fix: only force IdentityAgent when required

Author: isometry

main.go

@@ -111,7 +111,9 @@ func processCommand() int {
 			// override default ssh-agent socket
 			os.Setenv("SSH_AUTH_SOCK", agent.SocketFile())
 			log.Debugf("set SSH_AUTH_SOCK to %q\n", agent.SocketFile())
-			sshClient.PrependArgs([]string{"-o", "IdentityAgent=SSH_AUTH_SOCK"})
+			if sshClient.ForceIdentityAgent {
+				sshClient.PrependArgs([]string{"-o", "IdentityAgent=SSH_AUTH_SOCK"})
+			}
 
 		case "sign":
 			signedKey, err := vaultClient.SignKey(sshClient.User)

openssh/openssh.go

@@ -15,14 +15,15 @@ import (
 )
 
 type Client struct {
-	Args              []string
-	HostConfig        []string
-	User              string
-	Hostname          string
-	Extensions        Extensions
-	CertificateString string
-	CertificateFile   string
-	CertificateObject *ssh.Certificate
+	Args               []string
+	HostConfig         []string
+	User               string
+	Hostname           string
+	Extensions         Extensions
+	CertificateString  string
+	CertificateFile    string
+	CertificateObject  *ssh.Certificate
+	ForceIdentityAgent bool
 }
 
 // Options for https://man.openbsd.org/ssh.1; parsed simply to provide accurate Destination and RemoteCommand
@@ -127,6 +128,8 @@ func (c *Client) ParseConfig() error {
 			if value == "yes" {
 				c.Extensions.X11Forwarding = true
 			}
+		case "identityagent":
+			c.ForceIdentityAgent = true
 		case "localforward":
 			c.Extensions.PortForwarding = true
 		case "remoteforward":