Enum YubiHsm2UserMapping 

pub enum YubiHsm2UserMapping {
    Admin {
        authentication_key_id: Id,
    },
    AuditLog {
        authentication_key_id: Id,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    Backup {
        authentication_key_id: Id,
        wrapping_key_id: Id,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
    HermeticAuditLog {
        authentication_key_id: Id,
        system_user: SystemUserId,
    },
    Signing {
        authentication_key_id: Id,
        key_setup: SigningKeySetup,
        domain: Domain,
        signing_key_id: Id,
        ssh_authorized_key: AuthorizedKeyEntry,
        system_user: SystemUserId,
    },
}

User and data mapping between system users and YubiHSM2 users.

Variants

Admin

A YubiHSM2 user in the administrator role, without a system user mapped to it.

Tracks an authentication key object with a specific authentication_key_id.

Note

This variant implies, that the created authentication key object has all relevant capabilities necessary for the creation of users and keys and to restore from backup, i.e.:

• delete-asymmetric-key
• generate-asymmetric-key
• put-asymmetric-key
• delete-authentication-key
• put-authentication-key
• change-authentication-key
• get-option
• set-option
• delete-hmac-key
• generate-hmac-key
• put-mac-key
• sign-hmac
• verify-hmac
• delete-opaque
• generate-opaque
• get-opaque
• put-opaque
• reset-device
• delete-template
• get-template
• put-template
• delete-wrap-key
• exportable-under-wrap
• generate-wrap-key
• import-wrapped
• put-wrap-key
• unwrap-data
• wrap-data
• put-public-wrap-key
• delete-public-wrap-key
• generate-symmetric-key
• put-symmetric-key
• delete-symmetric-key

Further, it is assumed that the authentication key object is added to all domains.

Fields

authentication_key_id: Id

The identifier of the authentication key used to create a session with the YubiHSM2.

AuditLog

A system user, with SSH access, mapped to a YubiHSM2 authentication key.

This variant tracks

• an authentication key object with a specific authentication_key_id
• an SSH authorized key with a specific ssh_authorized_key
• a system user ID using system_user

Its data is used to create relevant system and backend users for the retrieval of audit logs over the network, made available by the YubiHSM2.

Note

This variant implies, that the created authentication key object has all relevant capabilities for audit log retrieval (i.e. get-log-entries).

Fields

authentication_key_id: Id

The identifier of the authentication key used to create a session with the YubiHSM2.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

Backup

A mapping used for the creation of YubiHSM2 backups.

This variant tracks

• an [authentication key object] with a specific authentication_key_id
• a wrap key object with a specific wrapping_key_id
• an SSH authorized key with a specific ssh_authorized_key
• a system user ID using system_user

Its data is used to create relevant system and backend users for the creation of backups of all keys (including [authentication key object]s) and non-key material (e.g. OpenPGP certificates) of a YubiHSM2.

Note

This variant implies, that the created [authentication key object] has all relevant capabilities for backup related actions (i.e. export-wrapped, wrap-data).

Further, it is assumed that both the [authentication key object] and wrap key object are added to all domains.

Fields

authentication_key_id: Id

The identifier of the authentication key used to create a session with the YubiHSM2.

This represents an authentication key object.

wrapping_key_id: Id

The identifier of the wrapping key in the YubiHSM2 backend.

This identifies the encryption key used for wrapping backups of all keys of the YubiHSM2.

Note

The wrapping key is automatically added to all domains.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

HermeticAuditLog

A system user, without SSH access, mapped to a YubiHSM2 authentication key for collecting audit logs.

This variant tracks

• an authentication key object with a specific authentication_key_id
• a system user ID using system_user

Its data is used to create relevant system and backend users for the retrieval of audit logs made available by the YubiHSM2.

Note

This variant implies, that the created authentication key object has all relevant capabilities for audit log retrieval (i.e. get-log-entries).

Fields

authentication_key_id: Id

The identifier of the authentication key used to create a session with the YubiHSM2.

system_user: SystemUserId

The name of the system user.

Signing

A system user, with SSH access, mapped to a YubiHSM2 user in the Operator role with access to a single signing key.

This variant tracks

• an authentication key object identified by an authentication_key_id
• a domain (domain) assigned to both objects identified by authentication_key_id and signing_key_id
• a SigningKeySetup using key_setup
• an asymmetric key object identified by a signing_key_id
• an SSH authorized key (ssh_authorized_key) for a system_user
• a system user ID (system_user)

Its data is used to create relevant system and backend users for the creation of backups of all keys (including authentication key objects) and non-key material (e.g. OpenPGP certificates) of a YubiHSM2.

