Extend internal endpoints to process SSH certificates requests
What does this MR do and why?
Blueprint: https://docs.gitlab.com/ee/architecture/blueprints/ssh_certificates/
- Implement
internal/authorized_certs
endpoint. It acceptskey
of the CA anduser_identifier
of the user and returns the information if found - Extend
internal/allowed
endpoint to acceptnamespace_path
. It is the namespace in which the user is authenticated. If it doesn't match the root ancestor of the project it fails with 401
Extracted from: Draft: Support uploading CA files to a group (!126741 - closed)
Related issue: Add internal API endpoints for authorized SSH c... (#421538 - closed)
Steps
- Check out this branch
- Run
gdk start
- Go to Gitlab Shell project (
cd gitlab-shell
) - Check out
main
, stop the runningsshd
server:gdk stop sshd
-
export FF_GITLAB_SHELL_SSH_CERTIFICATES=1
to enable the Gitlab Shell feature flag -
make && bin/gitlab-sshd -config-dir=.
to compile and run sshd server - Generate an SSH certificate using these ssh-keygen steps
- Add CA.pub to a group using
rails c
or REST get, post and delete endpoints for SSH Cer... (!130866 - merged) - Try to
git clone
a project from the group: should be successful - Try to
git clone
a project from another group: should not be successful
Edited by Igor Drozdov