luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity
open-vault/command
History
Seth Vargo 430fc22023
Initial pass at SSH CLI CA type authentication 
1. The current implementation of the SSH command is heavily tied to the
assumptions of OTP/dynamic key types. The SSH CA backend is
fundamentally a different approach to login and authentication. As a
result, there was some restructuring of existing methods to share more
code and state.

2. Each authentication method (ca, otp, dynamic) are now fully-contained
in their own handle* function.

3. -mode and -role are going to be required for SSH CA, and I don't
think the magical UX (and overhead) of guessing them is a good UX. It's
confusing as to which role and how Vault guesses. We can reduce 66% of
the API calls and add more declaration to the CLI by making -mode and
-role required. This commit adds warnings for that deprecation, but
these values are both required for CA type authentication.

4. The principal and extensions are currently fixed, and I personally
believe that's good enough for the first pass at this. Until we
understand what configuration options users will want, I think we should
ship with all the local extensions enabled. Users who don't want that
can generate the key themselves directly (current behavior) or submit
PRs to make the map of extensions customizable.

5. Host key checking for the CA backend is not currently implemented.
It's not strictly required at setup, so I need to think about whether it
belongs here.

This is not ready for merge, but it's ready for early review.
2017-08-18 12:59:08 -04:00
..
server tls_client_ca_file option for verifying client (#3034) 2017-08-03 07:33:06 -04:00
test-fixtures Remove config from Meta; it's only used right now with the token helper. 2016-04-01 16:02:18 -04:00
token Strip trailing whitespace in token from file. 2016-08-23 20:22:45 -04:00
audit_disable.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
audit_disable_test.go Add WithOptions methods to audit/auth enabling (#2383) 2017-02-16 11:37:27 -05:00
audit_enable.go add gofmt checks to Vault and format existing code (#2745) 2017-05-19 08:34:17 -04:00
audit_enable_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
audit_list.go Add WithOptions methods to audit/auth enabling (#2383) 2017-02-16 11:37:27 -05:00
audit_list_test.go Add WithOptions methods to audit/auth enabling (#2383) 2017-02-16 11:37:27 -05:00
auth.go Add token-only. (#2971) 2017-07-12 15:04:34 -04:00
auth_disable.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
auth_disable_test.go Add WithOptions methods to audit/auth enabling (#2383) 2017-02-16 11:37:27 -05:00
auth_enable.go Improve auth-enable output for plugin backends (#3189) 2017-08-16 14:31:16 -04:00
auth_enable_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
auth_test.go Add a no-store option to vault auth (#2809) 2017-06-05 16:36:28 -04:00
capabilities.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
capabilities_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
command_test.go Remove config from Meta; it's only used right now with the token helper. 2016-04-01 16:02:18 -04:00
config.go Improve error handling re: homedir expansion 2016-04-25 18:01:13 -07:00
config_test.go Remove config from Meta; it's only used right now with the token helper. 2016-04-01 16:02:18 -04:00
delete.go Provide clarity for output statements of idempotent calls. 2016-04-14 15:46:45 +00:00
delete_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
format.go Store original request path in WrapInfo (#3100) 2017-08-02 18:28:58 -04:00
format_test.go Added JSON Decode and Encode helpers. 2016-07-06 12:25:40 -04:00
generate-root.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
generate-root_test.go Fix tests 2017-05-25 09:00:49 -04:00
init.go Migrate physical backends into separate packages (#3106) 2017-08-03 13:24:27 -04:00
init_test.go Add support for PGP encrypting the initial root token. (#1883) 2016-09-13 18:42:24 -04:00
key_status.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
key_status_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
list.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
list_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
mount.go Improve auth-enable output for plugin backends (#3189) 2017-08-16 14:31:16 -04:00
mount_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
mount_tune.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
mounts.go Backend plugin system (#2874) 2017-07-20 13:28:40 -04:00
mounts_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
path_help.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
path_help_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
pgp_test.go Remove hex output from keys; standardize on B64 for CLI output. This (#1831) 2016-09-01 12:59:15 -04:00
policy_delete.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
policy_delete_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
policy_list.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
policy_list_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
policy_write.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
policy_write_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
read.go Add unwrap command, and change how the response is embedded (as a string, not an object) 2016-05-19 11:25:15 -04:00
read_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
rekey.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
rekey_test.go Backend plugin system (#2874) 2017-07-20 13:28:40 -04:00
remount.go Add some minor tweaks to the PR 2017-04-04 12:22:14 -04:00
remount_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
renew.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
renew_test.go Exclude /sys/leases/renew from registering with expiration manager (#2891) 2017-06-20 12:34:00 -04:00
revoke.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
revoke_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
rotate.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
rotate_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
seal.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
seal_test.go Change seal test name in command package 2016-04-26 00:12:14 +00:00
server.go * Add ability to specify a plugin dir in dev mode (#3184) 2017-08-16 11:17:50 -04:00
server_ha_test.go Migrate physical backends into separate packages (#3106) 2017-08-03 13:24:27 -04:00
server_test.go Migrate physical backends into separate packages (#3106) 2017-08-03 13:24:27 -04:00
ssh.go Initial pass at SSH CLI CA type authentication 2017-08-18 12:59:08 -04:00
ssh_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
status.go Add leader cluster address to status/leader output. (#3061) 2017-07-31 18:25:27 -04:00
status_test.go Multi value test seal (#2281) 2017-01-17 15:43:10 -05:00
step-down.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
token_create.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
token_create_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
token_lookup.go Fix up the meta common options text function to not strip leading space and fix up commands 2016-04-01 16:50:12 -04:00
token_lookup_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
token_renew.go Rename helper 'duration' to 'parseutil'. (#2449) 2017-03-07 11:21:22 -05:00
token_renew_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
token_revoke.go Add -self flag to token-revoke (#2596) 2017-04-17 12:40:51 -04:00
token_revoke_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
unmount.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
unmount_test.go Move meta into its own package 2016-04-01 13:16:05 -04:00
unseal.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
unseal_test.go Multi value test seal (#2281) 2017-01-17 15:43:10 -05:00
unwrap.go Typo corrections and tweaks to commands' help info 2017-03-25 12:51:12 -05:00
unwrap_test.go all: test: Fix govet warnings 2016-12-21 19:44:07 +01:00
util.go Store original request path in WrapInfo (#3100) 2017-08-02 18:28:58 -04:00
version.go Add cgo info to vault version output 2016-11-27 19:32:57 -05:00
version_test.go
wrapping_test.go Address most review feedback. Change responses to multierror to better return more useful values when there are multiple errors 2016-05-16 16:11:33 -04:00
write.go Write always needs a path, even with force. (#2675) 2017-05-04 06:40:58 -04:00
write_test.go Fix tests 2017-05-25 09:00:49 -04:00