Documentation
¶
Index ¶
- Constants
- Variables
- func CertKeyPEM(ctx context.Context, username, domain string, ttl time.Duration, ...) (certPEM, keyPEM []byte, err error)
- func GenerateCredentials(ctx context.Context, username, domain string, ttl time.Duration, ...) (certDER, keyDER []byte, err error)
- func SubjectAltNameExtension(user, domain string) (pkix.Extension, error)
- type LDAPConfig
- type SubjectAltName
Constants ¶
const ( // CertTTL is the TTL for Teleport-issued Windows Certificates. // Certificates are requested on each connection attempt, so the TTL is // deliberately set to a small value to give enough time to establish a // single desktop session. CertTTL = 5 * time.Minute )
Variables ¶
var ( // EnhancedKeyUsageExtensionOID is the object identifier for a // certificate's enhanced key usage extension EnhancedKeyUsageExtensionOID = asn1.ObjectIdentifier{2, 5, 29, 37} // SubjectAltNameExtensionOID is the object identifier for a // certificate's subject alternative name extension SubjectAltNameExtensionOID = asn1.ObjectIdentifier{2, 5, 29, 17} // ClientAuthenticationOID is the object idnetifier that is used to // include client SSL authentication in a certificate's enhanced // key usage ClientAuthenticationOID = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2} // SmartcardLogonOID is the object identifier that is used to include // smartcard login in a certificate's enhanced key usage SmartcardLogonOID = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 20, 2, 2} // UPNOtherNameOID is the object identifier that is used to include // the user principal name in a certificate's subject alternative name UPNOtherNameOID = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 20, 2, 3} )
The following vars contain the various object identifiers required for smartcard login certificates.
var EnhancedKeyUsageExtension = pkix.Extension{ Id: EnhancedKeyUsageExtensionOID, Value: func() []byte { val, err := asn1.Marshal([]asn1.ObjectIdentifier{ ClientAuthenticationOID, SmartcardLogonOID, }) if err != nil { panic(err) } return val }(), }
EnhancedKeyUsageExtension is a set of required extended key fields specific for Microsoft certificates
Functions ¶
func CertKeyPEM ¶
func CertKeyPEM(ctx context.Context, username, domain string, ttl time.Duration, clusterName string, ldapConfig LDAPConfig, authClient auth.ClientI) (certPEM, keyPEM []byte, err error)
CertKeyPEM returns certificate and private key bytes encoded in PEM format for use with `kinit`
func GenerateCredentials ¶
func GenerateCredentials(ctx context.Context, username, domain string, ttl time.Duration, clusterName string, ldapConfig LDAPConfig, authClient auth.ClientI) (certDER, keyDER []byte, err error)
GenerateCredentials generates a private key / certificate pair for the given Windows username. The certificate has certain special fields different from the regular Teleport user certificate, to meet the requirements of Active Directory. See: https://docs.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration
Types ¶
type LDAPConfig ¶
type LDAPConfig struct {
// Addr is the LDAP server address in the form host:port.
// Standard port is 636 for LDAPS.
Addr string
// Domain is an Active Directory domain name, like "example.com".
Domain string
// Username is an LDAP username, like "EXAMPLE\Administrator", where
// "EXAMPLE" is the NetBIOS version of Domain.
Username string
// InsecureSkipVerify decides whether we skip verifying with the LDAP server's CA when making the LDAPS connection.
InsecureSkipVerify bool
// ServerName is the name of the LDAP server for TLS.
ServerName string
// CA is an optional CA cert to be used for verification if InsecureSkipVerify is set to false.
CA *x509.Certificate
}
LDAPConfig contains parameters for connecting to an LDAP server.
func (LDAPConfig) DomainDN ¶
func (cfg LDAPConfig) DomainDN() string
DomainDN returns the distinguished name for the domain
type SubjectAltName ¶
type SubjectAltName struct {
OtherName otherName `asn1:"tag:0"`
}
SubjectAltName is a struct for marshaling the SAN field in a certificate
Source Files