Struct ExtendedUserMapping

pub struct ExtendedUserMapping {
    admin_secret_handling: AdministrativeSecretHandling,
    non_admin_secret_handling: NonAdministrativeSecretHandling,
    connections: HashSet<Connection>,
    user_mapping: UserMapping,
}

A UserMapping centric view of a SignstarConfig.

Wraps a single UserMapping, as well as the system-wide AdministrativeSecretHandling, NonAdministrativeSecretHandling and [Connection]s.

Fields

admin_secret_handling: AdministrativeSecretHandling

non_admin_secret_handling: NonAdministrativeSecretHandling

connections: HashSet<Connection>

user_mapping: UserMapping

Implementations

impl ExtendedUserMapping

pub fn new( admin_secret_handling: AdministrativeSecretHandling, non_admin_secret_handling: NonAdministrativeSecretHandling, connections: HashSet<Connection>, user_mapping: UserMapping, ) -> Self

Creates a new ExtendedUserMapping.

pub fn get_admin_secret_handling(&self) -> AdministrativeSecretHandling

Returns the AdministrativeSecretHandling.

pub fn get_connections(&self) -> HashSet<Connection>

Returns the [Connection]s.

pub fn get_non_admin_secret_handling(&self) -> NonAdministrativeSecretHandling

Returns the NonAdministrativeSecretHandling.

pub fn get_user_mapping(&self) -> &UserMapping

Returns the UserMapping.

pub fn load_credentials(&self) -> Result<CredentialsLoading, Error>

Loads credentials for each [UserId] associated with a SystemUserId.

The SystemUserId of the mapping must be equal to the current system user calling this function. Relies on get_plaintext_secret_file and get_systemd_creds_secret_file to retrieve the specific path to a secret file for each [UserId] mapped to a SystemUserId.

Returns a CredentialsLoading, which may contain critical errors related to loading a passphrase for each available [UserId]. The caller is expected to handle any errors tracked in the returned object based on context.

Errors

Returns an error if

• the ExtendedUserMapping provides no SystemUserId,
• no system user equal to the SystemUserId exists,
• the SystemUserId is not equal to the currently calling system user,
• or the systemd-creds command is not available when trying to decrypt secrets.

pub fn create_secrets_dir(&self) -> Result<(), Error>

Creates secrets directories for all non-administrative mappings.

Matches the SystemUserId in a mapping with an actual user on the system. Creates the passphrase directory for the user and ensures correct ownership of it and all parent directories up until the user’s home directory.

Errors

Returns an error if

• no system user is available in the mapping,
• the system user of the mapping is not available on the system,
• the directory could not be created,
• the ownership of any directory between the user’s home and the passphrase directory can not be changed.

pub fn create_non_administrative_secrets(&self) -> Result<(), Error>

Creates passphrases for all non-administrative mappings.

Creates a random alphanumeric, 30-char long passphrase for each backend user of each non-administrative user mapping.

• If self is configured to use NonAdministrativeSecretHandling::Plaintext, the passphrase is stored in a secrets file, defined by get_plaintext_secret_file.
• If self is configured to use NonAdministrativeSecretHandling::SystemdCreds, the passphrase is encrypted using systemd-creds and stored in a secrets file, defined by get_systemd_creds_secret_file.

Errors

Returns an error if

• the targeted system user does not exist in the mapping or on the system,
• the function is called using a non-root user,
• the systemd-creds command is not available when trying to encrypt the passphrase,
• the encryption of the passphrase using systemd-creds fails,
• the secrets file can not be created,
• the secrets file can not be written to,
• or the ownership and permissions of the secrets file can not be changed.

Trait Implementations

impl Clone for ExtendedUserMapping

fn clone(&self) -> ExtendedUserMapping

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExtendedUserMapping

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ExtendedUserMapping

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ExtendedUserMapping

fn eq(&self, other: &ExtendedUserMapping) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ExtendedUserMapping

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ExtendedUserMapping

impl StructuralPartialEq for ExtendedUserMapping