forked from TrueCloudLab/certificates
78 lines
2.1 KiB
Go
78 lines
2.1 KiB
Go
package stepcas
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/pkg/errors"
|
|
"github.com/smallstep/certificates/cas/apiv1"
|
|
)
|
|
|
|
type stepIssuer interface {
|
|
SignToken(subject string, sans []string) (string, error)
|
|
RevokeToken(subject string) (string, error)
|
|
Lifetime(d time.Duration) time.Duration
|
|
}
|
|
|
|
// newStepIssuer returns the configured step issuer.
|
|
func newStepIssuer(caURL *url.URL, iss *apiv1.CertificateIssuer) (stepIssuer, error) {
|
|
if err := validateCertificateIssuer(iss); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
switch strings.ToLower(iss.Type) {
|
|
case "x5c":
|
|
return newX5CIssuer(caURL, iss)
|
|
case "jwk":
|
|
return newJWKIssuer(caURL, iss)
|
|
default:
|
|
return nil, errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
|
|
}
|
|
}
|
|
|
|
// validateCertificateIssuer validates the configuration of the certificate
|
|
// issuer.
|
|
func validateCertificateIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss == nil:
|
|
return errors.New("stepCAS 'certificateIssuer' cannot be nil")
|
|
case iss.Type == "":
|
|
return errors.New("stepCAS `certificateIssuer.type` cannot be empty")
|
|
}
|
|
|
|
switch strings.ToLower(iss.Type) {
|
|
case "x5c":
|
|
return validateX5CIssuer(iss)
|
|
case "jwk":
|
|
return validateJWKIssuer(iss)
|
|
default:
|
|
return errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
|
|
}
|
|
}
|
|
|
|
// validateX5CIssuer validates the configuration of x5c issuer.
|
|
func validateX5CIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss.Certificate == "":
|
|
return errors.New("stepCAS `certificateIssuer.crt` cannot be empty")
|
|
case iss.Key == "":
|
|
return errors.New("stepCAS `certificateIssuer.key` cannot be empty")
|
|
case iss.Provisioner == "":
|
|
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
|
|
default:
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// validateJWKIssuer validates the configuration of jwk issuer.
|
|
func validateJWKIssuer(iss *apiv1.CertificateIssuer) error {
|
|
switch {
|
|
case iss.Key == "":
|
|
return errors.New("stepCAS `certificateIssuer.key` cannot be empty")
|
|
case iss.Provisioner == "":
|
|
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
|
|
default:
|
|
return nil
|
|
}
|
|
}
|