Mariano Cano
b900a7a2fc
Fix error message in tests.
2020-08-14 15:38:54 -07:00
Mariano Cano
d30a95236d
Use always go.step.sm/crypto
2020-08-14 15:33:50 -07:00
Mariano Cano
aaaa7e9b4e
Merge branch 'master' into cert-templates
2020-08-14 10:45:41 -07:00
Mariano Cano
3577d696c7
Use new x509util in tls_test.go
2020-08-10 18:14:32 -07:00
Mariano Cano
0a59efd853
Use new x509util to generate the CA certificate.
2020-08-10 16:09:22 -07:00
Mariano Cano
4943ae58d8
Move TLSOption, TLSVersion, CipherSuites and ASN1DN to certificates.
2020-08-10 15:29:18 -07:00
Mariano Cano
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
2020-08-10 11:26:51 -07:00
Mariano Cano
ce1eb0a01b
Use new x509util for renew/rekey.
2020-08-05 19:09:06 -07:00
Mariano Cano
f437b86a7b
Merge branch 'cert-templates' into ssh-cert-templates
2020-08-05 18:43:07 -07:00
Mariano Cano
c8d225a763
Use x509util from go.step.sm/crypto/x509util
2020-08-05 16:02:46 -07:00
Mariano Cano
37f84e9bb3
Add delay in test.
2020-08-03 19:01:15 -07:00
Mariano Cano
342cb713ee
Add test with custom templates.
2020-08-03 18:51:47 -07:00
Mariano Cano
8d89bbd62f
Remove unused code.
2020-08-03 18:39:02 -07:00
Mariano Cano
c4bbc81d9f
Fix authority tests.
2020-08-03 18:36:05 -07:00
Mariano Cano
413af88aad
Fix provisioning tests.
2020-08-03 18:10:29 -07:00
Mariano Cano
b66bdfabcd
Enforce an OIDC users to send all template variables.
2020-08-03 15:28:48 -07:00
Mariano Cano
9822305bb6
Use only the IID template on IID provisioners.
...
Use always sshutil.DefaultIIDCertificate and require at least one
principal on IID provisioners.
2020-08-03 15:11:42 -07:00
Mariano Cano
aa657cdb4b
Use SSHOptions inside provisioner options.
2020-07-30 18:44:52 -07:00
Mariano Cano
02379d494b
Add support for extensions and critical options on the identity
...
function.
2020-07-30 17:45:03 -07:00
Mariano Cano
8ff8d90f8c
On JWK and X5C validate the key id on the request.
2020-07-30 17:45:03 -07:00
Mariano Cano
a78f7e8913
Add template support on k8ssa provisioner.
2020-07-30 17:45:03 -07:00
Mariano Cano
6c36ceb158
Add initial template support for iid provisisioners.
2020-07-30 17:45:03 -07:00
Mariano Cano
8e7bf96769
Fix error prefix.
2020-07-30 17:45:03 -07:00
Mariano Cano
e0dce54338
Add missing argument.
2020-07-30 17:45:03 -07:00
Mariano Cano
c1fc45c872
Simplify SSH modifiers with options.
...
It also changes the behavior of the request options to modify only
the validity of the certificate.
2020-07-30 17:45:03 -07:00
Mariano Cano
ad28f0f59a
Move variable where it is used.
2020-07-30 17:45:03 -07:00
Mariano Cano
715eb4eacc
Add initial support for ssh templates on OIDC.
2020-07-30 17:45:03 -07:00
Mariano Cano
c2dc76550c
Add ssh certificate template to X5C provisioner.
2020-07-30 17:45:03 -07:00
Mariano Cano
380a0d6daf
Add ssh certificate templates to JWK provisioner.
2020-07-30 17:45:03 -07:00
Mariano Cano
f75a12e10a
Add omitempty tag option.
2020-07-30 17:45:03 -07:00
Mariano Cano
d7e590908e
Use sshutil for ssh renewing and rekeying.
2020-07-30 17:45:02 -07:00
Mariano Cano
b66d123572
Use sshutil for SSH certificate signing.
2020-07-30 17:45:02 -07:00
Mariano Cano
570ede45e7
Do not enforce number of principals or extensions.
2020-07-30 17:45:02 -07:00
Mariano Cano
631f1612a1
Add TemplateData to SignSSHOptions.
2020-07-30 17:45:02 -07:00
Mariano Cano
c6746425a3
Add methods to initialize ssh templates in provisioners.
