forked from TrueCloudLab/certificates
492256f2d7
Before this commit, EAB keys could be used CA-wide, meaning that an EAB credential could be used at any ACME provisioner. This commit changes that behavior, so that EAB credentials are now intended to be used with a specific ACME provisioner. I think that makes sense, because from the perspective of an ACME client the provisioner is like a distinct CA. Besides that this commit also includes the first tests for EAB. The logic for creating the EAB JWS as a client has been taken from github.com/mholt/acmez. This logic may be moved or otherwise sourced (i.e. from a vendor) as soon as the step client also (needs to) support(s) EAB with ACME.
74 lines
2.4 KiB
Go
74 lines
2.4 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/smallstep/certificates/api"
|
|
"github.com/smallstep/certificates/authority/admin"
|
|
)
|
|
|
|
// CreateExternalAccountKeyRequest is the type for POST /admin/acme/eab requests
|
|
type CreateExternalAccountKeyRequest struct {
|
|
ProvisionerName string `json:"provisioner"`
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
// CreateExternalAccountKeyResponse is the type for POST /admin/acme/eab responses
|
|
type CreateExternalAccountKeyResponse struct {
|
|
ProvisionerName string `json:"provisioner"`
|
|
KeyID string `json:"keyID"`
|
|
Name string `json:"name"`
|
|
Key []byte `json:"key"`
|
|
}
|
|
|
|
// GetExternalAccountKeysResponse is the type for GET /admin/acme/eab responses
|
|
type GetExternalAccountKeysResponse struct {
|
|
EAKs []*CreateExternalAccountKeyResponse `json:"eaks"`
|
|
NextCursor string `json:"nextCursor"`
|
|
}
|
|
|
|
// CreateExternalAccountKey creates a new External Account Binding key
|
|
func (h *Handler) CreateExternalAccountKey(w http.ResponseWriter, r *http.Request) {
|
|
var body CreateExternalAccountKeyRequest
|
|
if err := api.ReadJSON(r.Body, &body); err != nil { // TODO: rewrite into protobuf json (likely)
|
|
api.WriteError(w, err)
|
|
return
|
|
}
|
|
|
|
// TODO: Validate input
|
|
|
|
eak, err := h.acmeDB.CreateExternalAccountKey(r.Context(), body.ProvisionerName, body.Name)
|
|
if err != nil {
|
|
api.WriteError(w, admin.WrapErrorISE(err, "error creating external account key %s", body.Name))
|
|
return
|
|
}
|
|
|
|
eakResponse := CreateExternalAccountKeyResponse{
|
|
ProvisionerName: eak.ProvisionerName,
|
|
KeyID: eak.ID,
|
|
Name: eak.Name,
|
|
Key: eak.KeyBytes,
|
|
}
|
|
|
|
api.JSONStatus(w, eakResponse, http.StatusCreated) // TODO: rewrite into protobuf json (likely)
|
|
}
|
|
|
|
// GetExternalAccountKeys returns a segment of ACME EAB Keys.
|
|
func (h *Handler) GetExternalAccountKeys(w http.ResponseWriter, r *http.Request) {
|
|
// cursor, limit, err := api.ParseCursor(r)
|
|
// if err != nil {
|
|
// api.WriteError(w, admin.WrapError(admin.ErrorBadRequestType, err,
|
|
// "error parsing cursor and limit from query params"))
|
|
// return
|
|
// }
|
|
|
|
// eaks, nextCursor, err := h.acmeDB.GetExternalAccountKeys(cursor, limit)
|
|
// if err != nil {
|
|
// api.WriteError(w, admin.WrapErrorISE(err, "error retrieving paginated admins"))
|
|
// return
|
|
// }
|
|
// api.JSON(w, &GetExternalAccountKeysResponse{
|
|
// EAKs: eaks,
|
|
// NextCursor: nextCursor,
|
|
// })
|
|
}
|