From 6c3b1ef2fede1e3c2b6e89060d3d645c2ba744cd Mon Sep 17 00:00:00 2001
From: Takeru Hayasaka <hayatake396@gmail.com>
Date: Sat, 28 Dec 2024 19:58:02 +0000
Subject: ssh: T6013: support SSH AuthorizedPrincipalsFile in use with
 trusted-user-ca-key

Thisc omplements commit e7cab89f9f81 ("T6013: Add support for configuring
TrustedUserCAKeys in SSH service with local and remote CA keys"). It introduces
a new CLI node per user to support defining the authorized principals used by
any given PKI certificate. It is now possible to associate SSH login users with
their respective principals.

Authored-by: Takeru Hayasaka <hayatake396@gmail.com>
---
 interface-definitions/service_ssh.xml.in | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in
index 14d358c78..2ab9db48b 100644
--- a/interface-definitions/service_ssh.xml.in
+++ b/interface-definitions/service_ssh.xml.in
@@ -281,6 +281,25 @@
             </properties>
             <children>
               #include <include/pki/ca-certificate.xml.i>
+              <tagNode name="bind-user">
+                <properties>
+                  <help>user-name</help>
+                  <constraint>
+                    #include <include/constraint/login-username.xml.i>
+                  </constraint>
+                </properties>
+                <children>
+                  <leafNode name="principal">
+                    <properties>
+                      <help>principal-name</help>
+                      <constraint>
+                        #include <include/constraint/login-username.xml.i>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </tagNode>
             </children>
           </node>
           #include <include/vrf-multi.xml.i>
-- 
cgit v1.2.3