From e00956f95b9f8337c19a343c5366609cfe3d3a55 Mon Sep 17 00:00:00 2001 From: t38miwa Date: Wed, 8 Oct 2025 22:41:53 +0900 Subject: [PATCH 1/7] docs: Use lowercase for positional argument placeholders in scripts/installing.md Changed {USER} {EMAIL} {ISSUER} to {user} {email} {issuer} to maintain consistency with other CLI tools like git and ssh. Fixes #352 Signed-off-by: t38miwa --- scripts/installing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/installing.md b/scripts/installing.md index 675a9873..5c52435c 100644 --- a/scripts/installing.md +++ b/scripts/installing.md @@ -83,7 +83,7 @@ If you do not have root access, you can create a new auth_id file in at ~/auth_i sudo touch /etc/opk/auth_id sudo chown root:opksshuser /etc/opk/auth_id sudo chmod 640 /etc/opk/auth_id -sudo opkssh add {USER} {EMAIL} {ISSUER} +sudo opkssh add {user} {email} {issuer} ``` **4: Configure sshd to use opkssh.** Check which configuration file is active. From a7604b047a9520a6ae0a085ea15fcdbe1b7f1a79 Mon Sep 17 00:00:00 2001 From: t38miwa Date: Wed, 8 Oct 2025 22:46:19 +0900 Subject: [PATCH 2/7] docs: Use lowercase for positional argument placeholders in docs/config.md Changed {USER} {EMAIL|SUB|CLAIM} {ISSUER} to {user} {email|sub|claim} {issuer} to maintain consistency with other CLI tools like git and ssh. Fixes #352 Signed-off-by: t38miwa --- docs/config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/config.md b/docs/config.md index 062d567b..94d54b96 100644 --- a/docs/config.md +++ b/docs/config.md @@ -151,7 +151,7 @@ dev oidc-match-end:email:@example.com https://login.microsoftonline.com/9188040d These `auth_id` files can be edited by hand or you can use the add command to add new policies. The add command has the following syntax. -`sudo opkssh add {USER} {EMAIL|SUB|CLAIM} {ISSUER}` +`sudo opkssh add {user} {email|sub|claim} {issuer}` For convenience you can use the shorthand `google`, `azure`, `gitlab` rather than specifying the entire issuer. This is especially useful in the case of azure where the issuer contains a long and hard to remember random string. From 75654ab95ae5be18f7e75d31172723dad3c0e1ab Mon Sep 17 00:00:00 2001 From: t38miwa Date: Wed, 8 Oct 2025 22:48:40 +0900 Subject: [PATCH 3/7] docs: Use lowercase for positional argument placeholders in README.md Changed {USER} {EMAIL/SUB/GROUP} {ISSUER} to {user} {email/sub/group} {issuer} and {ISSUER},{CLIENT_ID},{CLIENT_SECRET},{SCOPES} to {issuer},{client_id},{client_secret},{scopes} to maintain consistency with other CLI tools like git and ssh. Fixes #352 Signed-off-by: t38miwa --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 5bbed22e..6982d4a1 100644 --- a/README.md +++ b/README.md @@ -260,7 +260,7 @@ dev oidc:"https://acme.com/groups":developer https://login.microsoftonline.com/9 To add new rule run: -`sudo opkssh add {USER} {EMAIL/SUB/GROUP} {ISSUER}` +`sudo opkssh add {user} {email/sub/group} {issuer}` These `auth_id` files can be edited by hand or you can use the add command to add new policies. For convenience you can use the shorthand `google` or `azure` rather than specifying the entire issuer. @@ -320,16 +320,16 @@ AuthorizedKeysCommandUser opksshuser To log in using a custom OpenID Provider, run: ```bash -opkssh login --provider="{ISSUER},{CLIENT_ID}" +opkssh login --provider="{issuer},{client_id}" ``` or in the rare case that a client secret is required by the OpenID Provider: ```bash -opkssh login --provider="{ISSUER},{CLIENT_ID},{CLIENT_SECRET},{SCOPES}" +opkssh login --provider="{issuer},{client_id},{client_secret},{scopes}" ``` -where ISSUER, CLIENT_ID and CLIENT_SECRET correspond to the issuer client ID and client secret of the custom OpenID Provider. +where issuer, client_id and client_secret correspond to the issuer client ID and client secret of the custom OpenID Provider. For example if the issuer is `https://authentik.local/application/o/opkssh/` and the client ID was `ClientID123`: From be8b32e71efacc00b8dc9ba15c85074294d0cb46 Mon Sep 17 00:00:00 2001 From: t38miwa Date: Wed, 8 Oct 2025 22:55:14 +0900 Subject: [PATCH 4/7] Use lowercase for positional argument placeholders in main.go Changed placeholder names in command definitions to lowercase: - add: -> - readhome: -> - verify: -> This maintains consistency with other CLI tools like git and ssh. Fixes #352 Signed-off-by: t38miwa --- main.go | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/main.go b/main.go index 80e04aa1..0ec3ed82 100644 --- a/main.go +++ b/main.go @@ -75,16 +75,16 @@ This program