Skip to content

Commit f1aadbb

Browse files
hslatmanhslatman
authored
Merge pull request #1391 from smallstep/herman/policy-scep-prompt-fixes
Fix some provisioner and policy prompt issues
2 parents 2122975 + 1156e44 commit f1aadbb

File tree

16 files changed

+343
-113
lines changed

16 files changed

+343
-113
lines changed

‎command/ca/policy/actions/cn.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ $ step ca policy authority x509 deny cn "My Bad CA Name"
5656
commonNamesAction,
5757
),
5858
Flags: []cli.Flag{
59-
provisionerFilterFlag,
59+
flags.Provisioner,
6060
flags.EABKeyID,
6161
flags.EABReference,
6262
cli.BoolFlag{
@@ -76,9 +76,12 @@ $ step ca policy authority x509 deny cn "My Bad CA Name"
7676
}
7777

7878
func commonNamesAction(ctx context.Context) (err error) {
79-
clictx := command.CLIContextFromContext(ctx)
79+
var (
80+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
81+
clictx = command.CLIContextFromContext(ctx)
82+
args = clictx.Args()
83+
)
8084

81-
args := clictx.Args()
8285
if len(args) == 0 {
8386
return errs.TooFewArguments(clictx)
8487
}
@@ -88,7 +91,7 @@ func commonNamesAction(ctx context.Context) (err error) {
8891
return fmt.Errorf("error creating admin client: %w", err)
8992
}
9093

91-
policy, err := retrieveAndInitializePolicy(ctx, client)
94+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
9295
if err != nil {
9396
return fmt.Errorf("error retrieving policy: %w", err)
9497
}
@@ -113,7 +116,7 @@ func commonNamesAction(ctx context.Context) (err error) {
113116
panic("no SSH nor X.509 context set")
114117
}
115118

116-
updatedPolicy, err := updatePolicy(ctx, client, policy)
119+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
117120
if err != nil {
118121
return fmt.Errorf("error updating policy: %w", err)
119122
}

‎command/ca/policy/actions/dns.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ $ step ca policy authority ssh host allow dns "badsshhost.local"
7474
dnsAction,
7575
),
7676
Flags: []cli.Flag{
77-
provisionerFilterFlag,
77+
flags.Provisioner,
7878
flags.EABKeyID,
7979
flags.EABReference,
8080
cli.BoolFlag{
@@ -94,9 +94,12 @@ $ step ca policy authority ssh host allow dns "badsshhost.local"
9494
}
9595

9696
func dnsAction(ctx context.Context) (err error) {
97-
clictx := command.CLIContextFromContext(ctx)
97+
var (
98+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
99+
clictx = command.CLIContextFromContext(ctx)
100+
args = clictx.Args()
101+
)
98102

99-
args := clictx.Args()
100103
if len(args) == 0 {
101104
return errs.TooFewArguments(clictx)
102105
}
@@ -106,7 +109,7 @@ func dnsAction(ctx context.Context) (err error) {
106109
return fmt.Errorf("error creating admin client: %w", err)
107110
}
108111

109-
policy, err := retrieveAndInitializePolicy(ctx, client)
112+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
110113
if err != nil {
111114
return fmt.Errorf("error retrieving policy: %w", err)
112115
}
@@ -138,7 +141,7 @@ func dnsAction(ctx context.Context) (err error) {
138141
panic("no SSH nor X.509 context set")
139142
}
140143

141-
updatedPolicy, err := updatePolicy(ctx, client, policy)
144+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
142145
if err != nil {
143146
return fmt.Errorf("error updating policy: %w", err)
144147
}

‎command/ca/policy/actions/emails.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ $ step ca policy provisioner ssh user deny email @example.com --provisioner my_p
6363
emailAction,
6464
),
6565
Flags: []cli.Flag{
66-
provisionerFilterFlag,
66+
flags.Provisioner,
6767
cli.BoolFlag{
6868
Name: "remove",
6969
Usage: `removes the provided emails from the policy instead of adding them`,
@@ -81,9 +81,12 @@ $ step ca policy provisioner ssh user deny email @example.com --provisioner my_p
8181
}
8282

