Skip to content

Extend internal endpoints to process SSH certificates requests

What does this MR do and why?

Blueprint: https://docs.gitlab.com/ee/architecture/blueprints/ssh_certificates/

  • Implement internal/authorized_certs endpoint. It accepts key of the CA and user_identifier of the user and returns the information if found
  • Extend internal/allowed endpoint to accept namespace_path. It is the namespace in which the user is authenticated. If it doesn't match the root ancestor of the project it fails with 401

Extracted from: Draft: Support uploading CA files to a group (!126741 - closed)

Related issue: Add internal API endpoints for authorized SSH c... (#421538 - closed)

Steps

  • Check out this branch
  • Run gdk start
  • Go to Gitlab Shell project (cd gitlab-shell)
  • Check out main, stop the running sshd server: gdk stop sshd
  • export FF_GITLAB_SHELL_SSH_CERTIFICATES=1 to enable the Gitlab Shell feature flag
  • make && bin/gitlab-sshd -config-dir=. to compile and run sshd server
  • Generate an SSH certificate using these ssh-keygen steps
  • Add CA.pub to a group using rails c or REST get, post and delete endpoints for SSH Cer... (!130866 - merged)
  • Try to git clone a project from the group: should be successful
  • Try to git clone a project from another group: should not be successful
Edited by Igor Drozdov

Merge request reports

Loading