- djm@cvs.openbsd.org 2010/05/07 11:30:30

     [auth-options.c auth-options.h auth.c auth.h auth2-pubkey.c]
     [key.c servconf.c servconf.h sshd.8 sshd_config.5]
     add some optional indirection to matching of principal names listed
     in certificates. Currently, a certificate must include the a user's name
     to be accepted for authentication. This change adds the ability to
     specify a list of certificate principal names that are acceptable.

     When authenticating using a CA trusted through ~/.ssh/authorized_keys,
     this adds a new principals="name1[,name2,...]" key option.

     For CAs listed through sshd_config's TrustedCAKeys option, a new config
     option "AuthorizedPrincipalsFile" specifies a per-user file containing
     the list of acceptable names.

     If either option is absent, the current behaviour of requiring the
     username to appear in principals continues to apply.

     These options are useful for role accounts, disjoint account namespaces
     and "user@realm"-style naming policies in certificates.

     feedback and ok markus@

1 files changed, 13 insertions, 5 deletions

diff --git a/servconf.c b/servconf.c
index 7d027ddb9..c556986e3 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.207 2010/03/25 23:38:28 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.208 2010/05/07 11:30:29 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -131,6 +131,7 @@ initialize_server_options(ServerOptions *options)
         options->zero_knowledge_password_authentication = -1;
         options->revoked_keys_file = NULL;
         options->trusted_user_ca_keys = NULL;
+        options->authorized_principals_file = NULL;
 }
 
 void
@@ -310,7 +311,7 @@ typedef enum {
         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
-        sRevokedKeys, sTrustedUserCAKeys,
+        sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
         sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -432,6 +433,7 @@ static struct {
         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
+        { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
 };
 
@@ -1218,10 +1220,14 @@ process_server_config_line(ServerOptions *options, char *line,
          * AuthorizedKeysFile   /etc/ssh_keys/%u
          */
         case sAuthorizedKeysFile:
+                charptr = &options->authorized_keys_file;
+                goto parse_tilde_filename;
         case sAuthorizedKeysFile2:
-                charptr = (opcode == sAuthorizedKeysFile) ?
-                    &options->authorized_keys_file :
-                    &options->authorized_keys_file2;
+                charptr = &options->authorized_keys_file2;
+                goto parse_tilde_filename;
+        case sAuthorizedPrincipalsFile:
+                charptr = &options->authorized_principals_file;
+ parse_tilde_filename:
                 arg = strdelim(&cp);
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: missing file name.",
@@ -1682,6 +1688,8 @@ dump_config(ServerOptions *o)
         dump_cfg_string(sChrootDirectory, o->chroot_directory);
         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
+        dump_cfg_string(sAuthorizedPrincipalsFile,
+            o->authorized_principals_file);
 
         /* string arguments requiring a lookup */
         dump_cfg_string(sLogLevel, log_level_name(o->log_level));