Enum UserMapping

pub enum UserMapping {
    NetHsmOnlyAdmin(UserId),
    SystemNetHsmBackup {
        nethsm_user: SystemWideUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmOperatorSigning {
        nethsm_user: UserId,
        nethsm_key_setup: SigningKeySetup,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
        tag: String,
    },
    HermeticSystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        system_user: SystemUserId,
    },
    SystemOnlyShareDownload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
    SystemOnlyShareUpload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
    SystemOnlyWireGuardDownload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
}

User mapping between system users and [NetHsm] users

Variants

NetHsmOnlyAdmin(UserId)

A NetHsm user in the Administrator role, without a system user mapped to it

SystemNetHsmBackup

A system user, with SSH access, mapped to a system-wide [NetHsm] user in the Backup role.

Fields

nethsm_user: SystemWideUserId

The name of the [NetHsm] user.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

SystemNetHsmMetrics

A system user, with SSH access, mapped to a system-wide [NetHsm] user in the Metrics role and n users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

The [NetHsm] users in the [Metrics][UserRole::Metrics] and [operator][UserRole::Operator] role.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

SystemNetHsmOperatorSigning

A system user, with SSH access, mapped to a [NetHsm] user in the Operator role with access to a single signing key.

Signing key and NetHSM user are mapped using a tag.

Fields

nethsm_user: UserId

The name of the [NetHsm] user.

nethsm_key_setup: SigningKeySetup

The setup of a [NetHsm] key.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

tag: String

The tag used for the user and the signing key on the [NetHsm].

HermeticSystemNetHsmMetrics

A system user, without SSH access, mapped to a system-wide [NetHsm] user in the Metrics role and one or more NetHsm users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

The [NetHsm] users in the [Metrics][UserRole::Metrics] and [operator][UserRole::Operator] role.

system_user: SystemUserId

The name of the system user.

SystemOnlyShareDownload

A system user, with SSH access, not mapped to any backend user, that is used for downloading shares of a shared secret.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

SystemOnlyShareUpload

A system user, with SSH access, not mapped to any backend user, that is used for uploading shares of a shared secret.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

SystemOnlyWireGuardDownload

A system user, with SSH access, not mapped to any backend user, that is used for downloading the WireGuard configuration of the host.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

Implementations

impl UserMapping

pub fn get_system_user(&self) -> Option<&SystemUserId>

Returns the optional system user of the mapping

Examples

use signstar_config::{SystemUserId, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_system_user(), Some(&SystemUserId::new("user1".to_string())?));

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_system_user(), None);

pub fn get_nethsm_users(&self) -> Vec<UserId>

Returns the NetHsm users of the mapping

Examples

use nethsm::UserId;
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_users().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users(), vec![UserId::new("user1".to_string())?]);

pub fn get_nethsm_users_and_roles(&self) -> Vec<(UserId, UserRole)>

Returns the list of all tracked [UserId]s and their respective [UserRole]s.

Examples

use nethsm::{UserId, UserRole};
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_users_and_roles().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users_and_roles(), vec![(UserId::new("user1".to_string())?, UserRole::Administrator)]);

pub fn get_nethsm_user_role_and_tags( &self, ) -> Vec<(UserId, UserRole, Vec<String>)>

Returns a list of tuples containing [UserId], [UserRole] and a list of tags.

Note

Certain variants of UserMapping such as UserMapping::SystemOnlyShareDownload, UserMapping::SystemOnlyShareUpload and UserMapping::SystemOnlyWireGuardDownload always return an empty Vec because they do not track backend users.

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, SigningKeySetup, UserId, UserRole};
use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(
    mapping.get_nethsm_user_role_and_tags(),
    vec![(UserId::new("user1".to_string())?, UserRole::Operator, vec!["tag1".to_string()])]);

pub fn get_ssh_authorized_key(&self) -> Option<&AuthorizedKeyEntry>

Returns the SSH authorized key of the mapping if it exists.

Returns None if the mapping does not have an SSH authorized key.

Examples

use std::str::FromStr;

use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_ssh_authorized_key(), Some(&AuthorizedKeyEntry::from_str("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host")?));

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_ssh_authorized_key(), None);

pub fn get_key_ids(&self, namespace: Option<&NamespaceId>) -> Vec<KeyId>

Returns all used [KeyId]s of the mapping

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList, SigningKeySetup};
use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_key_ids(None), vec![KeyId::new("key1".to_string())?]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_key_ids(None), vec![]);

pub fn get_tags(&self, namespace: Option<&NamespaceId>) -> Vec<&str>

Returns tags for keys and users

Tags can be filtered by namespace by providing Some namespace. Providing None implies that the context is system-wide.

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, SigningKeySetup};
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_tags(None).is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_tags(None).is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert!(mapping.get_tags(None).is_empty());
assert_eq!(mapping.get_tags(Some(&"ns1".parse()?)), vec!["tag1"]);

pub fn get_nethsm_user_key_and_tag( &self, filter: FilterUserKeys, ) -> Vec<(UserId, SigningKeySetup, String)>

Returns a list of tuples of [UserId], [SigningKeySetup] and tag for the mapping.

Using a filter (see FilterUserKeys) it is possible to have only a subset of the available tuples be returned:

• FilterUserKeys::All: Returns all available tuples.
• FilterUserKeys::Namespaced: Returns tuples that match [UserId]s with a namespace.
• FilterUserKeys::Namespace: Returns tuples that match [UserId]s with a specific namespace.
• FilterUserKeys::SystemWide: Returns tuples that match [UserId]s without a namespace.
• FilterUserKeys::Namespace: Returns tuples that match a specific tag.

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList, SigningKeySetup, UserId};
use signstar_config::{FilterUserKeys, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(
    mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All),
    vec![(
        UserId::new("user1".to_string())?,
        SigningKeySetup::new(
            "key1".parse()?,
            "Curve25519".parse()?,
            vec!["EdDsaSignature".parse()?],
            None,
            "EdDsa".parse()?,
            CryptographicKeyContext::OpenPgp{
                user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
                version: "v4".parse()?,
            },
        )?,
        "tag1".to_string(),
    )]
);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Namespace("test".parse()?)), vec![]);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Tag("tag2".parse()?)), vec![]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All), vec![]);

pub fn get_namespaces(&self) -> Vec<NamespaceId>

Returns all [NetHsm][nethsm::NetHsm] namespaces of the mapping

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, SigningKeySetup};
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_namespaces().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_namespaces().is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "key1".parse()?,
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_namespaces(), vec!["ns1".parse()?]);

pub fn has_system_and_nethsm_user(&self) -> bool

Returns whether the mapping has both system and [NetHsm] users.

Returns true if the self has at least one system and one [NetHsm] user, and false otherwise.

Trait Implementations

impl Clone for UserMapping

fn clone(&self) -> UserMapping

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserMapping

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UserMapping

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for UserMapping

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for UserMapping

fn eq(&self, other: &UserMapping) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for UserMapping

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for UserMapping

impl StructuralPartialEq for UserMapping