Depending on whether the test is executed in CI/VSCode vs. running
them locally with `make test`, the resulting error message was
different for the `multiple-select-ui` and `ignore-provisioner-flag`
test cases. For now we just test for an error, but it would be
nice to refactor a bit and trigger specific error cases in the
future.
Long ago the "issuer" flag was used to denote what we not call
provisioners. There were still some uses of `issuer` in the code,
which have now been renamed to reflect their current usage. Only
when the actual token is going to be signed, will it be called
an `issuer` again.
This PR fixes the following issues:
- SCEP provisioners not detected in admin token flows
- Invalid provisioner selection logic when managing provisioner policies
- Unexpected error messages showing "issuer" instead or "provisioner" flag
- min-encryption-password-length
- provisioner
Enforce min-encryption-password-length, if set, in the 'step ssh
certificate' command.
Add flags.FirstStringOf returns value of first defined flag in input list
Add the `--set` and `--set-file` flags to the `step ca token` command,
allowing the user to set keys in the "user" claim in the resulting JWT.
Signed-off-by: Dan Fuhry <dan@fuhry.com>
This commit allows passing confirmation claims to tokens to tie the
tokens with a provided CSR or SSH public key.
The confirmation claim is implemented in the token command as well as
the com commands that uses a given CSR or ssh public key. Those are:
- step ca token
- step ca sign
- step ssh certificate --sign
Fixessmallstep/certificates#1637
This commit changes the error printed by step if running step oauth
fails. This avoids printing the client secret in the command line, even
that is "public" knowledge.
This commit properly detects the algorithm used for JWT signing when using ECDSA
keys. The previous version always picked ES256, even if P-384 or P-521 were
used.
Additionally, make the logic for selecting which TPM EK to use
deterministic by always selecting the first RSA EK returned by
the TPM, falling back to the first EC EK if it exists.
