This PR adds API access via a local Unix socket on Unix systems allowing to
use the username of local user accessing the API as the authentication
username.
Configuration options are provided to map user names to roles similar to the
configfile authentication provider.
This will allow using Krill without authentication tokens if it is only
accessed via krillc on the same machine.
The PR also removes the example configuration files and moves the
documentation included in those files into a krill.conf.5 manual page. By
doing this, it simplifies the creation of the configuation file in the binary
packages. Those are now very minimal and only contain the mandatory config
options.
This PR refactors and reorganizes a lot of code. It attempts to organize
things in a way that allows to keep more things private. Conversely, it
made the fields of many data-only structs pub and removed the creator,
accessor, and unpack methods for those.
The PR deliberately avoid any functional code changes given that due to
its sheer size, it is essentially unreviewable.
This is also why it stopped short of re-organizing the structure of the
actual server, ie., the Krillserver and the daemon::http module which
currently have a rather blurry distinction. A follow-up PR will create a
more clear separation but this requires code changes.
This PR changes how the clients -- krillc, krillta, as well as the
integration tests -- work to better fit the derive model provided by clap.
This results in basically everything in the cli module and all the
integration tests being different now.
The PR slightly changes the options for both krillc and krillta. For krillc,
the --server, --token, --format, and --api options are now before the first
subcommand (since they affect all commands). For krillta, those options are
now after krillta proxy but before the next subcommand, while --format is
now after krillta signer.
This PR also removes client support and integration tests for RTA.
This is a breaking change.
* Use types which were ported into rpki-rs.
* Update dependency to rpki-rs 0.14.3-dev.
* IGNORE old_events test for now, see issue: #819
* Quick fix for compilation using --all-features. See issue #821
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Adds support for PKCS#11 v2.20 and/or KMIP 1.2 compatible HSMs.
Includes backward compatible extensions to the krill.conf syntax.
Includes HSM related developer docs.
Excludes HSM specific API (REST, krillc, Prometheus) or UI extensions.
* Let users configure the AIA to use with TA certificates. Set 'ta_aia' in the config file. (#409)
* Use explicit configuration section for testbed, no longer rely on magic env variables.
Note: this will all be revised again if/when the Publication server and TA vs CA code is fully separated in future.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Add a test that should (but doesn't in non-multi-user mode) panic because it tries to create a CA using the wrong master token.
* cargo fmt
* Add some comments explaining what the test does and how it works.
* FIX: Don't permit anonymous users to perform restricted actions in non-multi-user mode (this regression was introduced in the v0.8.1-bis branch, it was never released).
