gitlab-sshd: Add support for signed user certificatessh-ssh-certificates

We add a `trusted_user_ca_keys` config setting that allows gitlab-sshd
to trust any SSH certificate signed by the keys listed in this file.
This is equivalent to the `TrustedUserCAKeys` OpenSSH setting.

We assume the certificate identity is equivalent to the GitLab
username.

1 files changed, 3 insertions, 0 deletions

diff --git a/internal/sshd/session.go b/internal/sshd/session.go
index 3394b2a..3d5fbad 100644
--- a/internal/sshd/session.go
+++ b/internal/sshd/session.go
@@ -28,6 +28,7 @@ type session struct {
 	channel             ssh.Channel
 	gitlabKeyId         string
 	gitlabKrb5Principal string
+	gitlabUsername      string
 	remoteAddr          string
 
 	// State managed by the session
@@ -173,6 +174,8 @@ func (s *session) handleShell(ctx context.Context, req *ssh.Request) (uint32, er
 
 	if s.gitlabKrb5Principal != "" {
 		cmd, err = shellCmd.NewWithKrb5Principal(s.gitlabKrb5Principal, env, s.cfg, rw)
+	} else if s.gitlabUsername != "" {
+		cmd, err = shellCmd.NewWithUsername(s.gitlabUsername, env, s.cfg, rw)
 	} else {
 		cmd, err = shellCmd.NewWithKey(s.gitlabKeyId, env, s.cfg, rw)
 	}