Enum UserMapping

pub enum UserMapping {
    NetHsmOnlyAdmin(UserId),
    SystemNetHsmBackup {
        nethsm_user: SystemWideUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    SystemNetHsmOperatorSigning {
        nethsm_user: UserId,
        key_id: KeyId,
        nethsm_key_setup: SigningKeySetup,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
        tag: String,
    },
    HermeticSystemNetHsmMetrics {
        nethsm_users: NetHsmMetricsUsers,
        system_user: SystemUserId,
    },
    SystemOnlyShareDownload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
    SystemOnlyShareUpload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
    SystemOnlyWireGuardDownload {
        system_user: SystemUserId,
        ssh_authorized_key: AuthorizedKeyEntry,
    },
}

User mapping between system users and [NetHsm] users

Variants

NetHsmOnlyAdmin(UserId)

A NetHsm user in the Administrator role, without a system user mapped to it

SystemNetHsmBackup

A system user, with SSH access, mapped to a system-wide [NetHsm] user in the Backup role.

Fields

nethsm_user: SystemWideUserId

The name of the [NetHsm] user.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

SystemNetHsmMetrics

A system user, with SSH access, mapped to a system-wide [NetHsm] user in the Metrics role and n users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

The [NetHsm] users in the [Metrics][UserRole::Metrics] and [operator][UserRole::Operator] role.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

SystemNetHsmOperatorSigning

A system user, with SSH access, mapped to a [NetHsm] user in the Operator role with access to a single signing key.

Signing key and NetHSM user are mapped using a tag.

Fields

nethsm_user: UserId

The name of the [NetHsm] user.

key_id: KeyId

The ID of the [NetHsm] key.

nethsm_key_setup: SigningKeySetup

The setup of a [NetHsm] key.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

tag: String

The tag used for the user and the signing key on the [NetHsm].

HermeticSystemNetHsmMetrics

A system user, without SSH access, mapped to a system-wide [NetHsm] user in the Metrics role and one or more NetHsm users in the Operator role with read-only access to zero or more keys

Fields

nethsm_users: NetHsmMetricsUsers

The [NetHsm] users in the [Metrics][UserRole::Metrics] and [operator][UserRole::Operator] role.

system_user: SystemUserId

The name of the system user.

SystemOnlyShareDownload

A system user, with SSH access, not mapped to any backend user, that is used for downloading shares of a shared secret.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

SystemOnlyShareUpload

A system user, with SSH access, not mapped to any backend user, that is used for uploading shares of a shared secret.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

SystemOnlyWireGuardDownload

A system user, with SSH access, not mapped to any backend user, that is used for downloading the WireGuard configuration of the host.

Fields

system_user: SystemUserId

The name of the system user.

ssh_authorized_key: AuthorizedKeyEntry

The list of SSH public keys used for connecting to the system_user.

Implementations

impl UserMapping

pub fn get_system_user(&self) -> Option<&SystemUserId>

Returns the optional system user of the mapping

Examples

use signstar_config::{SystemUserId, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_system_user(), Some(&SystemUserId::new("user1".to_string())?));

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_system_user(), None);

pub fn get_nethsm_users(&self) -> Vec<UserId>

Returns the NetHsm users of the mapping

Examples

use nethsm::UserId;
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_users().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users(), vec![UserId::new("user1".to_string())?]);

pub fn get_nethsm_users_and_roles(&self) -> Vec<(UserId, UserRole)>

Returns the list of all tracked [UserId]s and their respective [UserRole]s.

Examples

use nethsm::{UserId, UserRole};
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_users_and_roles().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_nethsm_users_and_roles(), vec![(UserId::new("user1".to_string())?, UserRole::Administrator)]);

pub fn get_nethsm_user_role_and_tags( &self, ) -> Vec<(UserId, UserRole, Vec<String>)>

Returns a list of tuples containing [UserId], [UserRole] and a list of tags.

Note

Certain variants of UserMapping such as UserMapping::SystemOnlyShareDownload, UserMapping::SystemOnlyShareUpload and UserMapping::SystemOnlyWireGuardDownload always return an empty Vec because they do not track backend users.

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList, UserId, UserRole};
use signstar_crypto::key::SigningKeySetup;
use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    key_id: "key1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(
    mapping.get_nethsm_user_role_and_tags(),
    vec![(UserId::new("user1".to_string())?, UserRole::Operator, vec!["tag1".to_string()])]);

pub fn get_ssh_authorized_key(&self) -> Option<&AuthorizedKeyEntry>

Returns the SSH authorized key of the mapping if it exists.

Returns None if the mapping does not have an SSH authorized key.

