { serialNumber, signedPublicKey };
};
backend/src/ee/services/ssh/ssh-certificate-authority-service.ts
+74 -27
View File
@@ -1,6 +1,10 @@
import { ForbiddenError } from "@casl/ability";
import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
import {
OrgPermissionActions,
OrgPermissionSshCertificateTemplateActions,
OrgPermissionSubjects
} from "@app/ee/services/permission/org-permission";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal";
@@ -12,6 +16,7 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
import {
createSshCert,
createSshKeyPair,
getSshPublicKey,
validateSshCertificatePrincipals,
validateSshCertificateTtl,
validateSshCertificateType
@@ -33,7 +38,7 @@ type TSshCertificateAuthorityServiceFactoryDep = {
"transaction" | "create" | "findById" | "updateById" | "deleteById" | "findOne"
>;
sshCertificateAuthoritySecretDAL: Pick<TSshCertificateAuthoritySecretDALFactory, "create" | "findOne">;
sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find" | "findOne">;
sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find" | "getByName">;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction">;
kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey" | "getOrgKmsKeyId">;
permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
@@ -76,14 +81,14 @@ export const sshCertificateAuthorityServiceFactory = ({
const ca = await sshCertificateAuthorityDAL.create(
{
orgId: actorOrgId,
friendlyName: friendlyName || "",
friendlyName,
status: SshCaStatus.ACTIVE,
keyAlgorithm
},
tx
);
const { privateKey } = createSshKeyPair(keyAlgorithm, ca.friendlyName);
const { publicKey, privateKey } = createSshKeyPair(keyAlgorithm, ca.friendlyName);
const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
const kmsEncryptor = await kmsService.encryptWithKmsKey({
@@ -102,7 +107,7 @@ export const sshCertificateAuthorityServiceFactory = ({
tx
);
return ca;
return { ...ca, publicKey };
});
return newCa;
@@ -118,7 +123,7 @@ export const sshCertificateAuthorityServiceFactory = ({
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
actorOrgId,
ca.orgId,
actorAuthMethod,
actorOrgId
);
@@ -128,21 +133,43 @@ export const sshCertificateAuthorityServiceFactory = ({
OrgPermissionSubjects.SshCertificateAuthorities
);
return ca;
const sshCaSecret = await sshCertificateAuthoritySecretDAL.findOne({ sshCaId: ca.id });
// decrypt secret
const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
const kmsDecryptor = await kmsService.decryptWithKmsKey({
kmsId: orgKmsKeyId
});
const decryptedCaPrivateKey = await kmsDecryptor({
cipherTextBlob: sshCaSecret.encryptedPrivateKey
});
const publicKey = getSshPublicKey(decryptedCaPrivateKey.toString("utf-8"));
return { ...ca, publicKey };
};
/**
* Update SSH CA with id [caId]
* Note: Used to enable/disable CA
*/
const updateSshCaById = async ({ caId, status, actor, actorId, actorAuthMethod, actorOrgId }: TUpdateSshCaDTO) => {
const updateSshCaById = async ({
caId,
friendlyName,
status,
actor,
actorId,
actorAuthMethod,
actorOrgId
}: TUpdateSshCaDTO) => {
const ca = await sshCertificateAuthorityDAL.findById(caId);
if (!ca) throw new NotFoundError({ message: `SSH CA with ID '${caId}' not found` });
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
actorOrgId,
ca.orgId,
actorAuthMethod,
actorOrgId
);
@@ -152,9 +179,23 @@ export const sshCertificateAuthorityServiceFactory = ({
OrgPermissionSubjects.SshCertificateAuthorities
);
const updatedCa = await sshCertificateAuthorityDAL.updateById(caId, { status });
const updatedCa = await sshCertificateAuthorityDAL.updateById(caId, { friendlyName, status });
return updatedCa;
const sshCaSecret = await sshCertificateAuthoritySecretDAL.findOne({ sshCaId: ca.id });
// decrypt secret
const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
const kmsDecryptor = await kmsService.decryptWithKmsKey({
kmsId: orgKmsKeyId
});
const decryptedCaPrivateKey = await kmsDecryptor({
cipherTextBlob: sshCaSecret.encryptedPrivateKey
});
const publicKey = getSshPublicKey(decryptedCaPrivateKey.toString("utf-8"));
return { ...updatedCa, publicKey };
};
/**
@@ -167,7 +208,7 @@ export const sshCertificateAuthorityServiceFactory = ({
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
actorOrgId,
ca.orgId,
actorAuthMethod,
actorOrgId
);
@@ -184,10 +225,10 @@ export const sshCertificateAuthorityServiceFactory = ({
/**
* Return SSH certificate and corresponding new SSH public-private key pair where
* SSH public key is signed using CA behind SSH certificate with name [name].
* SSH public key is signed using CA behind SSH certificate with name [templateName].
