Make sure to define the KeyID from the token if available.

5 years ago · 08eac1b00d
parent 9c3349e90c
commit 08eac1b00d
1 changed files with 3 additions and 2 deletions
--- a/authority/provisioner/jwk.go
+++ b/authority/provisioner/jwk.go
@ -209,8 +209,9 @@ func (p *JWK) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption,
 	if !opts.ValidBefore.IsZero() {
 		signOptions = append(signOptions, sshCertificateValidBeforeModifier(opts.ValidBefore.RelativeTime(t).Unix()))
 	}
-	// Make sure to define the the KeyID
-	if opts.KeyID == "" {
+	if opts.KeyID != "" {
+		signOptions = append(signOptions, sshCertificateKeyIDModifier(opts.KeyID))
+	} else {
 		signOptions = append(signOptions, sshCertificateKeyIDModifier(claims.Subject))
 	}