2020-07-30 17:45:02 -07:00
Mariano Cano
3e80f41c19
Change provisioner options to have X509 as a field.
2020-07-30 17:44:22 -07:00
max furman
3f844c5e23
Update the way SubjectKeyId is calculated, and more ...
...
- swith lint to first in line for `make all`
- update tests to conform with new subjectkeyid
2020-07-28 12:00:07 -07:00
Mariano Cano
a7b65f1e1e
Add authority.Sign test with custom templates.
2020-07-22 19:18:45 -07:00
David Cowden
86efe7aff0
aws: use http.NoBody instead of nil
...
It's a little more descriptive.
2020-07-22 18:39:46 -07:00
David Cowden
2b121efc8f
aws: test constructor with empty IDMS string array
2020-07-22 18:33:44 -07:00
Mariano Cano
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
2020-07-22 18:24:45 -07:00
David Cowden
dc39eef721
aws: test badIDMS functional path
...
The existing test only covers the constructor logic. Also test the live
code path that is executed when a bad IDMS version is supplied.
2020-07-22 17:40:26 -07:00
David Cowden
51f16ee2e0
aws: add tests covering metadata service versions
...
* Add constructor tests for the aws provisioner.
* Add a test to make sure the "v1" logic continues to work.
By and large, v2 is the way to go. However, there are some instances of
things that specifically request metadata service version 1 and so this
adds minimal coverage to make sure we don't accidentally break the path
should anyone need to depend on the former logic.
2020-07-22 16:52:06 -07:00
David Cowden
5efe5f3573
metadata-v2: pull in joshathysolate-master
...
Taking of this PR to get it across the goal line.
2020-07-22 04:15:34 -07:00
Mariano Cano
978ad7e2b6
Fix merged tests.
2020-07-21 14:34:55 -07:00
Mariano Cano
5ac3f8a160
Add provisioner options tests.
2020-07-21 14:21:54 -07:00
Mariano Cano
02c4f9817d
Set full token payload instead of only the known properties.
2020-07-21 14:21:54 -07:00
Mariano Cano
0c8376a7f6
Fix existing unit tests.
2020-07-21 14:21:54 -07:00
Mariano Cano
d64cb99a22
Fix authority package tests.
2020-07-21 14:21:48 -07:00
Mariano Cano
ccc705cdcd
Use alias x509legacy to cli x509util in tls.go.
2020-07-21 14:20:48 -07:00
Mariano Cano
8f0dd811af
Allow to send errors from template to cli.
2020-07-21 14:18:06 -07:00
Mariano Cano
a7fe0104c4
Remove ACME restrictions and add proper template support.
2020-07-21 14:18:06 -07:00
Mariano Cano
cf2989a848
Add token and subject to K8sSA provisioner to be used in custom
...
templates.
2020-07-21 14:18:06 -07:00
Mariano Cano
71be83b25e
Add iss#sub uri in OIDC certificates.
...
Admin will use the CR template if none is provided.
2020-07-21 14:18:06 -07:00
Mariano Cano
c58117b30d
Allow to use base64 when defining a template in the ca.json.
2020-07-21 14:18:06 -07:00
Mariano Cano
b2ca3176f5
Prepend insecure to user and CR variables names.
2020-07-21 14:18:06 -07:00
Mariano Cano
b11486f41f
Fix option method for template variable.
2020-07-21 14:18:06 -07:00
Mariano Cano
04f5053a7a
Add template support for x5c.
2020-07-21 14:18:06 -07:00
Mariano Cano
eb8886d828
Add CR subject as iid default subject.
...
Add a minimal subject with just a common name to iid provisioners
in case we want to use it.
2020-07-21 14:18:06 -07:00
Mariano Cano
e60ea419cc
Add template support for gcp provisioner.
2020-07-21 14:18:06 -07:00
Mariano Cano
32646c49bf
Add templates support to Azure provisioner.
2020-07-21 14:18:06 -07:00
Mariano Cano
a44f0ca866
Add token payload.
2020-07-21 14:18:06 -07:00
Mariano Cano
00fd41a3d0
Add template support to K8sSA provisioners.
2020-07-21 14:18:06 -07:00
Mariano Cano
13b704aeed
Add template support for AWS provisioner.
2020-07-21 14:18:05 -07:00
Mariano Cano
49b9aa6e3f
Fix log string.
2020-07-21 14:18:05 -07:00
Mariano Cano
4795e371bd
Add back the support for ca.json DN template.
