func (a *AuthCommand) ExportAuthorities(client *auth.TunClient) error {
	var typesToExport []services.CertAuthType

	// if no --type flag is given, export all types
	if a.authType == "" {
		typesToExport = []services.CertAuthType{services.HostCA, services.UserCA}
	} else {
		authType := services.CertAuthType(a.authType)
		if err := authType.Check(); err != nil {
			return trace.Wrap(err)
		}
		typesToExport = []services.CertAuthType{authType}
	}
	localAuthName, err := client.GetDomainName()
	if err != nil {
		return trace.Wrap(err)
	}

	// fetch authorities via auth API (and only take local CAs, ignoring
	// trusted ones)
	var authorities []*services.CertAuthority
	for _, at := range typesToExport {
		cas, err := client.GetCertAuthorities(at, a.exportPrivateKeys)
		if err != nil {
			return trace.Wrap(err)
		}
		for _, ca := range cas {
			if ca.DomainName == localAuthName {
				authorities = append(authorities, ca)
			}
		}
	}

	// print:
	for _, ca := range authorities {
		if a.exportPrivateKeys {
			for _, key := range ca.SigningKeys {
				fingerprint, err := sshutils.PrivateKeyFingerprint(key)
				if err != nil {
					return trace.Wrap(err)
				}
				if a.exportAuthorityFingerprint != "" && fingerprint != a.exportAuthorityFingerprint {
					continue
				}
				os.Stdout.Write(key)
				fmt.Fprintf(os.Stdout, "\n")
			}
		} else {
			for _, keyBytes := range ca.CheckingKeys {
				fingerprint, err := sshutils.AuthorizedKeyFingerprint(keyBytes)
				if err != nil {
					return trace.Wrap(err)
				}
				if a.exportAuthorityFingerprint != "" && fingerprint != a.exportAuthorityFingerprint {
					continue
				}
				options := url.Values{
					"type": []string{string(ca.Type)},
				}
				if len(ca.AllowedLogins) > 0 {
					options["logins"] = ca.AllowedLogins
				}
				// Every auth public key is exported as a single line adhering to man sshd (8)
				// authorized_hosts format, a space-separated list of: makrer, hosts, key, and comment
				// example:
				// 		@cert-authority *.cluster-a ssh-rsa AAA... type=user
				// We use URL encoding to pass the CA type and allowed logins into the comment field
				fmt.Fprintf(os.Stdout, "@cert-authority *.%s %s %s\n",
					ca.DomainName, strings.TrimSpace(string(keyBytes)), options.Encode())
			}
		}
	}
	return nil
}
// ExportAuthorities outputs the list of authorities in OpenSSH compatible formats
// If --type flag is given, only prints keys for CAs of this type, otherwise
// prints all keys
ExportAuthorities outputs the list of authorities in OpenSSH compatible formats
If --type flag is given, only prints keys for CAs of this type, otherwise
prints all keys
// ExportAuthorities outputs the list of authorities in OpenSSH compatible formats // If -- type flag is given only prints keys for CAs of this type otherwise // prints all keys
func (a *AuthCommand) ExportAuthorities(client *auth.TunClient) error {
	var typesToExport []services.CertAuthType
	if a.authType == "" {
		typesToExport = []services.CertAuthType{services.HostCA, services.UserCA}
	} else {
		authType := services.CertAuthType(a.authType)
		if err := authType.Check(); err != nil {
			return trace.Wrap(err)
		}
		typesToExport = []services.CertAuthType{authType}
	}
	localAuthName, err := client.GetDomainName()
	if err != nil {
		return trace.Wrap(err)
	}
	var authorities []*services.CertAuthority
	for _, at := range typesToExport {
		cas, err := client.GetCertAuthorities(at, a.exportPrivateKeys)
		if err != nil {
			return trace.Wrap(err)
		}
		for _, ca := range cas {
			if ca.DomainName == localAuthName {
				authorities = append(authorities, ca)
