func (s *Server) checkPermissionToLogin(cert ssh.PublicKey, teleportUser, osUser string) error {
	// enumerate all known CAs and see if any of them signed the
	// supplied certificate
	cas, err := s.authService.GetCertAuthorities(services.UserCA, false)
	if err != nil {
		return trace.Wrap(err)
	}
	var ca *services.CertAuthority
	for i := range cas {
		checkers, err := cas[i].Checkers()
		if err != nil {
			return trace.Wrap(err)
		}
		for _, checker := range checkers {
			if sshutils.KeysEqual(cert, checker) {
				ca = cas[i]
				break
			}
		}
	}
	// the certificate was signed by unknown authority
	if ca == nil {
		return trace.AccessDenied("the certificate for user '%v' is signed by untrusted CA",
			teleportUser)
	}

	domainName, err := s.authService.GetDomainName()
	if err != nil {
		return trace.Wrap(err)
	}

	// for local users, go and check their individual permissions
	if domainName == ca.DomainName {
		users, err := s.authService.GetUsers()
		if err != nil {
			return trace.Wrap(err)
		}
		for _, u := range users {
			if u.GetName() == teleportUser {
				for _, login := range u.GetAllowedLogins() {
					if login == osUser {
						return nil
					}
				}
			}
		}
		return trace.AccessDenied("user %v is not authorized to login as %v",
			teleportUser, osUser)
	}

	// for other authorities, check for authoritiy permissions
	for _, login := range ca.AllowedLogins {
		if login == osUser || login == "*" {
			return nil
		}
	}
	return trace.AccessDenied("user %s@%s is not authorized to login as %v@%s",
		teleportUser, ca.DomainName, osUser, domainName)
}
// checkPermissionToLogin checks the given certificate (supplied by a connected client)
// to see if this certificate can be allowed to login as user:login pair
checkPermissionToLogin checks the given certificate (supplied by a connected client)
to see if this certificate can be allowed to login as user:login pair
// checkPermissionToLogin checks the given certificate ( supplied by a connected client ) // to see if this certificate can be allowed to login as user : login pair
func (s *Server) checkPermissionToLogin(cert ssh.PublicKey, teleportUser, osUser string) error {
	cas, err := s.authService.GetCertAuthorities(services.UserCA, false)
	if err != nil {
		return trace.Wrap(err)
	}
	var ca *services.CertAuthority
	for i := range cas {
		checkers, err := cas[i].Checkers()
		if err != nil {
			return trace.Wrap(err)
		}
		for _, checker := range checkers {
			if sshutils.KeysEqual(cert, checker) {
				ca = cas[i]
				break
			}
		}
	}
	if ca == nil {
		return trace.AccessDenied("the certificate for user '%v' is signed by untrusted CA",
			teleportUser)
	}
	domainName, err := s.authService.GetDomainName()
	if err != nil {
		return trace.Wrap(err)
	}
	if domainName == ca.DomainName {
		users, err := s.authService.GetUsers()
		if err != nil {
			return trace.Wrap(err)
		}
		for _, u := range users {
			if u.GetName() == teleportUser {
				for _, login := range u.GetAllowedLogins() {
					if login == osUser {
						return nil
					}
				}
			}
		}
		return trace.AccessDenied("user %v is not authorized to login as %v",
			teleportUser, osUser)
	}
	for _, login := range ca.AllowedLogins {
		if login == osUser || login == "*" {
			return nil
		}
	}
	return trace.AccessDenied("user %s@%s is not authorized to login as %v@%s",
		teleportUser, ca.DomainName, osUser, domainName)
}
func ( s * Server ) checkPermissionToLogin ( cert ssh . PublicKey , teleportUser , osUser string ) error { cas , err := s . authService . GetCertAuthorities ( services . UserCA , false ) if err != nil { return trace . Wrap ( err ) } var ca * services . CertAuthority for i := range cas { checkers , err := cas [ i ] . Checkers ( ) if err != nil { return trace . Wrap ( err ) } for _ , checker := range checkers { if sshutils . KeysEqual ( cert , checker ) { ca = cas [ i ] break } } } if ca == nil { return trace . AccessDenied ( " " , teleportUser ) } domainName , err := s . authService . GetDomainName ( ) if err != nil { return trace . Wrap ( err ) } if domainName == ca . DomainName { users , err := s . authService . GetUsers ( ) if err != nil { return trace . Wrap ( err ) } for _ , u := range users { if u . GetName ( ) == teleportUser { for _ , login := range u . GetAllowedLogins ( ) { if login == osUser { return nil } } } } return trace . AccessDenied ( " " , teleportUser , osUser ) } for _ , login := range ca . AllowedLogins { if login == osUser || login == " " { return nil } } return trace . AccessDenied ( " " , teleportUser , ca . DomainName , osUser , domainName ) }
checkPermissionToLogin checks the given certificate (supplied by a connected client)
to see if this certificate can be allowed to login as user:login pair
checkPermissionToLogin checks the given certificate ( supplied by a connected client ) to see if this certificate can be allowed to login as user : login pair
// enumerate all known CAs and see if any of them signed the // supplied certificate // the certificate was signed by unknown authority // for local users, go and check their individual permissions // for other authorities, check for authoritiy permissions