certificates/cas/stepcas/issuer.go
2021-03-23 16:14:49 -07:00

78 lines
2.1 KiB
Go

package stepcas
import (
"net/url"
"strings"
"time"
"github.com/pkg/errors"
"github.com/smallstep/certificates/cas/apiv1"
)
type stepIssuer interface {
SignToken(subject string, sans []string) (string, error)
RevokeToken(subject string) (string, error)
Lifetime(d time.Duration) time.Duration
}
// newStepIssuer returns the configured step issuer.
func newStepIssuer(caURL *url.URL, iss *apiv1.CertificateIssuer) (stepIssuer, error) {
if err := validateCertificateIssuer(iss); err != nil {
return nil, err
}
switch strings.ToLower(iss.Type) {
case "x5c":
return newX5CIssuer(caURL, iss)
case "jwk":
return newJWKIssuer(caURL, iss)
default:
return nil, errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
}
}
// validateCertificateIssuer validates the configuration of the certificate
// issuer.
func validateCertificateIssuer(iss *apiv1.CertificateIssuer) error {
switch {
case iss == nil:
return errors.New("stepCAS 'certificateIssuer' cannot be nil")
case iss.Type == "":
return errors.New("stepCAS `certificateIssuer.type` cannot be empty")
}
switch strings.ToLower(iss.Type) {
case "x5c":
return validateX5CIssuer(iss)
case "jwk":
return validateJWKIssuer(iss)
default:
return errors.Errorf("stepCAS `certificateIssuer.type` %s is not supported", iss.Type)
}
}
// validateX5CIssuer validates the configuration of x5c issuer.
func validateX5CIssuer(iss *apiv1.CertificateIssuer) error {
switch {
case iss.Certificate == "":
return errors.New("stepCAS `certificateIssuer.crt` cannot be empty")
case iss.Key == "":
return errors.New("stepCAS `certificateIssuer.key` cannot be empty")
case iss.Provisioner == "":
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
default:
return nil
}
}
// validateJWKIssuer validates the configuration of jwk issuer.
func validateJWKIssuer(iss *apiv1.CertificateIssuer) error {
switch {
case iss.Key == "":
return errors.New("stepCAS `certificateIssuer.key` cannot be empty")
case iss.Provisioner == "":
return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
default:
return nil
}
}