mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-01 05:50:30 +08:00
Tim Buckley
759203dc6a
* Add basic support for `bound_keypair` joining for all agent types This adds basic support for bound keypair joining for all agent types. This provides benefits in certain situations, for example: - Bound keypair registration secrets are single-use, unlike `token`. In rare cases, users may want to provide a credential that can only join one node. - Bound keypair allows preregistration of the node's public key, eliminating shared secrets. Notably, agents are still issued long-lived, effectively permanent credentials (10yr) after their first registration. This means many benefits of bound keypair joining are not relevant once joined; agents should effectively never need to perform a recovery as their primary credentials are valid for the life of the agent. * Parse bound keypair params from file config * Fix a few lints * Properly pass registration secret to the join client * Add first batch of tests * Add test for makeJoinParams() * Fix imports * Write bound keypair credentials to the correct storage backend * Only load the registration secret if no client state exists * Explicitly raise an error if no registration secret is loaded when required
49 lines
1.6 KiB
Go
49 lines
1.6 KiB
Go
/*
|
|
* Teleport
|
|
* Copyright (C) 2026 Gravitational, Inc.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package service
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/gravitational/teleport/lib/auth/join/boundkeypair"
|
|
"github.com/gravitational/teleport/lib/auth/storage"
|
|
)
|
|
|
|
// boundKeypairStorageAdapter returns a storage interface implementation for
|
|
// bound keypair joining backed by the local agent storage.
|
|
func (p *TeleportProcess) boundKeypairStorageAdapter() boundkeypair.FS {
|
|
return &boundKeypairAdapter{
|
|
storage: p.storage,
|
|
}
|
|
}
|
|
|
|
// boundKeypairAdapter satisfies the boundkeypair.FS interface and is suitable
|
|
// for managing persistence of bound keypair keys using agent local storage.
|
|
type boundKeypairAdapter struct {
|
|
storage *storage.ProcessStorage
|
|
}
|
|
|
|
func (a *boundKeypairAdapter) Read(ctx context.Context, name string) ([]byte, error) {
|
|
return a.storage.ReadBoundKeypairItem(ctx, name)
|
|
}
|
|
|
|
func (a *boundKeypairAdapter) Write(ctx context.Context, name string, value []byte) error {
|
|
return a.storage.WriteBoundKeypairItem(ctx, name, value)
|
|
}
|