allows users to: addCmd := &cobra.Command{ SilenceUsage: true, - Use: "add ", + Use: "add ", Short: "Appends new rule to the policy file", Long: `Add appends a new policy entry in the auth_id policy file granting SSH access to the specified email or subscriber ID (sub) or group. It first attempts to write to the system-wide file (/etc/opk/auth_id). If it lacks permissions to update this file it falls back to writing to the user-specific file (~/.opk/auth_id). Arguments: - PRINCIPAL The target user account (requested principal). - EMAIL|SUB|GROUP Email address, subscriber ID or group authorized to assume this principal. If using an OIDC group, the argument needs to be in the format of oidc:groups:. - ISSUER OpenID Connect provider (issuer) URL associated with the email/sub/group. + principal The target user account (requested principal). + email|sub|group Email address, subscriber ID or group authorized to assume this principal. If using an OIDC group, the argument needs to be in the format of oidc:groups:. + issuer OpenID Connect provider (issuer) URL associated with the email/sub/group. `, Args: cobra.ExactArgs(3), Example: ` opkssh add root alice@example.com https://accounts.google.com @@ -208,9 +208,9 @@ Arguments: readhomeCmd := &cobra.Command{ SilenceUsage: true, - Use: "readhome ", + Use: "readhome ", Short: "Read the principal's home policy file", - Long: `Read the principal's policy file (/home//.opk/auth_id). + Long: `Read the principal's policy file (/home//.opk/auth_id). You should not call this command directly. It is called by the opkssh verify command as part of the AuthorizedKeysCommand process to read the user's policy (principals) home file (~/.opk/auth_id) with sudoer permissions. This allows us to use an unprivileged user as the AuthorizedKeysCommand user. `, @@ -232,7 +232,7 @@ You should not call this command directly. It is called by the opkssh verify com var serverConfigPathArg string verifyCmd := &cobra.Command{ SilenceUsage: true, - Use: "verify ", + Use: "verify ", Short: "Verify an SSH key (used by sshd AuthorizedKeysCommand)", Long: `Verify extracts a PK token from a base64-encoded SSH certificate and verifies it against policy. It expects an allowed provider file at /etc/opk/providers and a user policy file at either /etc/opk/auth_id or ~/.opk/auth_id. @@ -256,9 +256,9 @@ Verification checks performed: If all checks pass, Verify authorizes the SSH connection. Arguments: - PRINCIPAL Target username. - CERT Base64-encoded SSH certificate. - KEY_TYPE SSH certificate key type (e.g., ecdsa-sha2-nistp256-cert-v01@openssh.com)`, + principal Target username. + cert Base64-encoded SSH certificate. + key_type SSH certificate key type (e.g., ecdsa-sha2-nistp256-cert-v01@openssh.com)`, Args: cobra.ExactArgs(3), Example: ` opkssh verify root ecdsa-sha2-nistp256-cert-v01@openssh.com`, RunE: func(cmd *cobra.Command, args []string) error { From 15c8fb8f93c534283a2d8b2b166ef88183e60be3 Mon Sep 17 00:00:00 2001 From: t38miwa Date: Thu, 9 Oct 2025 10:17:03 +0900 Subject: [PATCH 5/7] =?UTF-8?q?docs:=20Use=20angle=20brackets=20for=20posi?= =?UTF-8?q?tional=20argument=20placeholders=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=E2=94=82=20=E2=94=82=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=E2=94=82=20?= =?UTF-8?q?=E2=94=82=20=20=20Changed=20curly=20braces=20to=20angle=20brack?= =?UTF-8?q?ets=20for=20consistency:=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=E2=94=82=20?= =?UTF-8?q?=E2=94=82=20=20=20-=20{user}=20{email}=20{issuer}=20=E2=86=92?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=E2=94=82=20=E2=94=82=20=20=20-=20{user}=20{email|sub|cla?= =?UTF-8?q?im}=20{issuer}=20=E2=86=92=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=E2=94=82=20?= =?UTF-8?q?=E2=94=82=20=20=20-=20{user}=20{email/sub/group}=20{issuer}=20?= =?UTF-8?q?=E2=86=92=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=E2=94=82=20=E2=94=82=20=20=20-?= =?UTF-8?q?=20{issuer},{client=5Fid}=20=E2=86=92=20,?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=E2=94=82=20=E2=94=82=20=20=20-=20{issuer},{client=5Fid},{clien?= =?UTF-8?q?t=5Fsecret},{scopes}=20=E2=86=92=20,,,=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=E2=94=82?= =?UTF-8?q?=20=E2=94=82=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=E2=94=82=20=E2=94=82=20=20=20This=20fo?= =?UTF-8?q?llows=20the=20common=20convention=20used=20by=20other=20CLI=20t?= =?UTF-8?q?ools=20where=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=E2=94=82=20=E2=94=82=20=20=20angle=20brackets=20in?