2020-07-21 14:18:05 -07:00
Mariano Cano
e6fed5e0aa
Minor fixes and comments.
2020-07-21 14:18:05 -07:00
Mariano Cano
81cd288104
Enable templates in acme provisioners.
2020-07-21 14:18:05 -07:00
Mariano Cano
ca2fb42d68
Move options to the provisioner.
2020-07-21 14:18:05 -07:00
Mariano Cano
206bc6757a
Add initial support for templates in the OIDC provisioner.
2020-07-21 14:18:05 -07:00
Mariano Cano
95c3a41bf0
Rename UserData to TemplateData and fix unmarshaling.
2020-07-21 14:18:04 -07:00
Mariano Cano
9f3acc254b
Set the token payload in the JWK provisioner.
2020-07-21 14:18:04 -07:00
Mariano Cano
ef0ed0ff95
Integrate simple templates in the JWK provisioner.
2020-07-21 14:18:04 -07:00
Mariano Cano
d1d9ae42d6
Use certificates x509util instead of cli for certificate signing.
2020-07-21 14:18:04 -07:00
Mariano Cano
9032018cf2
Convert x509util.WithOptions to new modifiers.
2020-07-21 14:18:04 -07:00
Carl Tashian
912e298043
Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html
2020-07-20 15:42:47 -07:00
max furman
fd05f3249b
A few last fixes and tests added for rekey/renew ...
...
- remove all `renewOrRekey`
- explicitly test difference between renew and rekey (diff pub keys)
- add back tests for renew
2020-07-09 12:11:40 -07:00
Max
ea9bc493b8
Merge pull request #307 from dharanikumar-s/master
...
Add support for rekeying Fixes #292
2020-07-09 11:39:00 -07:00
dharanikumar-s
57fb0c80cf
Removed calculating SubjectKeyIdentifier on Rekey
2020-07-08 12:52:53 +05:30
dharanikumar-s
dfda497929
Renamed RenewOrRekey to Rekey
2020-07-08 11:47:59 +05:30
dharanikumar-s
fe73154a20
Corrected misspelling
2020-07-05 22:50:02 +05:30
dharanikumar-s
0c21f0ae9e
Added error check after GenerateDefaultKeyPair
2020-07-05 22:38:45 +05:30
dharanikumar-s
2479371c06
Added error check while marshalling public key
2020-07-05 22:37:29 +05:30
dharanikumar-s
b368a53149
Modified TestAuthority_Renew to TestAuthority_RenewOrRekey
2020-07-05 22:17:57 +05:30
dharanikumar-s
c8c3581e2f
SubjectKeyIdentifier extention is calculated from public key passed to this function instead of copying from old certificate
2020-07-05 22:15:01 +05:30
dharanikumar-s
8f504483ce
Added RenewOrRekey function based on @maraino suggestion. RenewOrReky is called from Renew.
2020-07-03 15:58:15 +05:30
dharanikumar-s
3813f57b1a
Add support for rekeying Fixes #292
2020-07-01 19:10:13 +05:30
Max
debce1cec2
Merge pull request #299 from smallstep/max/refactor
...
Refactor
2020-06-25 15:32:04 -07:00
max furman
accf1be7e9
wip
2020-06-25 14:02:24 -07:00
max furman
71d87b4e61
wip
2020-06-24 23:25:15 -07:00
max furman
d25e7f64c2
wip
2020-06-24 09:58:40 -07:00
max furman
3636ba3228
wip
2020-06-23 17:13:39 -07:00
Mariano Cano
39650637d4
Merge pull request #297 from smallstep/no-bastion-bastion
...
Do not return bastion for the configured bastion host.
2020-06-23 11:45:25 -07:00
Mariano Cano
fcfc4e9b2b
Fix ssh federated template variables.
2020-06-23 11:14:26 -07:00
max furman
1951669e13
wip
2020-06-23 11:10:45 -07:00
Mariano Cano
b0fdd0b2be
Do not return bastion for the configured bastion host.
...
Fixes #296
2020-06-19 12:37:08 -07:00
Mariano Cano
ff32746312
Add test case for error executing template.
2020-06-16 18:21:44 -07:00
Mariano Cano
e3ae751b57
Use templates from authority instead of config.
2020-06-16 17:57:35 -07:00
Mariano Cano
237baa5169
Check for required variables in templates.
...
Fixes smallstep/cli#232
2020-06-16 17:26:54 -07:00
Mariano Cano
6c844a0618
Load default templates if no templates are configured.
2020-06-16 17:26:18 -07:00