16.2.1.15.21. SSHKey Token

class privacyidea.lib.tokens.sshkeytoken.SSHkeyTokenClass(db_token)

The SSHKeyTokenClass provides a TokenClass that stores the public SSH key. This can be used to manage SSH keys and retrieve the public ssh key to import it to authorized keys files.

Create a new token object.

Parameters:

db_token (Token) – A database token object

Returns:

A TokenClass object

static get_class_info(key=None, ret='all')

returns a subtree of the token definition

Parameters:

• key (string) – subsection identifier

• ret (user defined) – default return value, if nothing is found

Returns:

subsection if key exists or user defined

Return type:

dictionary

static get_class_prefix()

static get_class_type()

get_sshkey()

returns the public SSH key

Before returning the key, the integrity checksum stored in the encrypted OTP key field is verified. If the SSH key data in the database was manipulated or the checksum is missing, a TokenAdminError is raised.

Returns:

SSH pub key

Return type:

string

import_token(token_information: dict)

Import a given SSH key token and store the integrity checksum of the imported SSH key data in the encrypted OTP key field.

mode = ['authenticate']

owned_tokeninfo_keys = frozenset({'ssh_comment', 'ssh_key', 'ssh_type'})

remove_tokeninfo(key: str = None) → None

Delete a token info entry and keep the SSH key integrity checksum in sync when one of the SSH key relevant entries (or all entries) is removed.

update(param)

The key holds the public ssh key and this is required

The key probably is of the form “ssh-rsa BASE64 comment”

using_pin = False

write_tokeninfo(key: str, value: str, value_type: str = None, commit_db_session: bool = True) → None

Add a token info entry and keep the SSH key integrity checksum in sync.

Overriding the writer makes the token class the single enforcement point for the checksum: every caller that changes the SSH key data (update(), token import, …) goes through here, so the checksum can no longer be desynced by writing directly to the token info.

The value type of the public key is enforced here as well, so the key stays encrypted no matter which caller writes it.