Examples

use std::str::FromStr;

use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_ssh_authorized_key(), Some(&AuthorizedKeyEntry::from_str("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host")?));

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert_eq!(mapping.get_ssh_authorized_key(), None);

pub fn get_nethsm_key_ids(&self, namespace: Option<&NamespaceId>) -> Vec<KeyId>

Returns all used [KeyId]s of the mapping

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList};
use signstar_crypto::key::SigningKeySetup;
use signstar_config::{AuthorizedKeyEntry, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    key_id: "key1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_nethsm_key_ids(None), vec![KeyId::new("key1".to_string())?]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_nethsm_key_ids(None), vec![]);

pub fn get_nethsm_tags(&self, namespace: Option<&NamespaceId>) -> Vec<&str>

Returns tags for keys and users

Tags can be filtered by namespace by providing Some namespace. Providing None implies that the context is system-wide.

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList};
use signstar_crypto::key::SigningKeySetup;
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_tags(None).is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_nethsm_tags(None).is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    key_id: "key1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert!(mapping.get_nethsm_tags(None).is_empty());
assert_eq!(mapping.get_nethsm_tags(Some(&"ns1".parse()?)), vec!["tag1"]);

pub fn get_nethsm_user_key_and_tag( &self, filter: FilterUserKeys, ) -> Vec<(UserId, KeyId, SigningKeySetup, String)>

Returns a list of tuples of [UserId], [KeyId], SigningKeySetup and tag for the mapping.

Using a filter (see FilterUserKeys) it is possible to have only a subset of the available tuples be returned:

• FilterUserKeys::All: Returns all available tuples.
• FilterUserKeys::Namespaced: Returns tuples that match [UserId]s with a namespace.
• FilterUserKeys::Namespace: Returns tuples that match [UserId]s with a specific namespace.
• FilterUserKeys::SystemWide: Returns tuples that match [UserId]s without a namespace.
• FilterUserKeys::Namespace: Returns tuples that match a specific tag.

Examples

use nethsm::{CryptographicKeyContext, KeyId, OpenPgpUserIdList, UserId};
use signstar_crypto::key::SigningKeySetup;
use signstar_config::{FilterUserKeys, UserMapping};

let mapping = UserMapping::SystemNetHsmOperatorSigning {
    nethsm_user: "user1".parse()?,
    key_id: "key1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "v4".parse()?,
        },
    )?,
    system_user: "ssh-user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(
    mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All),
    vec![(
        "user1".parse()?,
        "key1".parse()?,
        SigningKeySetup::new(
            "Curve25519".parse()?,
            vec!["EdDsaSignature".parse()?],
            None,
            "EdDsa".parse()?,
            CryptographicKeyContext::OpenPgp{
                user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
                version: "v4".parse()?,
            },
        )?,
        "tag1".to_string(),
    )]
);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Namespace("test".parse()?)), vec![]);
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::Tag("tag2".parse()?)), vec![]);

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert_eq!(mapping.get_nethsm_user_key_and_tag(FilterUserKeys::All), vec![]);

pub fn get_nethsm_namespaces(&self) -> Vec<NamespaceId>

Returns all [NetHsm][nethsm::NetHsm] namespaces of the mapping

Examples

use nethsm::{CryptographicKeyContext, OpenPgpUserIdList};
use signstar_crypto::key::SigningKeySetup;
use signstar_config::UserMapping;

let mapping = UserMapping::SystemOnlyShareDownload {
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
};
assert!(mapping.get_nethsm_namespaces().is_empty());

let mapping = UserMapping::NetHsmOnlyAdmin("user1".parse()?);
assert!(mapping.get_nethsm_namespaces().is_empty());

let mapping = UserMapping::SystemNetHsmOperatorSigning{
    nethsm_user: "ns1~user1".parse()?,
    key_id: "key1".parse()?,
    nethsm_key_setup: SigningKeySetup::new(
        "Curve25519".parse()?,
        vec!["EdDsaSignature".parse()?],
        None,
        "EdDsa".parse()?,
        CryptographicKeyContext::OpenPgp{
            user_ids: OpenPgpUserIdList::new(vec!["John Doe <john@example.org>".parse()?])?,
            version: "4".parse()?,
    })?,
    system_user: "user1".parse()?,
    ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3NyNfSqtDxdnWwSVzulZi0k7Lyjw3vBEG+U8y6KsuW user@host".parse()?,
    tag: "tag1".to_string(),
};
assert_eq!(mapping.get_nethsm_namespaces(), vec!["ns1".parse()?]);

pub fn has_system_and_backend_user(&self) -> bool

Returns whether the mapping has both system and HSM backend users.

Returns true if the self has at least one system and one HSM backend user, and false otherwise.

Trait Implementations

impl Clone for UserMapping

fn clone(&self) -> UserMapping

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserMapping

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UserMapping

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for UserMapping

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for UserMapping

fn eq(&self, other: &UserMapping) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for UserMapping

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for UserMapping

impl StructuralPartialEq for UserMapping