8383
func emailAction(ctx context.Context) (err error) {
84-
clictx := command.CLIContextFromContext(ctx)
84+
var (
85+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
86+
clictx = command.CLIContextFromContext(ctx)
87+
args = clictx.Args()
88+
)
8589

86-
args := clictx.Args()
8790
if len(args) == 0 {
8891
return errs.TooFewArguments(clictx)
8992
}
@@ -93,7 +96,7 @@ func emailAction(ctx context.Context) (err error) {
9396
return fmt.Errorf("error creating admin client: %w", err)
9497
}
9598

96-
policy, err := retrieveAndInitializePolicy(ctx, client)
99+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
97100
if err != nil {
98101
return err
99102
}
@@ -125,7 +128,7 @@ func emailAction(ctx context.Context) (err error) {
125128
panic("no SSH nor X.509 context set")
126129
}
127130

128-
updatedPolicy, err := updatePolicy(ctx, client, policy)
131+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
129132
if err != nil {
130133
return fmt.Errorf("error updating policy: %w", err)
131134
}

‎command/ca/policy/actions/ips.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ $ step ca policy authority ssh host deny ip 192.168.0.40
9494
ipAction,
9595
),
9696
Flags: []cli.Flag{
97-
provisionerFilterFlag,
97+
flags.Provisioner,
9898
flags.EABKeyID,
9999
flags.EABReference,
100100
cli.BoolFlag{
@@ -114,9 +114,12 @@ $ step ca policy authority ssh host deny ip 192.168.0.40
114114
}
115115

116116
func ipAction(ctx context.Context) (err error) {
117-
clictx := command.CLIContextFromContext(ctx)
117+
var (
118+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
119+
clictx = command.CLIContextFromContext(ctx)
120+
args = clictx.Args()
121+
)
118122

119-
args := clictx.Args()
120123
if len(args) == 0 {
121124
return errs.TooFewArguments(clictx)
122125
}
@@ -126,7 +129,7 @@ func ipAction(ctx context.Context) (err error) {
126129
return fmt.Errorf("error creating admin client: %w", err)
127130
}
128131

129-
policy, err := retrieveAndInitializePolicy(ctx, client)
132+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
130133
if err != nil {
131134
return err
132135
}
@@ -158,7 +161,7 @@ func ipAction(ctx context.Context) (err error) {
158161
panic("no SSH nor X.509 context set")
159162
}
160163

161-
updatedPolicy, err := updatePolicy(ctx, client, policy)
164+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
162165
if err != nil {
163166
return fmt.Errorf("error updating policy: %w", err)
164167
}

‎command/ca/policy/actions/policy.go‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"errors"
88
"fmt"
99

10-
"github.com/urfave/cli"
1110
"google.golang.org/protobuf/encoding/protojson"
1211

1312
"github.com/smallstep/certificates/ca"
@@ -18,22 +17,37 @@ import (
1817
"github.com/smallstep/cli/internal/command"
1918
)
2019

21-
var provisionerFilterFlag = cli.StringFlag{
22-
Name: "provisioner",
23-
Usage: `The provisioner <name>`,
20+
func retrieveAndUnsetProvisionerFlagIfRequired(ctx context.Context) string {
21+
// when managing policies on the authority level there's no need
22+
// to select a provisioner, so the flag does not need to be unset.
23+
if policycontext.IsAuthorityPolicyLevel(ctx) {
24+
return ""
25+
}
26+
27+
clictx := command.CLIContextFromContext(ctx)
28+
provisioner := clictx.String("provisioner")
29+
30+
// unset the provisioner and issuer flag values, so that they're not used
31+
// automatically in token flows.
32+
if err := clictx.Set("provisioner", ""); err != nil {
33+
panic(fmt.Errorf("failed unsetting provisioner flag: %w", err))
34+
}
35+
if err := clictx.Set("issuer", ""); err != nil {
36+
panic(fmt.Errorf("failed unsetting issuer flag: %w", err))
37+
}
38+
39+
return provisioner
2440
}
2541

