Keep proxycommand from sending the SSH user as a principal.

[flatheadmill]

I've configured SSH to use ~/.ssh/authorized_principals so that a user [email protected] can log in using [email protected]. When the user key expires, step ssh proxycommand will send a signing request with the principal fred which is rejected with ...

The request was forbidden by the certificate authority: ssh certificate principals does not match - got [fred], want [fredflinstone fredflinstone [email protected]].

I tell Fred to just use step ssh login for now.

Is there a way to tell step ssh proxycommand to just use the email returned from the OIDC token?

I'm aware that I can solve this by writing an alternative to step ssh proxycommand. Just want to make sure I'm not missing anything.

[flatheadmill]

Realize this is more of a step-cli issue. Sorry. Should I move it?

[maraino]

Hi @flatheadmill, Are you using the open-source version of step-ca?

I believe you're, looking at the code I don't see a way right now to behave exactly as step ssh login. The change should be simple, although it might require a custom configuration of ~/.step/ssh/config.

For the moment, I think the best solution is to use step ssh login once per day, it's possible to replace step ssh proxycommand with a bash script that works properly for that case, but it will be more costly than running step ssh login once per day.

If you want to adventure on the source code, perhaps replacing this like
https://github.com/smallstep/cli/blob/b6adb572306d49d207f6d76fb982374351505817/command/ssh/proxycommand.go#L136

principals := []string{subject}

with something like this

if subject != "" {
	principals := []string{subject}
}

and passing "" as the first argument to proxycommand instead of %r might do the trick.

[flatheadmill]

I did read through proxycommand.go before posting. I could make this change, but I could also work on it as a PR. Would this be something that would be accepted as a PR?

[maraino]

I did read through proxycommand.go before posting. I could make this change, but I could also work on it as a PR. Would this be something that would be accepted as a PR?

@flatheadmill I think so, I think it will work like step ssh login with that change.

[Janhouse]

Related to smallstep/cli#807

[maraino]

@flatheadmill, @Janhouse This PR might fix this issue #1206