agentless

Documentation

Overview

Package agentless provides functions to allow connecting to registered OpenSSH (agentless) nodes.

Index

• type AuthProvider
• type CertGenerator
• type SignerCreator
  • func SignerFromAuthzContext(authzCtx *authz.Context, authClient AuthProvider, clusterName string) SignerCreator
  • func SignerFromSSHCertificate(cert *ssh.Certificate, authClient AuthProvider, ...) SignerCreator

Types

type AuthProvider

type AuthProvider interface {
	GetUser(ctx context.Context, username string, withSecrets bool) (types.User, error)
	GetRole(ctx context.Context, name string) (types.Role, error)
}

AuthProvider is a subset of the full Auth API that must be connected to the root cluster.

type CertGenerator

type CertGenerator interface {
	GenerateOpenSSHCert(ctx context.Context, req *proto.OpenSSHCertRequest) (*proto.OpenSSHCert, error)
}

CertGenerator generates certificates from a certificate request. It must be connected to the same cluster as the target node that this certificate will be generated to authenticate to.

type SignerCreator

type SignerCreator func(ctx context.Context, certGen CertGenerator) (ssh.Signer, error)

SignerCreator returns an ssh.Signer that can be used to authenticate with an agentless node.

func SignerFromAuthzContext

func SignerFromAuthzContext(authzCtx *authz.Context, authClient AuthProvider, clusterName string) SignerCreator

SignerFromAuthzContext returns a function that attempts to create a ssh.Signer for the [tlsca.Identity] in the provided authz.Context that is signed with the OpenSSH CA and can be used to authenticate to agentless nodes. authClient must be connected to the root cluster, and the CertGenerator passed into the returned function must be connected to the same cluster as the target node.

func SignerFromSSHCertificate

func SignerFromSSHCertificate(cert *ssh.Certificate, authClient AuthProvider, clusterName, teleportUser string) SignerCreator

SignerFromSSHCertificate returns a function that attempts to create a ssh.Signer for the Identity in the provided ssh.Certificate that is signed with the OpenSSH CA and can be used to authenticate to agentless nodes. authClient must be connected to the root cluster, and the CertGenerator passed into the returned function must be connected to the same cluster as the target node.