Enum UserMapping

pub enum UserMapping {
    NetHsmOnlyAdmin(UserId),
    SystemNetHsmBackup {
        nethsm_user: SystemWideUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmOperatorSigning {
        nethsm_user: UserId,
        nethsm_key_setup: SigningKeySetup,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
        tag: String,
    },
    HermeticSystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        system_user: SystemUserId,
    },
    SystemOnlyShareDownload {
        system_user: SystemUserId,
        ssh_authorized_keys: AuthorizedKeyEntryList,
    },
    SystemOnlyShareUpload {
        system_user: SystemUserId,
        ssh_authorized_keys: AuthorizedKeyEntryList,
    },
    SystemOnlyWireGuardDownload {
        system_user: SystemUserId,
        ssh_authorized_keys: AuthorizedKeyEntryList,
    },
}

User mapping between system users and [NetHsm][nethsm::NetHsm] users

Variants

NetHsmOnlyAdmin(UserId)

A NetHsm user in the Administrator role, without a system user mapped to it

SystemNetHsmBackup

A system user, with SSH access, mapped to a system-wide [NetHsm][nethsm::NetHsm] user in the Backup role

Fields

nethsm_user: SystemWideUserId

ssh_authorized_key: AuthorizedKeyEntry

system_user: SystemUserId

SystemNetHsmMetrics

A system user, with SSH access, mapped to a system-wide [NetHsm][nethsm::NetHsm] user in the Metrics role and n users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

ssh_authorized_key: AuthorizedKeyEntry

system_user: SystemUserId

SystemNetHsmOperatorSigning

A system user, with SSH access, mapped to a [NetHsm][nethsm::NetHsm] user in the Operator role with access to a single signing key.

Signing key and NetHSM user are mapped using a tag.

Fields

nethsm_user: UserId

nethsm_key_setup: SigningKeySetup

ssh_authorized_key: AuthorizedKeyEntry

system_user: SystemUserId

tag: String

HermeticSystemNetHsmMetrics

A system user, without SSH access, mapped to a system-wide [NetHsm][nethsm::NetHsm] user in the Metrics role and one or more NetHsm users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

system_user: SystemUserId

SystemOnlyShareDownload

A system user, with SSH access for one or more SSH keys, not mapped to any NetHsm user, used for downloading shares of a shared secret

Fields

system_user: SystemUserId

ssh_authorized_keys: AuthorizedKeyEntryList

SystemOnlyShareUpload

A system user, with SSH access for one or more SSH keys, not mapped to any NetHsm user, used for uploading shares of a shared secret

Fields

system_user: SystemUserId

ssh_authorized_keys: AuthorizedKeyEntryList

SystemOnlyWireGuardDownload

A system user, with SSH access for one or more SSH keys, not mapped to any NetHsm user, used for downloading WireGuard configuration

Fields

system_user: SystemUserId

ssh_authorized_keys: AuthorizedKeyEntryList

Implementations

impl UserMapping

pub fn get_system_user(&self) -> Option<&SystemUserId>

Returns the optional system user of the mapping

Examples

use nethsm_config::{AuthorizedKeyEntryList, SystemUserId, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert_eq!(mapping.get_system_user(), Some(&SystemUserId::new("user1".to_string())?));

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_system_user(), None);

pub fn get_nethsm_users(&self) -> Vec<UserId>

Returns the NetHsm users of the mapping

Examples

use nethsm::UserId;
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert!(mapping.get_nethsm_users().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users(), vec![UserId::new("user1".to_string())?]);

pub fn get_nethsm_users_and_roles(&self) -> Vec<(UserId, UserRole)>

Returns the list of all tracked [UserId]s and their respective [UserRole]s.

Examples

use nethsm::{UserId, UserRole};
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert!(mapping.get_nethsm_users_and_roles().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users_and_roles(), vec![(UserId::new("user1".to_string())?, UserRole::Administrator)]);

pub fn get_nethsm_user_role_and_tag(&self) -> Option<(UserId, UserRole, &str)>

Returns the tracked [UserId], its respective [UserRole] and tag.

Examples

use nethsm::{UserId, UserRole};
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert!(mapping.get_nethsm_user_role_and_tag().is_none());

pub fn get_ssh_authorized_keys(&self) -> Vec<AuthorizedKeyEntry>

Returns the SSH authorized keys of the mapping

Examples

use nethsm_config::{AuthorizedKeyEntry, AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert_eq!(mapping.get_ssh_authorized_keys(), vec![AuthorizedKeyEntry::new("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".to_string())?]);

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_ssh_authorized_keys(), vec![]);

pub fn get_key_ids(&self, namespace: Option<&NamespaceId>) -> Vec<KeyId>

Returns all used [KeyId]s of the mapping

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList, SigningKeySetup};
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_key_ids(None), vec![KeyId::new("key1".to_string())?]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert_eq!(mapping.get_key_ids(None), vec![]);

pub fn get_tags(&self, namespace: Option<&NamespaceId>) -> Vec<&str>

Returns tags for keys and users

Tags can be filtered by namespace by providing Some namespace. Providing None implies that the context is system-wide.

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, SigningKeySetup};
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert!(mapping.get_tags(None).is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_tags(None).is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert!(mapping.get_tags(None).is_empty());
assert_eq!(mapping.get_tags(Some(&"ns1".parse()?)), vec!["tag1"]);

pub fn get_nethsm_user_key_and_tag( &self, filter: FilterUserKeys, ) -> Vec<(UserId, SigningKeySetup, String)>

Returns a list of tuples of [UserId], [SigningKeySetup] and tag for the mapping.

Using a filter (see FilterUserKeys) it is possible to have only a subset of the available tuples be returned:

• FilterUserKeys::All: Returns all available tuples.
• FilterUserKeys::Namespaced: Returns tuples that match [UserId]s with a namespace.
• FilterUserKeys::Namespace: Returns tuples that match [UserId]s with a specific namespace.
• FilterUserKeys::SystemWide: Returns tuples that match [UserId]s without a namespace.
• FilterUserKeys::Namespace: Returns tuples that match a specific tag.

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList, SigningKeySetup, UserId};
use nethsm_config::{AuthorizedKeyEntryList, FilterUserKeys, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(
    mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All),
    vec![(
        UserId::new("user1".to_string())?,
        SigningKeySetup::new(
            "key1".parse()?,
            "Curve25519".parse()?,
            vec!["EdDsaSignature".parse()?],
            None,
            "EdDsa".parse()?,
            CryptographicKeyContext::OpenPgp{
                user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
                version: "v4".parse()?,
            },
        )?,
        "tag1".to_string(),
    )]
);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Namespace("test".parse()?)), vec![]);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Tag("tag2".parse()?)), vec![]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All), vec![]);

pub fn get_namespaces(&self) -> Vec<NamespaceId>

Returns all [NetHsm][nethsm::NetHsm] namespaces of the mapping

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, SigningKeySetup};
use nethsm_config::{AuthorizedKeyEntryList, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_keys: AuthorizedKeyEntryList::new(vec!["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?])?,
};
assert!(mapping.get_namespaces().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_namespaces().is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_namespaces(), vec!["ns1".parse()?]);

pub fn has_system_and_nethsm_user(&self) -> bool

Returns whether the mapping has both system and [NetHsm] users.

Returns true if the self has at least one system and one [NetHsm] user, and false otherwise.

Trait Implementations

impl Clone for UserMapping

fn clone(&self) -> UserMapping

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserMapping

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UserMapping

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for UserMapping

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for UserMapping

fn eq(&self, other: &UserMapping) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for UserMapping

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for UserMapping

impl StructuralPartialEq for UserMapping