*/
const issueSshCreds = async ({
name,
templateName,
keyAlgorithm,
certType,
principals,
@@ -198,7 +239,13 @@ export const sshCertificateAuthorityServiceFactory = ({
actorAuthMethod,
actorOrgId
}: TIssueSshCredsDTO) => {
// TODO: proper permission check
const sshCertificateTemplate = await sshCertificateTemplateDAL.getByName(templateName, actorOrgId);
if (!sshCertificateTemplate) {
throw new NotFoundError({
message: "No SSH certificate template found with specified name"
});
}
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
@@ -208,13 +255,10 @@ export const sshCertificateAuthorityServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Create,
OrgPermissionSshCertificateTemplateActions.IssueSshCredentials,
OrgPermissionSubjects.SshCertificateTemplates
);
// TODO: adjust to find within org
const sshCertificateTemplate = await sshCertificateTemplateDAL.findOne({ name });
// validate if the requested [certType] is allowed under the template configuration
validateSshCertificateType(sshCertificateTemplate, certType);
@@ -266,10 +310,10 @@ export const sshCertificateAuthorityServiceFactory = ({
/**
* Return SSH certificate by signing SSH public key [publicKey]
* using CA behind SSH certificate template with name [name]
* using CA behind SSH certificate template with name [templateName]
*/
const signSshKey = async ({
name,
templateName,
publicKey,
certType,
principals,
@@ -280,7 +324,13 @@ export const sshCertificateAuthorityServiceFactory = ({
actorAuthMethod,
actorOrgId
}: TSignSshKeyDTO) => {
// TODO: proper permission check
const sshCertificateTemplate = await sshCertificateTemplateDAL.getByName(templateName, actorOrgId);
if (!sshCertificateTemplate) {
throw new NotFoundError({
message: "No SSH certificate template found with specified name"
});
}
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
@@ -290,13 +340,10 @@ export const sshCertificateAuthorityServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Create,
OrgPermissionSshCertificateTemplateActions.SignSshKey,
OrgPermissionSubjects.SshCertificateTemplates
);
// TODO: adjust to find within org
const sshCertificateTemplate = await sshCertificateTemplateDAL.findOne({ name });
// validate if the requested [certType] is allowed under the template configuration
validateSshCertificateType(sshCertificateTemplate, certType);
@@ -354,7 +401,7 @@ export const sshCertificateAuthorityServiceFactory = ({
);
ForbiddenError.from(permission).throwUnlessCan(
OrgPermissionActions.Read,
OrgPermissionSshCertificateTemplateActions.Read,
OrgPermissionSubjects.SshCertificateTemplates
);
backend/src/ee/services/ssh/ssh-certificate-authority-types.ts
+4 -3
View File
@@ -12,7 +12,7 @@ export enum SshCertType {
}
export type TCreateSshCaDTO = {
friendlyName?: string;
friendlyName: string;
keyAlgorithm: CertKeyAlgorithm;
} & Omit<TOrgPermission, "orgId">;
@@ -22,6 +22,7 @@ export type TGetSshCaDTO = {
export type TUpdateSshCaDTO = {
caId: string;
friendlyName?: string;
status?: SshCaStatus;
} & Omit<TOrgPermission, "orgId">;
@@ -30,7 +31,7 @@ export type TDeleteSshCaDTO = {
} & Omit<TOrgPermission, "orgId">;
export type TIssueSshCredsDTO = {
name: string; // name of SSH certificate template
templateName: string;
keyAlgorithm: CertKeyAlgorithm;
certType: SshCertType;
principals: string[];
@@ -39,7 +40,7 @@ export type TIssueSshCredsDTO = {
} & Omit<TOrgPermission, "orgId">;
export type TSignSshKeyDTO = {
name: string; // name of SSH certificate template
templateName: string;
publicKey: string;
certType: SshCertType;
principals: string[];
backend/src/lib/api-docs/constants.ts
+23
View File
@@ -1148,6 +1148,7 @@ export const SSH_CERTIFICATE_AUTHORITIES = {
},
UPDATE: {
sshCaId: "The ID of the SSH CA to update.",
friendlyName: "A friendly name for the SSH CA to update to.",
status: "The status of the SSH CA to update to. This can be one of active or disabled."
},
DELETE: {
@@ -1155,6 +1156,28 @@ export const SSH_CERTIFICATE_AUTHORITIES = {
},
GET_CERTIFICATE_TEMPLATES: {
sshCaId: "The ID of the SSH CA to get the certificate templates for."
},
SIGN_SSH_KEY: {
templateName: "The name of the SSH certificate template to sign the SSH public key with.",
publicKey: "The SSH public key to sign.",
certType: "The type of certificate to issue. This can be one of user or host.",
principals: "The list of principals (usernames, hostnames) to include in the certificate.",
ttl: "The time to live for the certificate such as 1m, 1h, 1d, ... If not specified, the default TTL for the template will be used.",
keyId: "The key ID to include in the certificate. If not specified, a default key ID will be generated.",
serialNumber: "The serial number of the issued SSH certificate.",
signedKey: "The SSH certificate or signed SSH public key."
},
ISSUE_SSH_CREDENTIALS: {
templateName: "The name of the SSH certificate template to issue the SSH credentials with.",
keyAlgorithm: "The type of public key algorithm and size, in bits, of the key pair for the SSH CA.",
certType: "The type of certificate to issue. This can be one of user or host.",
principals: "The list of principals (usernames, hostnames) to include in the certificate.",
ttl: "The time to live for the certificate such as 1m, 1h, 1d, ... If not specified, the default TTL for the template will be used.",
keyId: "The key ID to include in the certificate. If not specified, a default key ID will be generated.",
serialNumber: "The serial number of the issued SSH certificate.",
signedKey: "The SSH certificate or signed SSH public key.",
privateKey: "The private key corresponding to the issued SSH certificate.",
publicKey: "The public key of the issued SSH certificate."
}
};