forked from gravitational/teleport
-
Notifications
You must be signed in to change notification settings - Fork 0
/
trust.go
108 lines (87 loc) · 3.57 KB
/
trust.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
/*
Copyright 2015 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package services
import (
"fmt"
"strings"
"github.com/gravitational/trace"
)
// Trust is responsible for managing certificate authorities
// Each authority is managing some domain, e.g. example.com
//
// There are two type of authorities, local and remote.
// Local authorities have both private and public keys, so they can
// sign public keys of users and hosts
//
// Remote authorities have only public keys available, so they can
// be only used to validate
type Trust interface {
// CreateCertAuthority inserts a new certificate authority
CreateCertAuthority(ca CertAuthority) error
// UpsertCertAuthority updates or inserts a new certificate authority
UpsertCertAuthority(ca CertAuthority) error
// DeleteCertAuthority deletes particular certificate authority
DeleteCertAuthority(id CertAuthID) error
// DeleteAllCertAuthorities deletes cert authorities of a certain type
DeleteAllCertAuthorities(caType CertAuthType) error
// GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
// controls if signing keys are loaded
GetCertAuthority(id CertAuthID, loadSigningKeys bool) (CertAuthority, error)
// DELETE IN: 2.6.0
// GetAnyCertAuthority returns activated or deactivated certificate authority
// by given id whether it is activated or not. Signing keys are never loaded.
// This method is used in migrations.
GetAnyCertAuthority(id CertAuthID) (ca CertAuthority, error error)
// GetCertAuthorities returns a list of authorities of a given type
// loadSigningKeys controls whether signing keys should be loaded or not
GetCertAuthorities(caType CertAuthType, loadSigningKeys bool) ([]CertAuthority, error)
// ActivateCertAuthority moves a CertAuthority from the deactivated list to
// the normal list.
ActivateCertAuthority(id CertAuthID) error
// DeactivateCertAuthority moves a CertAuthority from the normal list to
// the deactivated list.
DeactivateCertAuthority(id CertAuthID) error
}
const (
// HostCA identifies the key as a host certificate authority
HostCA CertAuthType = "host"
// UserCA identifies the key as a user certificate authority
UserCA CertAuthType = "user"
)
// CertAuthType specifies certificate authority type, user or host
type CertAuthType string
// Check checks if certificate authority type value is correct
func (c CertAuthType) Check() error {
if c != HostCA && c != UserCA {
return trace.BadParameter("'%v' authority type is not supported", c)
}
return nil
}
// CertAuthID - id of certificate authority (it's type and domain name)
type CertAuthID struct {
Type CertAuthType `json:"type"`
DomainName string `json:"domain_name"`
}
func (c *CertAuthID) String() string {
return fmt.Sprintf("CA(type=%v, domain=%v)", c.Type, c.DomainName)
}
// Check returns error if any of the id parameters are bad, nil otherwise
func (c *CertAuthID) Check() error {
if err := c.Type.Check(); err != nil {
return trace.Wrap(err)
}
if strings.TrimSpace(c.DomainName) == "" {
return trace.BadParameter("identity validation error: empty domain name")
}
return nil
}