= =?UTF-8?q?dicate=20user-supplied=20values.=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=E2=94=82=20=E2=94=82=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20?= =?UTF-8?q?=E2=94=82=20=E2=94=82=20=20=20Fixes=20#352?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 6 +++--- docs/config.md | 2 +- scripts/installing.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 6982d4a1..4fdf5f8f 100644 --- a/README.md +++ b/README.md @@ -260,7 +260,7 @@ dev oidc:"https://acme.com/groups":developer https://login.microsoftonline.com/9 To add new rule run: -`sudo opkssh add {user} {email/sub/group} {issuer}` +`sudo opkssh add ` These `auth_id` files can be edited by hand or you can use the add command to add new policies. For convenience you can use the shorthand `google` or `azure` rather than specifying the entire issuer. @@ -320,13 +320,13 @@ AuthorizedKeysCommandUser opksshuser To log in using a custom OpenID Provider, run: ```bash -opkssh login --provider="{issuer},{client_id}" +opkssh login --provider="," ``` or in the rare case that a client secret is required by the OpenID Provider: ```bash -opkssh login --provider="{issuer},{client_id},{client_secret},{scopes}" +opkssh login --provider=",,," ``` where issuer, client_id and client_secret correspond to the issuer client ID and client secret of the custom OpenID Provider. diff --git a/docs/config.md b/docs/config.md index 94d54b96..9f7e2eda 100644 --- a/docs/config.md +++ b/docs/config.md @@ -151,7 +151,7 @@ dev oidc-match-end:email:@example.com https://login.microsoftonline.com/9188040d These `auth_id` files can be edited by hand or you can use the add command to add new policies. The add command has the following syntax. -`sudo opkssh add {user} {email|sub|claim} {issuer}` +`sudo opkssh add ` For convenience you can use the shorthand `google`, `azure`, `gitlab` rather than specifying the entire issuer. This is especially useful in the case of azure where the issuer contains a long and hard to remember random string. diff --git a/scripts/installing.md b/scripts/installing.md index 5c52435c..c064dd86 100644 --- a/scripts/installing.md +++ b/scripts/installing.md @@ -83,7 +83,7 @@ If you do not have root access, you can create a new auth_id file in at ~/auth_i sudo touch /etc/opk/auth_id sudo chown root:opksshuser /etc/opk/auth_id sudo chmod 640 /etc/opk/auth_id -sudo opkssh add {user} {email} {issuer} +sudo opkssh add ``` **4: Configure sshd to use opkssh.** Check which configuration file is active. From b15915096e2373d58c32b0a6f0f6bd67d9829ea8 Mon Sep 17 00:00:00 2001 From: t38miwa Date: Thu, 9 Oct 2025 14:35:42 +0900 Subject: [PATCH 6/7] chore: Trigger CI workflow rerun Add comment to trigger workflow execution again to verify if the CentOS Docker image issue is intermittent or persistent. Related to #352 Signed-off-by: t38miwa --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4fdf5f8f..76a805b2 100644 --- a/README.md +++ b/README.md @@ -525,4 +525,4 @@ For integration tests run: - [docs/gitlab-selfhosted.md](docs/gitlab-selfhosted.md) Guide on configuring and using a self hosted GitLab instance with opkssh. - [docs/paramiko.md](docs/paramiko.md) Guide to using the python SSH paramiko library with opkssh. - [docs/putty.md](docs/putty.md) Guide to using PuTTY with opkssh. - +change for one more time workflow \ No newline at end of file From a8201a6460a647b3088209fb3497a5c6b6e40e4f Mon Sep 17 00:00:00 2001 From: t38miwa Date: Thu, 9 Oct 2025 14:44:13 +0900 Subject: [PATCH 7/7] chore: fixed Readme.md which was changed to rerun workflow Add comment to trigger workflow execution again to verify if the CentOS Docker image issue is intermittent or persistent. Related to #352 Signed-off-by: t38miwa --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index 76a805b2..5ec2ad14 100644 --- a/README.md +++ b/README.md @@ -524,5 +524,4 @@ For integration tests run: - [CONTRIBUTING.md](https://github.com/openpubkey/opkssh/blob/main/CONTRIBUTING.md) Guide to contributing to opkssh (includes developer help). - [docs/gitlab-selfhosted.md](docs/gitlab-selfhosted.md) Guide on configuring and using a self hosted GitLab instance with opkssh. - [docs/paramiko.md](docs/paramiko.md) Guide to using the python SSH paramiko library with opkssh. -- [docs/putty.md](docs/putty.md) Guide to using PuTTY with opkssh. -change for one more time workflow \ No newline at end of file +- [docs/putty.md](docs/putty.md) Guide to using PuTTY with opkssh. \ No newline at end of file