pangolin_mirror/newt
1
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-09-07 14:41:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Handle the different modes

Browse Source
This commit is contained in:
Owen
2026-05-22 13:49:54 -07:00
parent 60d67ee9a1
commit 5d84fa9141
3 changed files with 62 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
authdaemon/connection.go
View File

@@ -19,7 +19,7 @@ func (s *Server) ProcessConnection(req ConnectionRequest) {
if err := ensureUser(req.Username, req.Metadata, s.cfg.GenerateRandomPassword); err != nil {
logger.Warn("auth-daemon: ensure user: %v", err)
}
if cfg.PrincipalsFilePath != "" {
if cfg.PrincipalsFilePath != "" && req.NiceId != "" {
if err := writePrincipals(cfg.PrincipalsFilePath, req.Username, req.NiceId); err != nil {
logger.Warn("auth-daemon: write principals: %v", err)
}

4
authdaemon/routes.go
View File

@@ -14,9 +14,9 @@ func (s *Server) registerRoutes() {
// ConnectionMetadata is the metadata object in POST /connection.
type ConnectionMetadata struct {
SudoMode string `json:"sudoMode"` // "none" | "full" | "commands"
SudoCommands []string `json:"sudoCommands"` // used when sudoMode is "commands"
SudoCommands []string `json:"sudoCommands"` // used when sudoMode is "commands"
Homedir bool `json:"homedir"`
Groups []string `json:"groups"` // system groups to add the user to
Groups []string `json:"groups"` // system groups to add the user to
}
// ConnectionRequest is the JSON body for POST /connection.

87
main.go
View File

@@ -1748,31 +1748,45 @@ persistent_keepalive_interval=5`, util.FixKey(privateKey.String()), util.FixKey(
return
}
// Check if we're running the auth daemon internally
if authDaemonServer != nil && certData.AuthDaemonMode == "site" { // if the auth daemon is running internally and the external auth daemon is not enabled
// Use a switch statement for AuthDaemonMode
switch certData.AuthDaemonMode {
case "site":
// Call ProcessConnection directly when running internally
logger.Debug("Calling internal auth daemon ProcessConnection for user %s", certData.Username)
authDaemonServer.ProcessConnection(authdaemon.ConnectionRequest{
CaCert: certData.CACert,
NiceId: certData.NiceID,
Username: certData.Username,
Metadata: authdaemon.ConnectionMetadata{
SudoMode: certData.Metadata.SudoMode,
SudoCommands: certData.Metadata.SudoCommands,
Homedir: certData.Metadata.Homedir,
Groups: certData.Metadata.Groups,
},
})
// Send success response back to cloud
err = client.SendMessage("ws/round-trip/complete", map[string]interface{}{
"messageId": certData.MessageId,
"complete": true,
})
if authDaemonServer != nil {
authDaemonServer.ProcessConnection(authdaemon.ConnectionRequest{
CaCert: certData.CACert,
NiceId: certData.NiceID,
Username: certData.Username,
Metadata: authdaemon.ConnectionMetadata{
SudoMode: certData.Metadata.SudoMode,
SudoCommands: certData.Metadata.SudoCommands,
Homedir: certData.Metadata.Homedir,
Groups: certData.Metadata.Groups,
},
})
// Send success response back to cloud
err = client.SendMessage("ws/round-trip/complete", map[string]interface{}{
"messageId": certData.MessageId,
"complete": true,
})
} else {
logger.Error("Auth daemon server is not initialized, cannot process connection")
// Send failure response back to cloud
err = client.SendMessage("ws/round-trip/complete", map[string]interface{}{
"messageId": certData.MessageId,
"complete": true,
"error": "auth daemon server not initialized",
})
if err != nil {
logger.Error("Failed to send SSH cert failure response: %v", err)
}
return
}
logger.Info("Successfully processed connection via internal auth daemon for user %s", certData.Username)
} else if certData.AuthDaemonMode == "remote" {
case "remote":
// External auth daemon mode - make HTTP request
// Check if auth daemon key is configured
if authDaemonKey == "" {
@@ -1869,15 +1883,14 @@ persistent_keepalive_interval=5`, util.FixKey(privateKey.String()), util.FixKey(
}
logger.Info("Successfully registered SSH certificate with external auth daemon for user %s", certData.Username)
} else if certData.AuthDaemonMode == "native" {
if disableSSH {
logger.Warn("Received native SSH connection request but SSH is disabled via --disable-ssh")
} else {
case "native":
logger.Debug("Processing SSH cert for native SSH server for user %s", certData.Username)
if authDaemonServer != nil && sshCredStore != nil {
authDaemonServer.ProcessConnection(authdaemon.ConnectionRequest{
CaCert: certData.CACert,
NiceId: certData.NiceID,
CaCert: "", // dont write the cert to the host
NiceId: "", // dont write the cert to the host
Username: certData.Username,
Metadata: authdaemon.ConnectionMetadata{
Metadata: authdaemon.ConnectionMetadata{ // but push the user
SudoMode: certData.Metadata.SudoMode,
SudoCommands: certData.Metadata.SudoCommands,
Homedir: certData.Metadata.Homedir,
@@ -1891,9 +1904,27 @@ persistent_keepalive_interval=5`, util.FixKey(privateKey.String()), util.FixKey(
}
sshCredStore.AddPrincipals(certData.Username, certData.NiceID)
logger.Info("nativessh: updated credentials for user %s (niceId=%s)", certData.Username, certData.NiceID)
} else {
logger.Error("Auth daemon server or SSH credential store not initialized, cannot process connection")
// Send failure response back to cloud
err = client.SendMessage("ws/round-trip/complete", map[string]interface{}{
"messageId": certData.MessageId,
"complete": true,
"error": "auth daemon server or SSH credential store not initialized",
})
if err != nil {
logger.Error("Failed to send SSH cert failure response: %v", err)
}
return
}
} else {
default:
logger.Error("Unknown auth daemon mode: %s", certData.AuthDaemonMode)
client.SendMessage("ws/round-trip/complete", map[string]interface{}{
"messageId": certData.MessageId,
"complete": true,
"error": fmt.Sprintf("unknown auth daemon mode: %s", certData.AuthDaemonMode),
})
return
}
// Send success response back to cloud