Repository navigation
Conversation
An authentication or authorization webhook can now supply an optional user-facing message along with a negative decision (HTTP 200 with success=false and a non-empty message field). The message is preserved through the webhook client and the auth integration layer as a terminal failure and delivered to the connecting SSH client as an SSH_MSG_USERAUTH_BANNER (RFC 4252, section 5.4) immediately before the authentication failure, via the ssh.BannerError mechanism of the pinned golang.org/x/crypto version. Safety rules: - Only webhook-supplied messages ever become banners. Internal, infrastructure, and unavailable errors never do. - A message on a successful response is not a denial and never becomes a banner. - Message-less denials behave exactly as before: no error, no banner. - Message-bearing denials are terminal: no retries, no backend session initialized, and non-200/transport failures keep their fail-closed retry/timeout behavior. Verified with real SSH client connections, including the OpenSSH client in noninteractive use, and covered by regression tests at the webhook client and auth integration seams. Part of #1, closes #3. Signed-off-by: Matt, Matthias <matthias.matt@tuwien.ac.at>
Bring in upstream's pgsty/minio test-image fix and dependency updates so S3 integration tests no longer pull the removed minio/minio image.
Extends the regression coverage of the readable-denial message transport to the authorization path, closing the motivating scenario end-to-end: successful public-key authentication followed by an authorization denial with an explicit message (e.g. "unknown pod template 'unknown' — use a configured template username") makes the SSH client see exactly that text as a user authentication banner (RFC 4252, section 5.4) immediately before the connection fails. The message transport introduced for the tracer bullet already routes the authorization webhook response through the post-authentication policy check that runs during authentication; this change locks that behavior in with controlled webhook fixtures at the established seams: - End-to-end at the auth integration seam, the authorization denial with a message is observed as the exact pre-failure banner by a real SSH client, completes within five seconds (it never enters config-webhook retry handling), and never initializes a backend session. Message-less authorization denials keep the previous behavior: plain failure, no banner. - End-to-end with the actual OpenSSH client in noninteractive use, exercising the representative unknown-template denial string, with the OpenSSH test setup factored into shared helpers. - At the webhook client seam, message-less authorization denials stay plain failures and a message on a successful authorization response is not a denial, mirroring the public-key path coverage. Part of #1, closes #4. Signed-off-by: Matt, Matthias <matthias.matt@tuwien.ac.at>
Bring in PR #11 (Settings SSH policy and gateway resize crash fixes) so the error-messages branch stays current with deploy: session signals now honor the dedicated signal policy, session channel handlers start only once, and the kubernetes resize shutdown and PID/rollback regressions are covered. No interaction with the authorization-denial banner work. Signed-off-by: Matt, Matthias <matthias.matt@tuwien.ac.at>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.