Note

This variant implies, that the created authentication key object has all relevant capabilities for signing with the asymmetric key object (i.e. sign-ecdsa, sign-eddsa, sign-pkcs and sign-pss).

Further, it is assumed that both the authentication key object and asymmetric key object are added to the single domain domain.

Fields

authentication_key_id: Id

The identifier of the authentication key used to create a session with the YubiHSM2.

key_setup: SigningKeySetup

The setup of a YubiHSM2 key.

domain: Domain

The domain the signing and authentication key belong to.

signing_key_id: Id

The identifier of the signing key in the YubiHSM2 backend.

ssh_authorized_key: AuthorizedKeyEntry

The SSH public key used for connecting to the system_user.

system_user: SystemUserId

The name of the system user.

Implementations

impl YubiHsm2UserMapping

pub fn domain(&self) -> Option<&Domain>

Returns the optional Domain of the YubiHsm2UserMapping.

pub fn backend_user_id(&self) -> Id

Returns the authentication key ID of the YubiHsm2UserMapping.

Trait Implementations

impl Clone for YubiHsm2UserMapping

fn clone(&self) -> YubiHsm2UserMapping

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for YubiHsm2UserMapping

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for YubiHsm2UserMapping

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for YubiHsm2UserMapping

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl MappingAuthorizedKeyEntry for YubiHsm2UserMapping

fn authorized_key_entry(&self) -> Option<&AuthorizedKeyEntry>

Returns an optional SSH authorized_keys entry.

impl MappingBackendDomain<YubiHsm2DomainFilter> for YubiHsm2UserMapping

fn backend_domain( &self, _filter: Option<&YubiHsm2DomainFilter>, ) -> Option<String>

Returns a String representing a backend domain according to an optional filter.

impl MappingBackendKeyId<YubiHsm2BackendKeyIdFilter> for YubiHsm2UserMapping

fn backend_key_id(&self, filter: &YubiHsm2BackendKeyIdFilter) -> Option<String>

Returns an optional String representing a backend key ID according to a filter.

impl MappingBackendUserIds for YubiHsm2UserMapping

fn backend_user_ids(&self, filter: BackendUserIdFilter) -> Vec<String>

Returns a list of Strings representing backend User IDs according to a filter.

fn backend_user_with_passphrase( &self, name: &str, passphrase: Passphrase, ) -> Result<Box<dyn UserWithPassphrase>, Error>

Returns a specific UserWithPassphrase implementation for a backend user.

fn backend_users_with_new_passphrase( &self, filter: BackendUserIdFilter, ) -> Vec<Box<dyn UserWithPassphrase>>

Returns a list of UserWithPassphrase implementations according to a filter.

impl MappingBackendUserSecrets for YubiHsm2UserMapping

fn create_non_admin_backend_user_secrets( &self, secret_handling: NonAdministrativeSecretHandling, ) -> Result<Option<Vec<Box<dyn UserWithPassphrase>>>, Error>

Creates on-disk secrets for non-administrative backend users of the mapping.

fn load_non_admin_backend_user_secrets( &self, secret_handling: NonAdministrativeSecretHandling, filter: NonAdminBackendUserIdFilter, ) -> Result<Option<Vec<Box<dyn UserWithPassphrase>>>, Error>

Loads secrets from on-disk files for each non-administrative backend user matching a filter.

impl MappingSystemUserId for YubiHsm2UserMapping

fn system_user_id(&self) -> Option<&SystemUserId>

Returns a reference to the SystemUserId.

fn system_user_id_as_existing_unix_user(&self) -> Result<Option<User>, Error>

Returns the tracked system user ID as [User] if it exists.

fn system_user_id_as_current_unix_user(&self) -> Result<Option<User>, Error>

Returns the tracked system user ID as the current [User] if it exists.

impl Ord for YubiHsm2UserMapping

fn cmp(&self, other: &YubiHsm2UserMapping) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for YubiHsm2UserMapping

fn eq(&self, other: &YubiHsm2UserMapping) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for YubiHsm2UserMapping

fn partial_cmp(&self, other: &YubiHsm2UserMapping) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for YubiHsm2UserMapping

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for YubiHsm2UserMapping

impl StructuralPartialEq for YubiHsm2UserMapping