mirror of
https://github.com/smallstep/certificates.git
synced 2024-11-17 15:29:21 +00:00
100 lines
3.0 KiB
Go
100 lines
3.0 KiB
Go
package stepcas
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/pkg/errors"
|
|
"github.com/smallstep/certificates/ca"
|
|
"github.com/smallstep/certificates/cas/apiv1"
|
|
)
|
|
|
|
// raAuthorityNS is a custom namespace used to generate endpoint ids based on
|
|
// the authority id.
|
|
var raAuthorityNS = uuid.MustParse("d6f14c1f-2f92-47bf-a04f-7b2c11382edd")
|
|
|
|
// newServerEndpointID returns a uuid v5 using raAuthorityNS as the namespace.
|
|
// The return uuid will be used as the server endpoint id, it will be unique per
|
|
// authority.
|
|
func newServerEndpointID(data string) uuid.UUID {
|
|
return uuid.NewSHA1(raAuthorityNS, []byte(data))
|
|
}
|
|
|
|
type raInfo struct {
|
|
AuthorityID string `json:"authorityId,omitempty"`
|
|
EndpointID string `json:"endpointId,omitempty"`
|
|
ProvisionerID string `json:"provisionerId,omitempty"`
|
|
ProvisionerType string `json:"provisionerType,omitempty"`
|
|
ProvisionerName string `json:"provisionerName,omitempty"`
|
|
}
|
|
|
|
type stepIssuer interface {
|
|
SignToken(subject string, sans []string, info *raInfo) (string, error)
|
|
RevokeToken(subject string) (string, error)
|
|
Lifetime(d time.Duration) time.Duration
|
|
}
|
|
|
|
// newStepIssuer returns the configured step issuer.
|
|
func newStepIssuer(caURL *url.URL, client *ca.Client, iss *apiv1.CertificateIssuer) (stepIssuer, error) {
|
|
if err := validateCertificateIssuer(iss); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
switch strings.ToLower(iss.Type) {
|
|
case "x5c":
|
|
return newX5CIssuer(caURL, iss)
|
|
case "jwk":
|
|
return newJWKIssuer(caURL, client, iss)
|
|
default:
|
|
return nil, errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
|
|
}
|
|
}
|
|
|
|
// validateCertificateIssuer validates the configuration of the certificate
|
|
// issuer.
|
|
func validateCertificateIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss == nil:
|
|
return errors.New("stepCAS 'certificateIssuer' cannot be nil")
|
|
case iss.Type == "":
|
|
return errors.New("stepCAS `certificateIssuer.type` cannot be empty")
|
|
}
|
|
|
|
switch strings.ToLower(iss.Type) {
|
|
case "x5c":
|
|
return validateX5CIssuer(iss)
|
|
case "jwk":
|
|
return validateJWKIssuer(iss)
|
|
default:
|
|
return errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
|
|
}
|
|
}
|
|
|
|
// validateX5CIssuer validates the configuration of x5c issuer.
|
|
func validateX5CIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss.Certificate == "":
|
|
return errors.New("stepCAS `certificateIssuer.crt` cannot be empty")
|
|
case iss.Key == "":
|
|
return errors.New("stepCAS `certificateIssuer.key` cannot be empty")
|
|
case iss.Provisioner == "":
|
|
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
|
|
default:
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// validateJWKIssuer validates the configuration of jwk issuer. If the key is
|
|
// not given, then it will download it from the CA. If the password is not set
|
|
// it will be prompted.
|
|
func validateJWKIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss.Provisioner == "":
|
|
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
|
|
default:
|
|
return nil
|
|
}
|
|
}
|