Merge pull request #11 from isometry/feature/default-user-to-role

feat: default Vault role to ssh username

Author: isometry

main.go

@@ -70,15 +70,20 @@ func processCommand() int {
 		log.Fatal(err)
 	}
 
-	userOverridden := overrideUser(&vaultClient, &sshClient)
-	if userOverridden {
-		log.Info("remote user overridden by vault role")
-	}
-
 	if err := sshClient.ParseConfig(); err != nil {
 		log.Fatal("failed to parse ssh configuration: ", err)
 	}
 
+	roleDefaulted := defaultRoleToUser(&vaultClient, &sshClient)
+	if roleDefaulted {
+		log.Infof("defaulted vault role to ssh username: %s", sshClient.User)
+	}
+
+	userOverridden := overrideUser(&vaultClient, &sshClient)
+	if userOverridden {
+		log.Infof("ssh username overridden by vault role: %s", sshClient.User)
+	}
+
 	// if we have already have a Control Connection, use it
 	controlConnection := sshClient.ControlConnection()
 
@@ -136,14 +141,22 @@ func setupExitHandler(fn string) {
 	}()
 }
 
+func defaultRoleToUser(vaultClient *signer.Client, sshClient *openssh.Client) bool {
+	// if role hasn't been set already, default to resolved SSH username
+	if vaultClient.Options.Role == "" {
+		vaultClient.Options.Role = sshClient.User
+		return true
+	}
+	return false
+}
+
 func overrideUser(vaultClient *signer.Client, sshClient *openssh.Client) bool {
 	// if the role only allows a single, fixed user, use it
-	if user := vaultClient.GetAllowedUser(); user != "" {
+	if user := vaultClient.GetAllowedUser(); user != "" && sshClient.User != user {
 		sshClient.User = user
 		sshClient.PrependArgs([]string{"-l", user})
 		return true
 	}
-
 	return false
 }
 

signer/vault.go

@@ -25,7 +25,7 @@ type Client struct {
 // Options define signer-specific flags
 type Options struct {
 	Path       string     `long:"path" default:"ssh" env:"VAULT_SSH_PATH" description:"Vault SSH Path"`
-	Role       string     `long:"role" default:"default" env:"VAULT_SSH_ROLE" description:"Vault SSH Role"`
+	Role       string     `long:"role" env:"VAULT_SSH_ROLE" description:"Vault SSH Role (default: <ssh-username>)"`
 	TTL        uint       `long:"ttl" default:"300" env:"VAULT_SSH_TTL" description:"Vault SSH Certificate TTL"`
 	PublicKey  string     `short:"P" long:"public-key" default:"~/.ssh/id_rsa.pub" env:"VAULT_SSH_PUBLIC_KEY" description:"OpenSSH Public RSA Key to sign"`
 	Extensions Extensions `group:"Certificate Extensions"`