@@ -132,11 +132,13 @@ func ValidateToken(token *jwt.Token) (interface{}, error) {
132132 return cert .PublicKey , nil
133133}
134134
135- func EnrollUpdb (enFlags EnrollmentFlags ) error {
135+ func EnrollUpdb (enFlags EnrollmentFlags ) ( string , error ) {
136136 caPool , allowedCerts := enFlags .GetCertPool ()
137137 ztApiRoot := enFlags .Token .Issuer
138138
139- if err := enrollUpdb (enFlags .Username , enFlags .Password , enFlags .Token , caPool ); err != nil {
139+ resultUsername := ""
140+ var err error
141+ if resultUsername , err = enrollUpdb (enFlags .Username , enFlags .Password , enFlags .Token , caPool ); err != nil {
140142 pfxlog .Logger ().Debug ("fetching certificates from server" )
141143 rootCaPool := x509 .NewCertPool ()
142144 rootCaPool .AddCert (enFlags .Token .SignatureCert )
@@ -146,14 +148,14 @@ func EnrollUpdb(enFlags EnrollmentFlags) error {
146148 caPool .AddCert (xcert )
147149 }
148150
149- if err : =enrollUpdb (enFlags .Username , enFlags .Password , enFlags .Token , caPool ); err != nil {
150- return fmt .Errorf ("unable to enroll after fetching server certs: %v" , err )
151+ if resultUsername , err = enrollUpdb (enFlags .Username , enFlags .Password , enFlags .Token , caPool ); err != nil {
152+ return "" , fmt .Errorf ("unable to enroll after fetching server certs: %v" , err )
151153 } else {
152- return nil
154+ return resultUsername , nil
153155 }
154156 }
155157
156- return nil
158+ return resultUsername , nil
157159}
158160
159161func Enroll (enFlags EnrollmentFlags ) (* ziti.Config , error ) {
@@ -164,47 +166,49 @@ func Enroll(enFlags EnrollmentFlags) (*ziti.Config, error) {
164166 ZtAPI : edge_apis .ClientUrl (enFlags .Token .Issuer ),
165167 }
166168
167- if strings .TrimSpace (enFlags .KeyFile ) != "" {
168- stat , err := os .Stat (enFlags .KeyFile )
169+ if enFlags .Token .EnrollmentMethod != "updb" {
170+ if strings .TrimSpace (enFlags .KeyFile ) != "" {
171+ stat , err := os .Stat (enFlags .KeyFile )
169172
170- if stat != nil && ! os .IsNotExist (err ) {
171- if stat .IsDir () {
172- return nil , errors .Errorf ("specified key is a directory (%s)" , enFlags .KeyFile )
173- }
173+ if stat != nil && ! os .IsNotExist (err ) {
174+ if stat .IsDir () {
175+ return nil , errors .Errorf ("specified key is a directory (%s)" , enFlags .KeyFile )
176+ }
177+
178+ if absPath , fileErr := filepath .Abs (enFlags .KeyFile ); fileErr != nil {
179+ return nil , fileErr
180+ } else {
181+ cfg .ID .Key = "file://" + absPath
182+ }
174183
175- if absPath , fileErr := filepath .Abs (enFlags .KeyFile ); fileErr != nil {
176- return nil , fileErr
177184 } else {
178- cfg .ID .Key = "file://" + absPath
185+ cfg .ID .Key = enFlags .KeyFile
186+ pfxlog .Logger ().Infof ("using engine : %s\n " , strings .Split (enFlags .KeyFile , ":" )[0 ])
179187 }
180-
181188 } else {
182- cfg .ID .Key = enFlags .KeyFile
183- pfxlog .Logger ().Infof ("using engine : %s\n " , strings .Split (enFlags .KeyFile , ":" )[0 ])
184- }
185- } else {
186- var asnBytes []byte
187- var keyPem []byte
188- if enFlags .KeyAlg .EC () {
189- key , err = generateECKey ()
190- asnBytes , _ := x509 .MarshalECPrivateKey (key .(* ecdsa.PrivateKey ))
191- keyPem = pem .EncodeToMemory (& pem.Block {Type : "EC PRIVATE KEY" , Bytes : asnBytes })
192- } else if enFlags .KeyAlg .RSA () {
193- key , err = generateRSAKey ()
194- asnBytes = x509 .MarshalPKCS1PrivateKey (key .(* rsa.PrivateKey ))
195- keyPem = pem .EncodeToMemory (& pem.Block {Type : "RSA PRIVATE KEY" , Bytes : asnBytes })
196- } else {
197- panic (fmt .Sprintf ("invalid KeyAlg specified: %s" , enFlags .KeyAlg .Get ()))
198- }
199- cfg .ID .Key = "pem:" + string (keyPem )
200- if err != nil {
201- return nil , err
189+ var asnBytes []byte
190+ var keyPem []byte
191+ if enFlags .KeyAlg .EC () {
192+ key , err = generateECKey ()
193+ asnBytes , _ := x509 .MarshalECPrivateKey (key .(* ecdsa.PrivateKey ))
194+ keyPem = pem .EncodeToMemory (& pem.Block {Type : "EC PRIVATE KEY" , Bytes : asnBytes })