			}
		}
	}
	for _, ca := range authorities {
		if a.exportPrivateKeys {
			for _, key := range ca.SigningKeys {
				fingerprint, err := sshutils.PrivateKeyFingerprint(key)
				if err != nil {
					return trace.Wrap(err)
				}
				if a.exportAuthorityFingerprint != "" && fingerprint != a.exportAuthorityFingerprint {
					continue
				}
				os.Stdout.Write(key)
				fmt.Fprintf(os.Stdout, "\n")
			}
		} else {
			for _, keyBytes := range ca.CheckingKeys {
				fingerprint, err := sshutils.AuthorizedKeyFingerprint(keyBytes)
				if err != nil {
					return trace.Wrap(err)
				}
				if a.exportAuthorityFingerprint != "" && fingerprint != a.exportAuthorityFingerprint {
					continue
				}
				options := url.Values{
					"type": []string{string(ca.Type)},
				}
				if len(ca.AllowedLogins) > 0 {
					options["logins"] = ca.AllowedLogins
				}
				fmt.Fprintf(os.Stdout, "@cert-authority *.%s %s %s\n",
					ca.DomainName, strings.TrimSpace(string(keyBytes)), options.Encode())
			}
		}
	}
	return nil
}
func ( a * AuthCommand ) ExportAuthorities ( client * auth . TunClient ) error { var typesToExport [ ] services . CertAuthType if a . authType == " " { typesToExport = [ ] services . CertAuthType { services . HostCA , services . UserCA } } else { authType := services . CertAuthType ( a . authType ) if err := authType . Check ( ) ; err != nil { return trace . Wrap ( err ) } typesToExport = [ ] services . CertAuthType { authType } } localAuthName , err := client . GetDomainName ( ) if err != nil { return trace . Wrap ( err ) } var authorities [ ] * services . CertAuthority for _ , at := range typesToExport { cas , err := client . GetCertAuthorities ( at , a . exportPrivateKeys ) if err != nil { return trace . Wrap ( err ) } for _ , ca := range cas { if ca . DomainName == localAuthName { authorities = append ( authorities , ca ) } } } for _ , ca := range authorities { if a . exportPrivateKeys { for _ , key := range ca . SigningKeys { fingerprint , err := sshutils . PrivateKeyFingerprint ( key ) if err != nil { return trace . Wrap ( err ) } if a . exportAuthorityFingerprint != " " && fingerprint != a . exportAuthorityFingerprint { continue } os . Stdout . Write ( key ) fmt . Fprintf ( os . Stdout , " \n " ) } } else { for _ , keyBytes := range ca . CheckingKeys { fingerprint , err := sshutils . AuthorizedKeyFingerprint ( keyBytes ) if err != nil { return trace . Wrap ( err ) } if a . exportAuthorityFingerprint != " " && fingerprint != a . exportAuthorityFingerprint { continue } options := url . Values { " " : [ ] string { string ( ca . Type ) } , } if len ( ca . AllowedLogins ) > 0 { options [ " " ] = ca . AllowedLogins } fmt . Fprintf ( os . Stdout , " \n " , ca . DomainName , strings . TrimSpace ( string ( keyBytes ) ) , options . Encode ( ) ) } } } return nil }
ExportAuthorities outputs the list of authorities in OpenSSH compatible formats
If --type flag is given, only prints keys for CAs of this type, otherwise
prints all keys
ExportAuthorities outputs the list of authorities in OpenSSH compatible formats If -- type flag is given only prints keys for CAs of this type otherwise prints all keys
// if no --type flag is given, export all types // fetch authorities via auth API (and only take local CAs, ignoring // trusted ones) // print: // Every auth public key is exported as a single line adhering to man sshd (8) // authorized_hosts format, a space-separated list of: makrer, hosts, key, and comment // example: // 		@cert-authority *.cluster-a ssh-rsa AAA... type=user // We use URL encoding to pass the CA type and allowed logins into the comment field