This repository has been archived by the owner on Jan 24, 2020. It is now read-only.
forked from smallstep/cli
-
Notifications
You must be signed in to change notification settings - Fork 1
/
remove.go
186 lines (160 loc) 路 4.88 KB
/
remove.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
package provisioner
import (
"strings"
"github.com/pkg/errors"
"github.com/smallstep/certificates/authority"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/cli/errs"
"github.com/urfave/cli"
)
func removeCommand() cli.Command {
return cli.Command{
Name: "remove",
Action: cli.ActionFunc(removeAction),
Usage: "remove one, or more, provisioners from the CA configuration",
UsageText: `**step ca provisioner remove** <name>
[**--kid**=<kid>] [**--config**=<file>] [**--all**]`,
Flags: []cli.Flag{
cli.StringFlag{
Name: "ca-config",
Usage: "The <file> containing the CA configuration.",
},
cli.StringFlag{
Name: "kid",
Usage: "The <kid> (Key ID) of the JWK provisioner key to be removed.",
},
cli.StringFlag{
Name: "client-id",
Usage: "The <id> (Client ID) of the OIDC provisioner to be removed.",
},
cli.BoolFlag{
Name: "all",
Usage: `Remove all provisioners with a given name. Cannot be
used in combination w/ the **--kid** or **--client-id** flag.`,
},
cli.StringFlag{
Name: "type",
Usage: `The <type> of provisioner to remove. Type is a case-insensitive string
and must be one of:
**JWK**
: Uses an JWK key pair to sign bootstrap tokens.
**OIDC**
: Uses an OpenID Connect provider to sign bootstrap tokens.
**AWS**
: Uses Amazon AWS instance identity documents.
**GCP**
: Use Google instance identity tokens.
**Azure**
: Uses Microsoft Azure identity tokens.
**ACME**
: Uses ACME protocol.`,
},
},
Description: `**step ca provisioner remove** removes one or more provisioners
from the configuration and writes the new configuration back to the CA config.
## POSITIONAL ARGUMENTS
<name>
: The name field of the provisioner(s) to be removed.
## EXAMPLES
Remove all provisioners associated with a given name (max@smallstep.com):
'''
$ step ca provisioner remove max@smallstep.com --all --ca-config ca.json
'''
Remove the provisioner matching a given name and kid:
'''
$ step ca provisioner remove max@smallstep. --kid 1234 --ca-config ca.json
'''
Remove the provisioner matching a given name and a client id:
'''
$ step ca provisioner remove Google --ca-config ca.json \
--client-id 1087160488420-8qt7bavg3qesdhs6it824mhnfgcfe8il.apps.googleusercontent.com
'''
Remove the cloud identity provisioner given name and a type:
'''
$ step ca provisioner remove Amazon --ca-config ca.json --type AWS
'''
Remove the ACME provisioner by name:
'''
$ step ca provisioner remove Amazon --ca-config ca.json --type AWS
'''`,
}
}
func removeAction(ctx *cli.Context) error {
if err := errs.NumberOfArguments(ctx, 1); err != nil {
return err
}
name := ctx.Args().Get(0)
config := ctx.String("ca-config")
all := ctx.Bool("all")
kid := ctx.String("kid")
clientID := ctx.String("client-id")
typ := ctx.String("type")
if len(config) == 0 {
return errs.RequiredFlag(ctx, "ca-config")
}
if len(kid) > 0 && len(clientID) > 0 {
return errs.MutuallyExclusiveFlags(ctx, "kid", "client-id")
}
if all {
if len(kid) != 0 {
return errs.MutuallyExclusiveFlags(ctx, "all", "kid")
}
if len(clientID) != 0 {
return errs.MutuallyExclusiveFlags(ctx, "all", "client-id")
}
} else {
if len(kid) == 0 && len(clientID) == 0 && len(typ) == 0 {
return errs.RequiredOrFlag(ctx, "all", "kid", "client-id", "type")
}
}
c, err := authority.LoadConfiguration(config)
if err != nil {
return errors.Wrapf(err, "error loading configuration")
}
var (
provisioners provisioner.List
found = false
)
for _, p := range c.AuthorityConfig.Provisioners {
if p.GetName() != name || !isProvisionerType(p, typ) {
provisioners = append(provisioners, p)
continue
}
if !all {
switch pp := p.(type) {
case *provisioner.JWK:
if kid != "" && pp.Key.KeyID != kid {
provisioners = append(provisioners, p)
}
case *provisioner.OIDC:
if clientID != "" && pp.ClientID != clientID {
provisioners = append(provisioners, p)
}
case *provisioner.AWS, *provisioner.Azure, *provisioner.GCP, *provisioner.ACME:
// they are filtered by type and name.
default:
continue
}
}
found = true
}
if !found {
switch {
case kid != "":
return errors.Errorf("no provisioners with name=%s and kid=%s found", name, kid)
case clientID != "":
return errors.Errorf("no provisioners with name=%s and client-id=%s found", name, clientID)
case typ != "":
return errors.Errorf("no provisioners with name=%s and type=%s found", name, typ)
default:
return errors.Errorf("no provisioners with name %s found", name)
}
}
c.AuthorityConfig.Provisioners = provisioners
return c.Save(config)
}
// isProvisionerType returns true if p.GetType() is equal to typ. If typ is
// empty it will always return true.
func isProvisionerType(p provisioner.Interface, typ string) bool {
return typ == "" || strings.EqualFold(typ, p.GetType().String())
}