From a18b10ecae6bbae6b547501f5acb088c30340aa9 Mon Sep 17 00:00:00 2001
From: Alexander Scheel <alex.scheel@hashicorp.com>
Date: Wed, 31 May 2023 09:36:07 -0400
Subject: [PATCH] Add tests issuing certificate and using against docker
 (#20890)

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
---
 builtin/logical/ssh/backend_test.go | 51 +++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/builtin/logical/ssh/backend_test.go b/builtin/logical/ssh/backend_test.go
index 02224e0ef6..13f9f73624 100644
--- a/builtin/logical/ssh/backend_test.go
+++ b/builtin/logical/ssh/backend_test.go
@@ -948,12 +948,63 @@ cKumubUxOfFdy1ZvAAAAEm5jY0BtYnAudWJudC5sb2NhbA==
 					return nil
 				},
 			},
+			testIssueCert("testcarole", "ec", testUserName, sshAddress, expectError),
+			testIssueCert("testcarole", "ed25519", testUserName, sshAddress, expectError),
+			testIssueCert("testcarole", "rsa", testUserName, sshAddress, expectError),
 		},
 	}
 
 	logicaltest.Test(t, testCase)
 }
 
+func testIssueCert(role string, keyType string, testUserName string, sshAddress string, expectError bool) logicaltest.TestStep {
+	return logicaltest.TestStep{
+		Operation: logical.UpdateOperation,
+		Path:      "issue/" + role,
+		ErrorOk:   expectError,
+		Data: map[string]interface{}{
+			"key_type":         keyType,
+			"valid_principals": testUserName,
+		},
+
+		Check: func(resp *logical.Response) error {
+			// Tolerate nil response if an error was expected
+			if expectError && resp == nil {
+				return nil
+			}
+
+			signedKey := strings.TrimSpace(resp.Data["signed_key"].(string))
+			if signedKey == "" {
+				return errors.New("no signed key in response")
+			}
+
+			privKey, err := ssh.ParsePrivateKey([]byte(resp.Data["private_key"].(string)))
+			if err != nil {
+				return fmt.Errorf("error parsing private key: %v", err)
+			}
+
+			parsedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(signedKey))
+			if err != nil {
+				return fmt.Errorf("error parsing signed key: %v", err)
+			}
+			certSigner, err := ssh.NewCertSigner(parsedKey.(*ssh.Certificate), privKey)
+			if err != nil {
+				return err
+			}
+
+			err = testSSH(testUserName, sshAddress, ssh.PublicKeys(certSigner), "date")
+			if expectError && err == nil {
+				return fmt.Errorf("expected error but got none")
+			}
+			if !expectError && err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+}
+
 func TestSSHBackend_CAUpgradeAlgorithmSigner(t *testing.T) {
 	cleanup, sshAddress := prepareTestContainer(t, dockerImageTagSupportsRSA1, testCAPublicKey)
 	defer cleanup()