26-
func retrieveAndInitializePolicy(ctx context.Context, client *ca.AdminClient) (*linkedca.Policy, error) {
42+
func retrieveAndInitializePolicy(ctx context.Context, client *ca.AdminClient, provisioner string) (*linkedca.Policy, error) {
2743
var (
28-
policy *linkedca.Policy
29-
err error
44+
clictx = command.CLIContextFromContext(ctx)
45+
reference = clictx.String("eab-key-reference")
46+
keyID = clictx.String("eab-key-id")
47+
policy *linkedca.Policy
48+
err error
3049
)
3150

32-
clictx := command.CLIContextFromContext(ctx)
33-
provisioner := clictx.String("provisioner")
34-
reference := clictx.String("eab-key-reference")
35-
keyID := clictx.String("eab-key-id")
36-
3751
switch {
3852
case policycontext.IsAuthorityPolicyLevel(ctx):
3953
policy, err = client.GetAuthorityPolicy()
@@ -147,13 +161,11 @@ func initPolicy(p *linkedca.Policy) *linkedca.Policy {
147161
return p
148162
}
149163

150-
func updatePolicy(ctx context.Context, client *ca.AdminClient, policy *linkedca.Policy) (*linkedca.Policy, error) {
151-
clictx := command.CLIContextFromContext(ctx)
152-
provisioner := clictx.String("provisioner")
153-
reference := clictx.String("eab-key-reference")
154-
keyID := clictx.String("eab-key-id")
155-
164+
func updatePolicy(ctx context.Context, client *ca.AdminClient, policy *linkedca.Policy, provisioner string) (*linkedca.Policy, error) {
156165
var (
166+
clictx = command.CLIContextFromContext(ctx)
167+
reference = clictx.String("eab-key-reference")
168+
keyID = clictx.String("eab-key-id")
157169
updatedPolicy *linkedca.Policy
158170
err error
159171
)

‎command/ca/policy/actions/principals.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ $ step ca policy provisioner ssh host deny principal root --provisioner my_ssh_u
5858
principalAction,
5959
),
6060
Flags: []cli.Flag{
61-
provisionerFilterFlag,
61+
flags.Provisioner,
6262
cli.BoolFlag{
6363
Name: "remove",
6464
Usage: `removes the provided Principals from the policy instead of adding them`,
@@ -76,9 +76,12 @@ $ step ca policy provisioner ssh host deny principal root --provisioner my_ssh_u
7676
}
7777

7878
func principalAction(ctx context.Context) (err error) {
79-
clictx := command.CLIContextFromContext(ctx)
79+
var (
80+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
81+
clictx = command.CLIContextFromContext(ctx)
82+
args = clictx.Args()
83+
)
8084

81-
args := clictx.Args()
8285
if len(args) == 0 {
8386
return errs.TooFewArguments(clictx)
8487
}
@@ -88,7 +91,7 @@ func principalAction(ctx context.Context) (err error) {
8891
return fmt.Errorf("error creating admin client: %w", err)
8992
}
9093

91-
policy, err := retrieveAndInitializePolicy(ctx, client)
94+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
9295
if err != nil {
9396
return err
9497
}
@@ -120,7 +123,7 @@ func principalAction(ctx context.Context) (err error) {
120123
panic("no SSH nor X.509 context set")
121124
}
122125

123-
updatedPolicy, err := updatePolicy(ctx, client, policy)
126+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
124127
if err != nil {
125128
return fmt.Errorf("error updating policy: %w", err)
126129
}

‎command/ca/policy/actions/remove.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ $ step ca policy acme remove --provisioner my_acme_provisioner --eab-key-id "lUO
5555
removeAction,
5656
),
5757
Flags: []cli.Flag{
58-
provisionerFilterFlag,
58+
flags.Provisioner,
5959
flags.EABKeyID,
6060
flags.EABReference,
6161
flags.AdminCert,
@@ -71,10 +71,12 @@ $ step ca policy acme remove --provisioner my_acme_provisioner --eab-key-id "lUO
7171
}
7272