195+ } else if enFlags .KeyAlg .RSA () {
196+ key , err = generateRSAKey ()
197+ asnBytes = x509 .MarshalPKCS1PrivateKey (key .(* rsa.PrivateKey ))
198+ keyPem = pem .EncodeToMemory (& pem.Block {Type : "RSA PRIVATE KEY" , Bytes : asnBytes })
199+ } else {
200+ panic (fmt .Sprintf ("invalid KeyAlg specified: %s" , enFlags .KeyAlg .Get ()))
201+ }
202+ cfg .ID .Key = "pem:" + string (keyPem )
203+ if err != nil {
204+ return nil , err
205+ }
202206 }
203- }
204207
205- if enFlags .CertFile != "" {
206- enFlags .CertFile , _ = filepath .Abs (enFlags .CertFile )
207- cfg .ID .Cert = "file://" + enFlags .CertFile
208+ if enFlags .CertFile != "" {
209+ enFlags .CertFile , _ = filepath .Abs (enFlags .CertFile )
210+ cfg .ID .Cert = "file://" + enFlags .CertFile
211+ }
208212 }
209213
210214 caPool , allowedCerts := enFlags .GetCertPool ()
@@ -225,6 +229,8 @@ func Enroll(enFlags EnrollmentFlags) (*ziti.Config, error) {
225229 caPool .AddCert (cert )
226230 }
227231
232+ resultUsername := ""
233+
228234 var enrollErr error
229235 switch enFlags .Token .EnrollmentMethod {
230236 case "ott" :
@@ -233,6 +239,8 @@ func Enroll(enFlags EnrollmentFlags) (*ziti.Config, error) {
233239 enrollErr = enrollCA (enFlags .Token , cfg , caPool )
234240 case "ca" :
235241 enrollErr = enrollCAAuto (enFlags , cfg , caPool )
242+ case "updb" :
243+ resultUsername , enrollErr = enrollUpdb (enFlags .Username , enFlags .Password , enFlags .Token , caPool )
236244 default :
237245 enrollErr = errors .Errorf ("enrollment method '%s' is not supported" , enFlags .Token .EnrollmentMethod )
238246 }
@@ -253,7 +261,17 @@ func Enroll(enFlags EnrollmentFlags) (*ziti.Config, error) {
253261 cfg .ID .CA = "pem:" + buf .String ()
254262 }
255263
256- cfg .Credentials = edge_apis .NewIdentityCredentialsFromConfig (cfg .ID )
264+ if enFlags .Token .EnrollmentMethod == "updb" {
265+ cfg .Credentials = & edge_apis.UpdbCredentials {
266+ BaseCredentials : edge_apis.BaseCredentials {
267+ CaPool : caPool ,
268+ },
269+ Username : resultUsername ,
270+ Password : enFlags .Password ,
271+ }
272+ } else {
273+ cfg .Credentials = edge_apis .NewIdentityCredentialsFromConfig (cfg .ID )
274+ }
257275
258276 return cfg , nil
259277}
@@ -281,7 +299,7 @@ func useSystemCasIfEmpty(caPool *x509.CertPool) *x509.CertPool {
281299 }
282300}
283301
284- func enrollUpdb (username , password string , token * ziti.EnrollmentClaims , caPool * x509.CertPool ) error {
302+ func enrollUpdb (username , password string , token * ziti.EnrollmentClaims , caPool * x509.CertPool ) ( string , error ) {
285303 caPool = useSystemCasIfEmpty (caPool )
286304 client := http.Client {
287305 Transport : & http.Transport {
@@ -301,21 +319,25 @@ func enrollUpdb(username, password string, token *ziti.EnrollmentClaims, caPool
301319
302320 resp , err := client .Post (token .EnrolmentUrl (), "application/json" , bytes .NewBuffer (body .EncodeJSON ()))
303321 if err != nil {
304- return err
322+ return "" , err
305323 }
306324
307325 if resp .StatusCode == http .StatusOK {
308- return nil
326+ respBody , _ := io .ReadAll (resp .Body )
327+ if respContainer , err := gabs .ParseJSON (respBody ); err == nil {
328+ username = respContainer .Path ("data.username" ).Data ().(string )
329+ }
330+ return username , nil
309331 }
310332
311333 respBody , _ := io .ReadAll (resp .Body )
312334
313335 if respContainer , err := gabs .ParseJSON (respBody ); err == nil {
314336 code := respContainer .Path ("error.code" ).Data ().(string )
315337 message := respContainer .Path ("error.message" ).Data ().(string )
316- return errors .Errorf ("enroll error: %s: %s: %s" , resp .Status , code , message )
338+ return "" , errors .Errorf ("enroll error: %s: %s: %s" , resp .Status , code , message )
317339 } else {
318- return errors .Errorf ("enroll error: %s: %s" , resp .Status , body )
340+ return "" , errors .Errorf ("enroll error: %s: %s" , resp .Status , body )
319341 }
320342}
321343
0 commit comments