Struct YubiHsm2Backend 

pub struct YubiHsm2Backend<'admin_creds, 'config> {
    connector: Connector,
    runner: ScenarioRunner,
    admin_credentials: &'admin_creds YubiHsm2AdminCredentials,
    yubihsm2_config: &'config YubiHsm2Config,
    admin_user_mappings_and_creds: UserMappingsAndCredentials<'config, 'admin_creds>,
    default_credentials: RefCell<bool>,
}

A YubiHSM2 backend that provides control over a YubiHSM2 and its data.

Using a specific Connector, it is possible to synchronize a YubiHSM2 with the data provided by a YubiHsm2AdminCredentials and a YubiHsm2Config.

Fields

connector: Connector

runner: ScenarioRunner

admin_credentials: &'admin_creds YubiHsm2AdminCredentials

yubihsm2_config: &'config YubiHsm2Config

admin_user_mappings_and_creds: UserMappingsAndCredentials<'config, 'admin_creds>

default_credentials: RefCell<bool>

Indication whether the default credentials are in use currently.

Implementations

impl<'admin_creds, 'config> YubiHsm2Backend<'admin_creds, 'config>

pub fn new( connector: Connector, admin_credentials: &'admin_creds YubiHsm2AdminCredentials, signstar_config: &'config Config, ) -> Result<Option<Self>, Error>

Creates a new YubiHsm2Backend.

Returns Ok(None) if signstar_config contains no YubiHsm2Config.

Errors

Returns an error if

• the iteration of the admin_credentials does not match that of the signstar_config
• a set of administrative user mappings and corresponding credentials cannot be created from the admin_credentials and signstar_config

pub fn yubihsm2_config(&self) -> &YubiHsm2Config

Returns a reference to the YubiHsm2Config used for the backend.

pub fn default_credentials_in_use(&self) -> bool

Returns whether the default administrative credentials are in use.

Note

The default administrative credentials are considered no longer in use, if logging in with them failed once.

fn check_set_default_credentials(&self) -> bool

Checks whether the default credentials are in use and sets up YubiHsm2Backend accordingly.

Returns true, if YubiHsm2AdminCredentials::default_credentials can be used to connect to the YubiHSM2 and the authentication key object contains the required capabilities and domains. Returns false in all other cases.

pub fn sync(&self, user_credentials: &[Credentials]) -> Result<(), Error>

Syncs the state of a Signstar configuration with the backend using credentials for users in non-administrative roles.

fn add_openpgp_certificates( &self, non_admin_user_mappings_and_creds: &UserMappingsAndCredentials<'_, '_>, ) -> Result<(), Error>

Adds the OpenPGP certificates for keys that use them.

Note

Does not overwrite existing data!

Errors

Returns an error, if

• a usable administrative authentication key cannot be found
• retrieving of opaque data info fails
• creating an OpenPGP certificate for a signgin key fails
• the scenario of adding OpenPGP certificates as opaque data fails
• the return values of the scenario do not match the requested actions

fn add_signing_keys(&self) -> Result<(), Error>

Adds the asymmetric signing keys.

Note

Does not overwrite existing signing keys!

Errors

Returns an error, if

• a usable administrative authentication key cannot be found
• retrieving of signing key info fails
• the scenario of generating asymmetric signging keys fails
• the return values of the scenario do not match the requested actions

fn add_non_admin_users( &self, non_admin_user_mappings_and_creds: &UserMappingsAndCredentials<'_, '_>, ) -> Result<(), Error>

Adds non-administrative users.

Note

Existing authentication keys are replaced!

Errors

Returns an error, if

• a usable administrative authentication key cannot be found
• the list of authentication key objects cannot be retrieved from the backend
• a new authentication key cannot be created
• the scenario cannot be run successfully
• one or more return values of the scenario do not match the requested actions

fn add_wrap_key(&self) -> Result<(), Error>

Adds a wrap key based on the backup passphrase.

Note

Existing wrap keys are replaced!

Errors

Returns an error, if

• usable administrative credentials cannot be found
• infos about wrap keys cannot be retrieved from the backend
• a wrap key cannot be created from the backup passphrase
• running the scenario against the backend fails
• the scenario’s return values do not match the request

fn add_admin_users(&self) -> Result<(), Error>

Sets up all admin users in the backend.

Note

Existing authentication keys are replaced!

Errors

Returns an error, if

• no usable administrative credentials can be found
• currently used authentication keys cannot be retrieved from the backend
• the currently used credentials cannot be found in the set of available credentials
• the scenario for removing and/or adding all relevant administrative authentication keys fails
• the return values for the scenario do not match the requested actions
• the default admin credentials are still usable at the end of this function

fn usable_admin_creds(&self) -> Result<Credentials, Error>

Returns the currently usable credentials for an administrative user.

Errors

Returns an error, if no usable administrative credentials are found.

pub(crate) fn user_states(&self) -> Result<Vec<YubiHsm2BackendUserData>, Error>

Returns the list of available authentication key objects in the backend.

Errors

Returns an error, if

• no usable administrative credentials can be found
• retrieving the information on authentication key objects fails.

pub(crate) fn key_states( &self, ) -> Result<Vec<YubiHsm2BackendUserKeyData>, Error>

Returns the list of available non-authentication key objects in the backend.

Errors

Returns an error if

• no usable administrative credentials can be found
• the fetching of one or more object infos fails

Trait Implementations

impl<'admin_creds, 'config> Debug for YubiHsm2Backend<'admin_creds, 'config>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'admin_creds, 'config> TryFrom<&YubiHsm2Backend<'admin_creds, 'config>> for YubiHsm2BackendState

fn try_from( value: &YubiHsm2Backend<'admin_creds, 'config>, ) -> Result<Self, Self::Error>

Creates a new YubiHsm2BackendState from a YubiHsm2Backend.

Errors

Returns an error if retrieving the user or key states from the backend fails.

type Error = Error

The type returned in the event of a conversion error.