-
Notifications
You must be signed in to change notification settings - Fork 0
/
identity.go
138 lines (118 loc) · 3.82 KB
/
identity.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
/*
Copyright 2016 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package client
import (
"io"
"io/ioutil"
"os"
"github.com/gravitational/teleport/lib/auth/native"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/sshutils"
"github.com/gravitational/trace"
)
// NewKey generates a new unsigned key. Such key must be signed by a
// Teleport CA (auth server) before it becomes useful.
func NewKey() (key *Key, err error) {
priv, pub, err := native.GenerateKeyPair("")
if err != nil {
return nil, trace.Wrap(err)
}
return &Key{
Priv: priv,
Pub: pub,
}, nil
}
// IdentityFileFormat describes possible file formats how a user identity can be sotred
type IdentityFileFormat string
const (
// IdentityFormatFile is when a key + cert are stored concatenated into a single file
IdentityFormatFile IdentityFileFormat = "file"
// IdentityFormatOpenSSH is OpenSSH-compatible format, when a key and a cert are stored in
// two different files (in the same directory)
IdentityFormatOpenSSH IdentityFileFormat = "openssh"
// DefaultIdentityFormat is what Teleport uses by default
DefaultIdentityFormat = IdentityFormatFile
)
// MakeIdentityFile takes a username + their credentials and saves them to disk
// in a specified format
func MakeIdentityFile(filePath string, key *Key, format IdentityFileFormat, certAuthorities []services.CertAuthority) (err error) {
const (
// the files and the dir will be created with these permissions:
fileMode = 0600
dirMode = 0700
)
if filePath == "" {
return trace.BadParameter("identity location is not specified")
}
var output io.Writer = os.Stdout
switch format {
// dump user identity into a single file:
case IdentityFormatFile:
f, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fileMode)
if err != nil {
return trace.Wrap(err)
}
output = f
defer f.Close()
// write key:
if _, err = output.Write(key.Priv); err != nil {
return trace.Wrap(err)
}
// append ssh cert:
if _, err = output.Write(key.Cert); err != nil {
return trace.Wrap(err)
}
// append tls cert:
if _, err = output.Write(key.TLSCert); err != nil {
return trace.Wrap(err)
}
// append trusted host certificate authorities
for _, ca := range certAuthorities {
// append ssh ca certificates
for _, publicKey := range ca.GetCheckingKeys() {
data, err := sshutils.MarshalAuthorizedHostsFormat(ca.GetClusterName(), publicKey, nil)
if err != nil {
return trace.Wrap(err)
}
if _, err = output.Write([]byte(data)); err != nil {
return trace.Wrap(err)
}
if _, err = output.Write([]byte("\n")); err != nil {
return trace.Wrap(err)
}
}
// append tls ca certificates
for _, keyPair := range ca.GetTLSKeyPairs() {
if _, err = output.Write(keyPair.Cert); err != nil {
return trace.Wrap(err)
}
}
}
// dump user identity into separate files:
case IdentityFormatOpenSSH:
keyPath := filePath
certPath := keyPath + "-cert.pub"
err = ioutil.WriteFile(certPath, key.Cert, fileMode)
if err != nil {
return trace.Wrap(err)
}
err = ioutil.WriteFile(keyPath, key.Priv, fileMode)
if err != nil {
return trace.Wrap(err)
}
default:
return trace.BadParameter("unsupported identity format: %q, use either %q or %q",
format, IdentityFormatFile, IdentityFormatOpenSSH)
}
return nil
}