7373
func removeAction(ctx context.Context) (err error) {
74-
clictx := command.CLIContextFromContext(ctx)
75-
provisioner := clictx.String("provisioner")
76-
reference := clictx.String("eab-key-reference")
77-
keyID := clictx.String("eab-key-id")
74+
var (
75+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
76+
clictx = command.CLIContextFromContext(ctx)
77+
reference = clictx.String("eab-key-reference")
78+
keyID = clictx.String("eab-key-id")
79+
)
7880

7981
client, err := cautils.NewAdminClient(clictx)
8082
if err != nil {

‎command/ca/policy/actions/uris.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ $ step ca policy provisioner x509 allow uri "*.example.com" --provisioner my_pro
5353
uriAction,
5454
),
5555
Flags: []cli.Flag{
56-
provisionerFilterFlag,
56+
flags.Provisioner,
5757
cli.BoolFlag{
5858
Name: "remove",
5959
Usage: `removes the provided URIs from the policy instead of adding them`,
@@ -71,9 +71,12 @@ $ step ca policy provisioner x509 allow uri "*.example.com" --provisioner my_pro
7171
}
7272

7373
func uriAction(ctx context.Context) (err error) {
74-
clictx := command.CLIContextFromContext(ctx)
74+
var (
75+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
76+
clictx = command.CLIContextFromContext(ctx)
77+
args = clictx.Args()
78+
)
7579

76-
args := clictx.Args()
7780
if len(args) == 0 {
7881
return errs.TooFewArguments(clictx)
7982
}
@@ -83,7 +86,7 @@ func uriAction(ctx context.Context) (err error) {
8386
return fmt.Errorf("error creating admin client: %w", err)
8487
}
8588

86-
policy, err := retrieveAndInitializePolicy(ctx, client)
89+
policy, err := retrieveAndInitializePolicy(ctx, client, provisioner)
8790
if err != nil {
8891
return fmt.Errorf("error retrieving policy: %w", err)
8992
}
@@ -108,7 +111,7 @@ func uriAction(ctx context.Context) (err error) {
108111
panic("no SSH nor X.509 context set")
109112
}
110113

111-
updatedPolicy, err := updatePolicy(ctx, client, policy)
114+
updatedPolicy, err := updatePolicy(ctx, client, policy, provisioner)
112115
if err != nil {
113116
return fmt.Errorf("error updating policy: %w", err)
114117
}

‎command/ca/policy/actions/view.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ $ step ca policy acme view --provisioner my_acme_provisioner --eab-key-id "lUOTG
5656
viewAction,
5757
),
5858
Flags: []cli.Flag{
59-
provisionerFilterFlag,
59+
flags.Provisioner,
6060
flags.EABKeyID,
6161
flags.EABReference,
6262
flags.AdminCert,
@@ -72,20 +72,19 @@ $ step ca policy acme view --provisioner my_acme_provisioner --eab-key-id "lUOTG
7272
}
7373

7474
func viewAction(ctx context.Context) (err error) {
75-
clictx := command.CLIContextFromContext(ctx)
76-
provisioner := clictx.String("provisioner")
77-
reference := clictx.String("eab-key-reference")
78-
keyID := clictx.String("eab-key-id")
75+
var (
76+
provisioner = retrieveAndUnsetProvisionerFlagIfRequired(ctx)
77+
clictx = command.CLIContextFromContext(ctx)
78+
reference = clictx.String("eab-key-reference")
79+
keyID = clictx.String("eab-key-id")
80+
policy *linkedca.Policy
81+
)
7982

8083
client, err := cautils.NewAdminClient(clictx)
8184
if err != nil {
8285
return fmt.Errorf("error creating admin client: %w", err)
8386
}
8487

85-
var (
86-
policy *linkedca.Policy
87-
)
88-
8988
switch {
9089
case policycontext.IsAuthorityPolicyLevel(ctx):
9190
policy, err = client.GetAuthorityPolicy()

0 commit comments

Comments
 (0)